All checks
High
GuardDuty EKS Audit Log Monitoring should be enabled
Checks that GuardDuty EKS Audit Log Monitoring is enabled on this Region's detector, so GuardDuty reads the Kubernetes audit logs of every EKS cluster here to detect suspicious activity. It also fails while GuardDuty is suspended in the Region. In an AWS Organization, only the GuardDuty delegated administrator can change this for a member account.
- service
- GuardDuty
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
GuardDuty → Protection plans → EKS Protection
- EKS Audit Log Monitoring
- Enable; EKS control plane logging does not need to be on
With the AWS CLI
aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"EKS_AUDIT_LOGS","Status":"ENABLED"}]'With Terraform
resource "aws_guardduty_detector_feature" "this" {
detector_id = aws_guardduty_detector.this.id
name = "EKS_AUDIT_LOGS"
status = "ENABLED"
}See which of your accounts this check is failing on.
Book a live scan