# GuardDuty EKS Protection
EKS Protection helps you detect potential security risks in Amazon Elastic Kubernetes Service (Amazon EKS) clusters in your AWS environment. For example, it helps you detect when a misconfigured EKS cluster is being accessed by an unauthenticated actor that attempts to collect secrets or AWS credentials from your cluster. EKS Protection uses EKS audit logs to analyze activities of users and applications.
When you enable EKS Protection, GuardDuty automatically starts monitoring your Amazon EKS clusters for potential security threats. GuardDuty uses its own independent stream to collect and analyze [EKS audit logs in EKS Protection](#guardduty_k8s-audit-logs) – no additional configuration is required.
When GuardDuty detects a potential threat based on EKS audit log monitoring, it generates a security finding. For information about the finding types that GuardDuty may generate when you enable EKS Protection, see [EKS Protection finding types](guardduty-finding-types-eks-audit-logs.md).
**Note**
To view EKS audit logs in your account (optional), you can configure Amazon EKS control plane logging to send audit logs to CloudWatch Logs. This configuration is separate from EKS Protection and is not required for security monitoring capability in GuardDuty.
**30-day free trial**
+ When you enable GuardDuty in an AWS account in an AWS Region for the first time, you get a 30-day free trial. In this case, GuardDuty will also enable EKS Protection, which is included in the 30-day free trial.
+ When you are already using GuardDuty and decide to enable EKS Protection for the first time, your account in this Region will get a 30-day free trial for EKS Protection.
+ You can choose to disable EKS Protection in any Region at any time.
+ During the 30-day free trial, you can get an estimate of your usage costs in that account and Region. After the 30-day free trial ends, GuardDuty doesn't automatically disable EKS Protection. Your account in this Region will start incurring usage cost. For more information, see [Monitoring usage and estimating costs](monitoring_costs.md).
When you disable EKS Protection, GuardDuty immediately stops monitoring and analyzing the EKS audit logs for your Amazon EKS resources.
EKS Protection may not be available in all the AWS Regions where GuardDuty is available. For more information, see [Region-specific feature availability](guardduty_regions.md#gd-regional-feature-availability).
**Note**
EKS Runtime Monitoring is managed as a part of Runtime Monitoring. For more information, see [GuardDuty Runtime Monitoring](runtime-monitoring.md).
## EKS audit logs in EKS Protection
EKS audit logs capture sequential actions within your Amazon EKS cluster, including activities from users, applications using the Kubernetes API, and the control plane. Audit logging is a component of all Kubernetes clusters.
For more information, see [Auditing](https://Kubernetes.io/docs/tasks/debug-application-cluster/audit/) in the Kubernetes documentation.
Amazon EKS allows EKS audit logs to be ingested as Amazon CloudWatch Logs through the [EKS control plane logging](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) feature. GuardDuty doesn't manage your Amazon EKS control plane logging or make EKS audit logs accessible in your account if you have not enabled them for Amazon EKS. To manage access to and retention of your EKS audit logs, you must configure the Amazon EKS control plane logging feature. For more information, see [Enabling and disabling control plane logs](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html#enabling-control-plane-log-export) in the **Amazon EKS User Guide**.
# Enabling EKS Protection in multiple-account environments
In a multiple-account environment, only the delegated GuardDuty administrator account has the option to enable or disable the EKS Protection; feature for the member accounts in their organization. The GuardDuty member accounts can't modify this configuration from their accounts. The delegated GuardDuty administrator account manages their member accounts using AWS Organizations. This delegated GuardDuty administrator account can choose to auto-enable EKS Protection for all the new accounts as they join the organization. For more information about multiple-account environments, see [Managing multiple accounts in Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html).
## Configuring EKS Audit Log Monitoring for delegated GuardDuty administrator account
Choose your preferred access method to configure EKS Audit Log Monitoring for the delegated GuardDuty administrator account.
------
#### [ Console ]
1. Open the GuardDuty console at [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/).
1. In the navigation pane, choose EKS Protection.
1. Under the **Configuration** tab, you can view the current configuration status of EKS Audit Log Monitoring in the respective section. To update the configuration for delegated GuardDuty administrator account, choose **Edit** in the **EKS Audit Log Monitoring** pane.
1. Do one of the following:
**Using **Enable for all accounts****
+ Choose **Enable for all accounts**. This will enable the protection plan for all the active GuardDuty accounts in your AWS organization, including the new accounts that join the organization.
+ Choose **Save**.
**Using **Configure accounts manually****
+ To enable the protection plan only for the delegated GuardDuty administrator account account, choose **Configure accounts manually**.
+ Choose **Enable** under the **delegated GuardDuty administrator account (this account)** section.
+ Choose **Save**.
------
#### [ API/CLI ]
Run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html) API operation using your own regional detector ID and passing the `features` object `name` as `EKS_AUDIT_LOGS` and `status` as `ENABLED` or `DISABLED`.
To find the `detectorId` for your account and current Region, see the **Settings** page in the [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/) console, or run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.
