---
controls:
version: "eks-1.7.0"
id: 2
text: "Control Plane Configuration"
type: "controlplane"
groups:
  - id: 2.1
    text: "Logging"
    checks:
      - id: 2.1.1
        text: "Enable audit Logs (Manual)"
        type: manual
        remediation: |
          From Console:
          1.  For each EKS Cluster in each region;
          2.  Go to 'Amazon EKS' > 'Clusters' > '' > 'Configuration' > 'Logging'.
          3.  Click 'Manage logging'.
          4.  Ensure that all options are toggled to 'Enabled'.
                API server: Enabled
                Audit: Enabled
                Authenticator: Enabled
                Controller manager: Enabled
                Scheduler: Enabled
          5.  Click 'Save Changes'.

          From CLI:
          # For each EKS Cluster in each region;
          aws eks update-cluster-config \
            --region '${REGION_CODE}' \
            --name '${CLUSTER_NAME}' \
            --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'
        scored: false

      - id: 2.1.2
        text: "Ensure audit logs are collected and managed (Manual)"
        type: manual
        remediation: |
          Create or update the audit-policy.yaml to specify the audit logging configuration:
          apiVersion: audit.k8s.io/v1
          kind: Policy
          rules:
            - level: Metadata
              resources:
                - group: ""
                  resources: ["pods"]
          Apply the audit policy configuration to the cluster:
            kubectl apply -f <path-to-audit-policy>.yaml
          Ensure audit logs are forwarded to a centralized logging system like CloudWatch, Elasticsearch, or another log management solution:
            kubectl create configmap cluster-audit-policy --from-file=audit-policy.yaml -n kube-system
            kubectl apply -f - <<EOF
          apiVersion: v1
          kind: Pod
          metadata:
            name: audit-logging
            namespace: kube-system
          spec:
            containers:
              - name: audit-log-forwarder
                image: my-log-forwarder-image
                volumeMounts:
                  - mountPath: /etc/kubernetes/audit
                    name: audit-config
            volumes:
              - name: audit-config
                configMap:
                  name: cluster-audit-policy
            EOF
        scored: false
