EKS cluster should have control-plane logging enabled

What it checks

EKS cluster: no control-plane log types are enabled.

Where it applies

Terraform: aws_eks_cluster

CloudFormation: AWS::EKS::Cluster

How to fix it

1. Set enabled_cluster_log_types to include at minimum ["api", "audit", "authenticator"]. All five types are recommended.

Frameworks

• AWS FSBP EKS.8
• SOC 2 CC7.2
• PCI-DSS v4.0.1/10.2.1
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules