Control plane logs are off by default; enable the ones that answer 'who did what'.

Control plane log types

audit	Every API call: who, what, when. The forensic record.
authenticator	IAM to Kubernetes identity mapping events.
api	API server logs for troubleshooting.
controllerManager, scheduler	Reconciliation and scheduling diagnostics.

enable audit and authenticator logs

$ aws eks update-cluster-config --name shop-eu \
  --logging '{"clusterLogging":[{"enabled":true,
  "types":["api","audit","authenticator"]}]}'

Cost and retention

Logs go to CloudWatch Logs and can be large. Set retention, filter noisy users in the audit policy where possible, and consider shipping to S3.

GuardDuty EKS protection

Analyses audit logs for suspicious API activity and can add runtime monitoring on nodes.

CloudTrail

Records AWS-side actions such as access entry changes, role assumptions and cluster updates.

Inspector and ECR scanning

Finds vulnerabilities in images and node packages. Gate deployments on severity.

Turn on the logs and detections before you need them

Several valuable control plane logs are disabled by default and are opt-in per type. The audit log records every request to the Kubernetes API with the identity that made it, and is the single most important forensic source after an incident. The authenticator log shows how IAM identities were mapped. The api, controllerManager and scheduler logs help with troubleshooting. They are delivered to CloudWatch Logs, so set a retention period and watch volume and cost.

On top of logs, enable detection. Amazon GuardDuty offers EKS protection that analyses audit logs for suspicious activity such as anonymous access, privilege escalation or access from unusual locations, and optional runtime monitoring on nodes. CloudTrail captures the AWS-side actions: changes to access entries, role assumptions and cluster configuration. Amazon Inspector and ECR scanning find vulnerable images and packages.

These are most useful when someone is going to look at them. Route high-severity findings to your incident channel, practise a response with a simulated compromise, and keep a runbook for the first ten minutes: which logs to query, which roles to revoke, how to isolate a node with a network policy or by cordoning it.

Features and names evolve, so confirm current capabilities and pricing for GuardDuty and Inspector in your account before relying on them.