You can enable or disable EKS Audit Log Monitoring by running the following AWS CLI command. Make sure to use delegated GuardDuty administrator account's valid *detector ID*.
**Note**
The following example code enables EKS Audit Log Monitoring. Make sure to replace *12abc34d567e8fa901bc2d34e56789f0* with the `detector-id` of the delegated GuardDuty administrator account and *555555555555* with the AWS account of the delegated GuardDuty administrator account.
To find the `detectorId` for your account and current Region, see the **Settings** page in the [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/) console, or run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.
```
aws guardduty update-detector --detector-id 12abc34d567e8fa901bc2d34e56789f0 --features '[{"Name": "EKS_AUDIT_LOGS", "Status": "ENABLED"}]'
```
To disable EKS Audit Log Monitoring, replace `ENABLED` with `DISABLED`.
------
## Auto-enable EKS Audit Log Monitoring for all member accounts
Choose your preferred access method to enable the EKS Audit Log Monitoring for existing member accounts in your organization.
------
#### [ Console ]
1. Sign in to the AWS Management Console and open the GuardDuty console at [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/).
Make sure to use the delegated GuardDuty administrator account credentials.
1. Do one of the following:
**Using the **EKS Protection** page**
1. In the navigation pane, choose **EKS Protection**.
1. Under the **Configuration** tab, you can view the current status of EKS Audit Log Monitoring for active member accounts in your organization.
To update the EKS Audit Log Monitoring configuration, choose **Edit**.
1. Choose **Enable for all accounts**. This action automatically enables EKS Audit Log Monitoring for both the existing and new accounts in the organization.
1. Choose **Save**.
**Note**
It may take up to 24 hours to update the configuration for the member accounts.
**Using the **Accounts** page**
1. In the navigation pane, choose **Accounts**.
1. On the **Accounts** page, choose **Auto-enable** preferences before **Add accounts by invitation**.
1. In the **Manage auto-enable preferences** window, choose **Enable for all accounts** under **EKS Audit Log Monitoring**.
1. Choose **Save**.
If you can't use the **Enable for all accounts** option and want to customize EKS Audit Log Monitoring configuration for specific accounts in your organization, see [Selectively enable or disable EKS Audit Log Monitoring for member accounts](#k8s-enable-disable-selective-members-org).
------
#### [ API/CLI ]
+ To selectively enable or disable EKS Audit Log Monitoring for your member accounts, run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateMemberDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateMemberDetectors.html) API operation using your own *detector ID*.
+ The following example shows how you can enable EKS Audit Log Monitoring for a single member account. To disable it, replace `ENABLED` with `DISABLED`.
To find the `detectorId` for your account and current Region, see the **Settings** page in the [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/) console, or run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.
```
aws guardduty update-member-detectors --detector-id 12abc34d567e8fa901bc2d34e56789f0 --account-ids 111122223333 --features '[{"name": "EKS_AUDIT_LOGS", "status": "ENABLED"}]'
```
**Note**
You can also pass a list of account IDs separated by a space.
+ When the code has successfully executed, it returns an empty list of `UnprocessedAccounts`. If there were any problems changing the detector settings for an account, that account ID is listed along with a summary of the issue.
------
## Enable EKS Audit Log Monitoring for all existing active member accounts
Choose your preferred access method to enable EKS Audit Log Monitoring for all existing active member accounts in the organization.
------
#### [ Console ]
1. Sign in to the AWS Management Console and open the GuardDuty console at [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/).
Sign in using the delegated GuardDuty administrator account credentials.
1. In the navigation pane, choose **EKS Protection**.
1. On the **EKS Protection** page, you can view the current status of the **GuardDuty-initiated malware scan** configuration. Under the **Active member accounts** section, choose **Actions**.
1. From the **Actions** dropdown menu, choose **Enable for all existing active member accounts**.
1. Choose **Save**.
------
#### [ API/CLI ]
+ To selectively enable or disable EKS Audit Log Monitoring for your member accounts, run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateMemberDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateMemberDetectors.html) API operation using your own *detector ID*.
+ The following example shows how you can enable EKS Audit Log Monitoring for a single member account. To disable it, replace `ENABLED` with `DISABLED`.
To find the `detectorId` for your account and current Region, see the **Settings** page in the [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/) console, or run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.
```
aws guardduty update-member-detectors --detector-id 12abc34d567e8fa901bc2d34e56789f0 --account-ids 111122223333 --features '[{"name": "EKS_AUDIT_LOGS", "status": "ENABLED"}]'
```
**Note**
You can also pass a list of account IDs separated by a space.
+ When the code has successfully executed, it returns an empty list of `UnprocessedAccounts`. If there were any problems changing the detector settings for an account, that account ID is listed along with a summary of the issue.
------
## Auto-enable EKS Audit Log Monitoring for new member accounts
The newly added member accounts must **Enable** GuardDuty before selecting configuring GuardDuty-initiated malware scan. The member accounts managed by invitation can configure GuardDuty-initiated malware scan manually for their accounts. For more information, see [Step 3 - Accept an invitation](guardduty_become_console.md#guardduty_accept_invite_proc).
