Enable CloudTrail Logging for Kubernetes API Calls

01 Sign in to the AWS Management Console.

02 Navigate to CloudTrail console available at https://console.aws.amazon.com/cloudtrail/.

03 In the main navigation panel, under CloudTrail, choose Trails.

04 Click on the name (link) of the Amazon CloudTrail trail that you want to examine.

05 In the General details section, check the Trail logging attribute value. If the Trail logging value is set to Off, the selected CloudTrail trail is not active.

06 Repeat steps no. 4 and 5 for each Amazon CloudTrail trail available within the current AWS region. If the Trail logging value is set to Off for each verified trail, there are no active trails within the current AWS region, therefore CloudTrail logging is not enabled for your Amazon EKS clusters. If the Trail logging value is set to Logging, follow the steps outlined on this page to ensure that the trail configuration is compliant and the trail log files are delivered as expected.

07 Change the AWS cloud region from the top navigation bar and perform the Audit process for other AWS regions.

01 Run list-trails command (OSX/Linux/UNIX) with custom query filters to list the names of all the Amazon CloudTrail trails created for your AWS cloud account:

aws cloudtrail list-trails
  --region us-east-1
  --query 'Trails[*].Name'

02 The command output should return an array with the requested CloudTrail trail names:

[
	"cc-main-cloudtrail-trail",
	"cc-project5-api-trail"
]

03 Run get-trail-status command (OSX/Linux/UNIX) using the name of the Amazon CloudTrail trail that you want to examine as the identifier parameter and custom query filters to determine if your CloudTrail trail is enabled in the selected AWS region:

aws cloudtrail get-trail-status
  --name cc-main-cloudtrail-trail
  --query 'IsLogging'

04 The command output should return the requested flag status (**true** for enabled, **false** for disabled):

[
	false
]

05 Repeat steps no. 3 and 4 for each Amazon CloudTrail trail available in the selected AWS region. If the get-trail-status command output returns false for each verified trail, there are no active trails within the selected AWS region, therefore CloudTrail logging is not enabled for Amazon EKS clusters. If the get-trail-status value is set to true, follow the steps outlined on this page to ensure that the trail configuration is compliant and the trail log files are delivered as expected.

06 Change the AWS cloud region using the --region command parameter and perform the Audit process for other AWS regions.

01 Sign in to the AWS Management Console.

02 Navigate to CloudTrail console available at https://console.aws.amazon.com/cloudtrail/.

03 In the main navigation panel, under CloudTrail, choose Trails.

04 Click on the name (link) of the Amazon CloudTrail trail that you want to enable and choose Start logging.

05 If there is no CloudTrail trail created within the current AWS region, choose Create trail and follow the setup wizard to create the trail required to record the activity performed on your Amazon EKS clusters. Once all the required settings are configured, choose Create trail to deploy your new, multi-region Amazon CloudTrail trail.

01 Run start-logging command (OSX/Linux/UNIX) to enable the selected Amazon CloudTrail trail (the command does not produce an output):

aws cloudtrail start-logging
  --region us-east-1
  --name cc-main-cloudtrail-trail

02 If the existing trail is not configured to support all AWS cloud regions, i.e. is not a multi-region trail, follow the steps outlined on this page to enable global monitoring for the existing trail.

03 If there are no CloudTrail trails available, run create-trail command (OSX/Linux/UNIX) to create the multi-region trail required to record the activity performed on your Amazon EKS clusters:

aws cloudtrail create-trail
  --region us-east-1
  --name cc-eks-global-trail
  --s3-bucket-name cc-trail-log-bucket
  --is-multi-region-trail

04 The command output should return the configuration information available for the new multi-region trail:

{
	"IncludeGlobalServiceEvents": true,
	"IsOrganizationTrail": false,
	"Name": "cc-eks-global-trail",
	"TrailARN": "arn:aws:cloudtrail:us-east-1:123456789012:trail/cc-eks-global-trail",
	"LogFileValidationEnabled": true,
	"IsMultiRegionTrail": true,
	"S3BucketName": "cc-trail-log-bucket"
}