# Ensure EKS Control Plane Audit Logging is enabled for all log types

- Source: https://support.icompaas.com/support/solutions/articles/62000229615-ensure-eks-control-plane-audit-logging-is-enabled-for-all-log-types
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**

Amazon Elastic Kubernetes Service (EKS) control plane audit logging enables you to collect logs of all control plane API requests and events. This includes requests made by users, administrators, and system components. Audit logs can be used to troubleshoot issues, investigate security incidents, and comply with regulatory requirements.

**Rationale:**

Audit logging is an important security measure for EKS clusters. It can help you to:

-   Identify unauthorized access to the control plane
-   Track changes to cluster configuration
-   Investigate security incidents
-   Comply with regulatory requirements

**Impact:**

Enabling audit logging for all log types will give you the most comprehensive view of activity on the EKS control plane. This can help you to improve security and compliance, and to troubleshoot issues more effectively.

**Default Value:**

By default, audit logging is disabled for all log types in EKS clusters.

**Pre-Requisite:**

To follow this policy, you will need to have access to the AWS Management Console or the AWS CLI. You will also need to know the ID of the EKS cluster that you want to update.

**Remediation Steps:**

To remediate this issue, you can follow these steps:

1.  In the AWS Management Console, go to the **EKS** page.
2.  Select the cluster that you want to update.
3.  Click the **Logging** tab.
4.  For each log type, select **Enabled**.
5.  Click **Save**.

**Test Plan:**

To test that the policy has been implemented correctly, you can use the following steps:

1.  Check the EKS control plane logs to see if they are being generated for all log types.
2.  Verify that the logs contain information about API requests and events.

**Implementation Plan:**

The following are the steps on how to implement this policy:

1.  Identify the EKS clusters that do not have audit logging enabled for all log types.
2.  Enable audit logging for all log types in the EKS clusters.
3.  Test that the policy has been implemented correctly.

**AWS CLI Process:**

To enable audit logging for all log types in an EKS cluster using the AWS CLI, you can use the following command:

```
aws eks update-cluster-logging --cluster-name my-cluster --enable-audit-logs --all-log-types
```

**Using AWS GUI:**

To enable audit logging for all log types in an EKS cluster using the AWS GUI, you can follow these steps:

1.  Go to the AWS Management Console.
2.  Click on the **EKS** service.
3.  Click on the **Clusters** tab.
4.  Select the cluster that you want to update.
5.  Click on the **Logging** tab.
6.  For each log type, select **Enabled**.
7.  Click on the **Save** button.

**Backout Plan:**

To revoke the changes that you made to the audit logging configuration in an EKS cluster, you can follow these steps:

1.  In the AWS Management Console, go to the **EKS** page.
2.  Select the cluster that you want to update.
3.  Click the **Logging** tab.
4.  For each log type, select **Disabled**.
5.  Click **Save**.

**Note:**

-   You can also use the AWS CLI or the AWS GUI to disable audit logging for all log types in an EKS cluster.
-   If you disable audit logging, you will lose the ability to collect logs of all control plane API requests and events.

**Reference:**

-   AWS documentation on EKS control plane audit logging: https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html

**Section 2:**

-   Tags: security, audit logging, EKS
-   Keywords: control plane, logs, remediation, backout, policy

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.