Overview

The AWS EKS integration ingests EKS control plane logs that are streamed to CloudWatch Logs:

• api — Kubernetes API server requests
• audit — admission and authorization decisions
• authenticator — IAM-to-Kubernetes identity mapping events
• controllerManager — controller reconcile loops
• scheduler — pod scheduling decisions

Prerequisites

• An EKS cluster with control plane logging enabled.
• IAM credentials with read access to the cluster's log group.

Step 1: Enable EKS control plane logging

1. Open the AWS Console → EKS → Clusters and select your cluster.
2. Open the Observability tab.
3. Under Control plane logging, click Manage logging and enable the log types you need:
   • API server
   • Audit
   • Authenticator
   • Controller manager
   • Scheduler
4. Click Save changes. EKS will create a log group named /aws/eks/<cluster-name>/cluster.

Step 2: Create an IAM user with log read access

1. Open IAM → Users → Create user, name it atatus-eks-reader.
2. Attach an inline policy granting:
   • logs:DescribeLogGroups
   • logs:DescribeLogStreams
   • logs:GetLogEvents
   • logs:FilterLogEvents
3. Scope the policy to the EKS log group ARN.
4. Create an access key under Security credentials → Create access key and copy both values.

Step 3: Connect AWS EKS in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the AWS EKS card and click Connect.
3. Fill in the form:

1. Click Connect.

Verification

• The AWS EKS card shows Configured.
• Control plane events appear in Security → Cloud SIEM → Audit Logs → Events with source aws_eks.