Skip to content

Disable EKS API audit logging

Platform Author Last Update
aws Anela Tiro 2023-07-01

An adversary may attempt to disable the exporting of the control plane API logs to CloudWatch

MITRE IDs

Required Permissions

  • eks:UpdateClusterConfig

Required Parameters

Name Type Description Example Value
name str Cluster name which will be updated cluster_name

Attacker Action

aws eks update-cluster-config --name cluster_name --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":false}]}'

Detection Case

ELK query

When logs are ingested into ELK, the following Lucene query can be used to identify relevant events.

eventName:UpdateClusterConfig AND eventSource:*.eks.amazonaws.com  

Sigma Definition

---
title: Disable EKS API audit logging
id: testing
status: experimental
author: Anela Tiro
date: 2023-07-01
description: An adversary may attempt to disable the exporting of the control plane API logs to CloudWatch
logsource:
  service: cloudtrail
detection:
  selection_source:
    - eventSource: "*.eks.amazonaws.com"
  events:
    - eventName: "UpdateClusterConfig"
  condition: selection_source AND events
level: low
tags:
  - attack.None