AWS EKS

​

Overview

The AWS EKS integration ingests EKS control plane logs that are streamed to CloudWatch Logs:

• api: Kubernetes API server requests
• audit: admission and authorization decisions
• authenticator: IAM-to-Kubernetes identity mapping events
• controllerManager: controller reconcile loops
• scheduler: pod scheduling decisions

---

​

Prerequisites

• An EKS cluster with control plane logging enabled.
• IAM credentials with read access to the cluster’s log group.

---

​

Step 1: Enable EKS control plane logging

1. Open the AWS Console → EKS → Clusters and select your cluster.
2. Open the Observability tab.
3. Under Control plane logging, click Manage logging and enable the log types you need:
   • API server
   • Audit
   • Authenticator
   • Controller manager
   • Scheduler
4. Click Save changes. EKS will create a log group named /aws/eks/<cluster-name>/cluster.

---

​

Step 2: Create an IAM user with log read access

1. Open IAM → Users → Create user, name it atatus-eks-reader.
2. Attach an inline policy granting:
   • logs:DescribeLogGroups
   • logs:DescribeLogStreams
   • logs:GetLogEvents
   • logs:FilterLogEvents
3. Scope the policy to the EKS log group ARN.
4. Create an access key under Security credentials → Create access key and copy both values.

---

​

Step 3: Connect AWS EKS in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the AWS EKS card and click Connect.
3. Fill in the form:

4. Click Connect.

---

​

Verification

• The AWS EKS card shows Configured.
• Control plane events appear in Security → Cloud SIEM → Audit Logs → Events with source aws_eks.