EKS cluster has all control plane log types enabled

Check ID: eks_control_plane_logging_all_types_enabled
Provider: AWS
Service: eks
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: AwsEksCluster

What this check verifies

Amazon EKS clusters are evaluated for control plane logging coverage of required types: api, audit, authenticator, controllerManager, scheduler. The finding identifies clusters where any of these log types are not configured.

Risk

Gaps in control plane logging reduce visibility across the cluster.

Confidentiality: undetected API access, RBAC abuse, token misuse
Integrity: untraceable config changes and policy edits
Availability: scheduler/controller issues lack evidence, delaying recovery and masking attacker persistence

Recommendation

Enable and standardize EKS control plane logging for all required types ["api","audit","authenticator","controllerManager","scheduler"]. Apply least privilege to log access, set retention and alerts, and centralize analysis to support defense in depth, rapid detection, and reliable forensics.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws eks update-cluster-config --name <cluster_name> --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'

# Enable all required EKS control plane log types
resource "aws_eks_cluster" "<example_resource_name>" {
  enabled_cluster_log_types = [
    "api",            # Critical: required control plane log types
    "audit",          # Critical: required control plane log types
    "authenticator",  # Critical: required control plane log types
    "controllerManager", # Critical: required control plane log types
    "scheduler"       # Critical: required control plane log types
  ]
}

# CloudFormation: enable all EKS control plane log types
Resources:
  <example_resource_name>:
    Type: AWS::EKS::Cluster
    Properties:
      RoleArn: <example_role_arn>
      ResourcesVpcConfig:
        SubnetIds: [<example_subnet_id>]
      Logging:
        ClusterLogging:
          - EnabledTypes:
              - Type: api            # Critical: enable required control plane log types
              - Type: audit          # Critical: enable required control plane log types
              - Type: authenticator  # Critical: enable required control plane log types
              - Type: controllerManager  # Critical: enable required control plane log types
              - Type: scheduler      # Critical: enable required control plane log types

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = eks_control_plane_logging_all_types_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EKS cluster uses a supported Kubernetes version ElastiCache cluster is not using public subnets

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires