Description

Detects Amazon EKS clusters that have disabled logging configurations. When cluster logging is disabled, there is reduced visibility into cluster activities, making it difficult to monitor security events, conduct audits, and investigate potential security incidents.

Detection Strategy

• Retrieves all EKS clusters in the specified AWS region

• For each cluster, examines the logging configuration under the cluster settings

• Reports a vulnerability if any logging configuration entry is found with 'enabled' set to false

• Each disabled logging configuration is reported separately with its specific location in the cluster configuration