EKS clusters should have audit logging enabled

How to fix it

In the console

EKS → Clusters → the cluster → Cluster monitoring → Control plane logging

Audit

On; the other log types are optional

With the AWS CLI

aws eks update-cluster-config --name <cluster-name> --logging '{"clusterLogging":[{"types":["audit"],"enabled":true}]}' --region <region>

With Terraform

• Overwrites existing settings: enabled_cluster_log_types is the cluster's whole set of log types, so keep any it already sends, such as api or authenticator, in the list.

resource "aws_eks_cluster" "this" {
  name                      = "example"
  role_arn                  = aws_iam_role.eks_cluster.arn
  enabled_cluster_log_types = ["audit"]

  vpc_config {
    subnet_ids = var.subnet_ids
  }
}