Skip to main content
emnode / learn
Compliance Medium severity

AWS Security Hub · EKS

EKS.8: EKS clusters should have audit logging

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub EKS.8 check?

EKS.8 fails when a cluster does not have the Kubernetes `audit` control-plane log type enabled. This is distinct from the always-on infrastructure logging people assume they already have.

Why does EKS.8 matter?

When audit logging is off, the control plane does not buffer events for later — it never generates the records at all. So during an incident, teams who discover audit logging was off get nothing for the period before they turned it on, not a partial trail. It is installing the security camera after the burglary: the fix takes seconds, but the missing window is permanent.

How do I fix EKS.8?

  1. Inspect each cluster's logging configuration with the CLI to see which log types are enabled.
  2. Enable the `audit` log type (alongside the others you need) so events flow to CloudWatch Logs.
  3. Size and budget the CloudWatch ingestion, since busy clusters can produce significant audit volume.
  4. Do not confuse this control-plane audit log with GuardDuty EKS Audit Log Monitoring; default new clusters to audit logging on.

Remediation script · bash

# Enable the EKS audit log type (non-disruptive), then bound the cost with retention.
aws eks update-cluster-config \
  --name prod-platform \
  --logging '{"clusterLogging":[{"types":["audit"],"enabled":true}]}'

aws logs put-retention-policy \
  --log-group-name /aws/eks/prod-platform/cluster \
  --retention-in-days 90

# Turn on GuardDuty EKS Audit Log Monitoring and auto-enable for the whole org.
DETECTOR=$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)
aws guardduty update-detector --detector-id "$DETECTOR" \
  --features '[{"Name":"EKS_AUDIT_LOGS","Status":"ENABLED"}]'
aws guardduty update-organization-configuration --detector-id "$DETECTOR" \
  --features '[{"Name":"EKS_AUDIT_LOGS","AutoEnable":"ALL"}]'

Full walkthrough (console steps, edge cases and verification) in the lesson Enable cluster and search audit logging.

Full lesson Enable cluster and search audit logging Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for EKS controls ↗ Check your own account for EKS.8 →
Part of the learning path See what's happening

More EKS controls

  • EKS.1 An EKS cluster API endpoint is public
  • EKS.2 An EKS cluster runs an unsupported Kubernetes version
  • EKS.3 EKS clusters should use encrypted K8s secrets
  • EKS.9 An EKS node group runs an unsupported Kubernetes version