VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

EKS clusters should have all five control plane log types (API server, audit, authenticator, controller manager, and scheduler) enabled to provide comprehensive visibility into managed Kubernetes control plane operations. Control plane logs create a persistent record of administrative activity, authentication events, scheduling behavior, and platform operations to support monitoring, troubleshooting, investigation, and accountability.

Remediation

For each EKS cluster, enable all control plane log types from the EKS console under Observability > Control plane logs, or use the AWS CLI to update the cluster configuration with all five log types enabled. See the Amazon EKS control plane logging documentation for details.

References