Amazon EKS
      Back to home
      1. CNS Policies
      2. AWS Knowledge Base
      3. Amazon EKS

      EKS Logging Disabled

      Risk Level: Medium

      Description: 

      This plugin guarantees that all logs from EKS clusters are forwarded to CloudWatch. EKS may provide cluster event and audit logs, as well as control plane logs, to CloudWatch. For security analysis, all logs should be transmitted to CloudWatch.

      About the Service :

      Amazon Elastic Kubernetes Service (Amazon EKS) is a managed container service for running and scaling Kubernetes applications in the cloud or on-premises. With Amazon EKS, you can take advantage of all the performance, scale, reliability, and availability of AWS infrastructure, as well as integrations with AWS networking and security services. 

      Impact : 

      Disabled logs make the EKS cluster insecure and hinder the efficient running of your EKS cluster.

      Steps to reproduce :

      1. Log In to your AWS Console.
      2. Open the Amazon EKS console. You can use this link (https://console.aws.amazon.com/eks) to navigate directly if already logged in. 
      3. From the list of clusters available, click on the Cluster name of the cluster you wish to investigate.
      4. Move to the Logging tab of the cluster configuration page.
      5. Check if the log types are enabled or not.
      6. We can see that all the log types are disabled, this suggests that the EKS logging are disabled.
      7. Repeat the same steps for other clusters as well.

      Steps for remediation :

      1. Log In to your AWS Console.
      2. Open the Amazon EKS console. You can use this link (https://console.aws.amazon.com/eks) to navigate directly if already logged in. 
      3. From the list of clusters available, click on the Cluster name of the cluster you wish to investigate.
      4. Move to the Logging tab of the cluster configuration page.
      5. Check if the log types are enabled or not.
      6. We can see that all the log types are disabled, this suggests that the EKS logging are disabled.
      7. We will click on the Manage logging button and enable the logging type that we want to and click Update to save the settings.
      8. Repeat the same steps for other clusters as well.

      References: