GuardDuty detector has EKS Audit Log Monitoring enabled

Check ID: guardduty_eks_audit_log_enabled
Provider: AWS
Service: guardduty
Severity: HIGH
Categories: cluster-security
Resource type: AwsGuardDutyDetector

What this check verifies

Amazon GuardDuty detectors are evaluated for EKS Audit Log Monitoring (EKS_AUDIT_LOGS) being enabled to analyze Kubernetes audit activity from your Amazon EKS clusters.

Risk

Without it, Kubernetes API abuse may go undetected, impacting CIA:

Secret access and data exfiltration
RBAC changes enabling privilege escalation
Rogue deployments for persistence/cryptomining

Attackers can laterally move to AWS using harvested credentials.

Recommendation

Enable EKS Audit Log Monitoring on all detectors in every required Region, centrally managed by the GuardDuty administrator.

Route findings to alerting/IR workflows
Enforce least privilege on access to findings and configs
Combine with defense-in-depth: hardened RBAC and runtime monitoring

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws guardduty update-detector --detector-id <detector-id> --features '[{"Name":"EKS_AUDIT_LOGS","Status":"ENABLED"}]'

# Enable EKS Audit Log Monitoring on GuardDuty detector
resource "aws_guardduty_detector" "example" {
  enable = true

  features {
    name   = "EKS_AUDIT_LOGS"
    status = "ENABLED"  # CRITICAL: Enables EKS Audit Log Monitoring
  }
}

# CloudFormation: Enable EKS Audit Log Monitoring on GuardDuty detector
Resources:
  GuardDutyDetector:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      DataSources:
        Kubernetes:
          AuditLogs:
            Enable: true  # CRITICAL: Enables EKS Audit Log Monitoring

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_eks_audit_log_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

GuardDuty detector has Malware Protection for EC2 enabled GuardDuty detector has EKS Runtime Monitoring enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires