aws:eks-audit
EKS control-plane audit log
- Host type
- AWS
- Tier, as a whole
- Recommended
- Cost class
- Usage billed
- Techniques
- 0
- Rules listed
- 42
- Events
- 3
Licensing
- License or service
- CloudWatch Logs
- What is free
- Off by default; no EKS fee for the feature
- What costs
- "standard CloudWatch Logs data ingestion and storage costs"
- Notes
- Types: api/audit/authenticator/controllerManager/scheduler
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
No ATT&CK analytic names this source.
Rules
Elastic 42
- AWS EKS API Request Impersonating Privileged Identity
- AWS EKS API Server Proxying Request to Kubelet
- AWS EKS Admission Webhook Created or Modified
- AWS EKS Anonymous Request Authorized by Unusual User Agent
- AWS EKS Anonymous User Create/Update/Patch Pods Request
- AWS EKS Authentication Configuration Modified
- AWS EKS Client Certificate Signing Request Created or Approved
- AWS EKS Cluster-Admin Role Binding Created
- AWS EKS Container Created with Excessive Linux Capabilities
- AWS EKS CoreDNS or Kube-DNS Configuration Modified
- AWS EKS Creation of a RoleBinding Referencing a ServiceAccount
- AWS EKS Creation or Modification of Sensitive Role
- AWS EKS Ephemeral Container Added to Pod
- AWS EKS Events Deleted
- AWS EKS Exposed Service Created With Type NodePort
- AWS EKS Forbidden Creation Request
- AWS EKS Forbidden Request from Unusual User Agent
- AWS EKS Multi-Resource Discovery
- AWS EKS Pod Created With HostIPC
- AWS EKS Pod Created With HostNetwork
- AWS EKS Pod Created With HostPID
- AWS EKS Pod Created with a Sensitive hostPath Volume
- AWS EKS Pod Exec Cloud Instance Metadata Access
- AWS EKS Pod Exec Potential Reverse Shell
- AWS EKS Pod Exec Sensitive File or Credential Path Access
- AWS EKS Pod Exec with Curl or Wget to HTTPS
- AWS EKS Potential Endpoint Permission Enumeration Attempt Detected
- AWS EKS Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected
- AWS EKS Privileged Pod Created
- AWS EKS RBAC Wildcard Elevation on Existing Role
- AWS EKS Rapid Secret GET Activity Against Multiple Objects
- AWS EKS Secret get or list from Node or Pod Service Account
- AWS EKS Secret get or list with Suspicious User Agent
- AWS EKS Secrets List Across Cluster or Sensitive Namespaces
- AWS EKS Sensitive RBAC Change Followed by Workload Modification
- AWS EKS Service Account Modified RBAC Objects
- AWS EKS Service Account Token Created via TokenRequest API
- AWS EKS Suspicious Assignment of Controller Service Account
- AWS EKS Suspicious Self-Subject Review via Unusual User Agent
- AWS EKS Unusual Decision by User Agent
- AWS EKS Unusual Kubernetes Sensitive Workload Modification
- AWS EKS User Exec into Pod