Back to Checks
aws

GuardDuty detector has EKS Audit Log Monitoring enabled

guardduty_eks_audit_log_enabled
Service: guarddutySeverity: high
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:AwsGuardDutyDetector

Amazon GuardDuty detectors are evaluated for EKS Audit Log Monitoring (EKS_AUDIT_LOGS) being enabled to analyze Kubernetes audit activity from your Amazon EKS clusters.

Prowler logoProwlerprowler-provider-aws

Risk

Without it, Kubernetes API abuse may go undetected, impacting CIA:

  • Secret access and data exfiltration
  • RBAC changes enabling privilege escalation
  • Rogue deployments for persistence/cryptomining

Attackers can laterally move to AWS using harvested credentials.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks guardduty_eks_audit_log_enabled

Recommendation

Enable EKS Audit Log Monitoring on all detectors in every required Region, centrally managed by the GuardDuty administrator.

  • Route findings to alerting/IR workflows
  • Enforce least privilege on access to findings and configs
  • Combine with defense-in-depth: hardened RBAC and runtime monitoring

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --features '[{"Name":"EKS_AUDIT_LOGS","Status":"ENABLED"}]'

Terraform

# Enable EKS Audit Log Monitoring on GuardDuty detector
resource "aws_guardduty_detector" "example" {
  enable = true

  features {
    name   = "EKS_AUDIT_LOGS"
    status = "ENABLED"  # CRITICAL: Enables EKS Audit Log Monitoring
  }
}

NativeIaC

# CloudFormation: Enable EKS Audit Log Monitoring on GuardDuty detector
Resources:
  GuardDutyDetector:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      DataSources:
        Kubernetes:
          AuditLogs:
            Enable: true  # CRITICAL: Enables EKS Audit Log Monitoring

Other

1Open the AWS Console and go to Amazon GuardDuty
2Select the Region where you want to enable it
3In the left menu, click EKS Protection
4Click Enable and confirm
5If using AWS Organizations, perform these steps in the delegated GuardDuty administrator account

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client


class guardduty_eks_audit_log_enabled(Check):
    def execute(self):
        findings = []
        for detector in guardduty_client.detectors:
            if detector.status:
                report = Check_Report_AWS(metadata=self.metadata(), resource=detector)
                report.status = "FAIL"
                report.status_extended = f"GuardDuty detector {detector.id} does not have EKS Audit Log Monitoring enabled."
                if detector.eks_audit_log_protection:
                    report.status = "PASS"
                    report.status_extended = f"GuardDuty detector {detector.id} has EKS Audit Log Monitoring enabled."
                findings.append(report)
        return findings

References