Choose your preferred access method to enable EKS Audit Log Monitoring for new accounts that join your organization.
------
#### [ Console ]
The delegated GuardDuty administrator account can enable EKS Audit Log Monitoring for new member accounts in an organization, using either the **EKS Audit Log Monitoring** or **Accounts** page.
**To auto-enable EKS Audit Log Monitoring for new member accounts**
1. Open the GuardDuty console at [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/).
Make sure to use the delegated GuardDuty administrator account credentials.
1. Do one of the following:
+ Using the **EKS Protection** page:
1. In the navigation pane, choose **EKS Protection**.
1. On the **EKS Protection** page, choose **Edit** in the **EKS Audit Log Monitoring**.
1. Choose **Configure accounts manually**.
1. Select **Automatically enable for new member accounts**. This step ensures that whenever a new account joins your organization, EKS Audit Log Monitoring will be automatically enabled for their account. Only the organization delegated GuardDuty administrator account can modify this configuration.
1. Choose **Save**.
+ Using the **Accounts** page:
1. In the navigation pane, choose **Accounts**.
1. On the **Accounts** page, choose **Auto-enable** preferences.
1. In the **Manage auto-enable preferences** window, select **Enable for new accounts** under **EKS Audit Log Monitoring**.
1. Choose **Save**.
------
#### [ API/CLI ]
+ To selectively enable or disable EKS Audit Log Monitoring for your new accounts, run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateOrganizationConfiguration.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateOrganizationConfiguration.html) API operation using your own *detector ID*.
+ The following example shows how you can enable EKS Audit Log Monitoring for the new members that join your organization. You can also pass a list of account IDs separated by a space.
To find the `detectorId` for your account and current Region, see the **Settings** page in the [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/) console, or run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.
```
aws guardduty update-organization-configuration --detector-id 12abc34d567e8fa901bc2d34e56789f0 --auto-enable --features '[{"Name": "EKS_AUDIT_LOGS", "AutoEnable": "NEW"}]'
```
------
## Selectively enable or disable EKS Audit Log Monitoring for member accounts
Choose your preferred access method to enable or disable EKS Audit Log Monitoring for selective member accounts in your organization.
------
#### [ Console ]
1. Open the GuardDuty console at [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/).
Make sure to use the delegated GuardDuty administrator account credentials.
1. In the navigation pane, choose **Accounts**.
On the **Accounts** page, review the **EKS Audit Log Monitoring** column for the status of your member account.
1.
**To enable or disable EKS Audit Log Monitoring**
Select an account that you want to configure for EKS Audit Log Monitoring. You can select multiple accounts at a time. Under the **Edit Protection Plans** dropdown, choose **EKS Audit Log Monitoring**, and then choose the appropriate option.
------
#### [ API/CLI ]
To selectively enable or disable EKS Audit Log Monitoring for your member accounts, invoke the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateMemberDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateMemberDetectors.html) API operation using your own *detector ID*.
The following example shows how you can enable EKS Audit Log Monitoring for a single member account. To disable it, replace `ENABLED` with `DISABLED`. You can also pass a list of account IDs separated by a space.
To find the `detectorId` for your account and current Region, see the **Settings** page in the [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/) console, or run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.
```
aws guardduty update-member-detectors --detector-id 12abc34d567e8fa901bc2d34e56789f0 --accountids 111122223333 --features '[{"Name": "EKS_AUDIT_LOGS", "Status": "ENABLED"}]'
```
------
# Enabling EKS Protection for a standalone account
A standalone account owns the decision to enable or disable a protection plan in their AWS account in a specific Region.
If your account is associated with a GuardDuty administrator account through AWS Organizations, or by the method of invitation, this section doesn't apply to you. For information about managing multiple accounts, see [Enabling EKS Protection in multiple-account environments](eks-protection-enable-multiple-accounts.md).
After you enable EKS Protection, GuardDuty will start monitoring EKS audit logs for the Amazon EKS clusters in your account.
Choose your preferred access method to enable EKS Protection in your standalone account.
------
#### [ Console ]
1. Open the GuardDuty console at [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/).
1. From the **Region** selector in the upper-right corner, select a Region where you want to enable EKS Protection.
1. In the navigation pane, choose EKS Protection.
1. The **EKS Protection** page provides the current status of EKS Protection for your account. Choose **Enable** to enable EKS Protection.
1. Choose **Confirm** to save your selection.
------
#### [ API/CLI ]
+ Run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html) API operation using the regional detector ID of the delegated GuardDuty administrator account and passing the `features` object name as `EKS_AUDIT_LOGS` and status as `ENABLED`.
Alternatively, you can also enable EKS Protection running the a AWS CLI command. Run the following command, and replace *12abc34d567e8fa901bc2d34e56789f0* with your account's detector ID and *us-east-1* with the Region where you want to enable EKS Protection.
To find the `detectorId` for your account and current Region, see the **Settings** page in the [https://console.aws.amazon.com/guardduty/](https://console.aws.amazon.com/guardduty/) console, or run the [https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html) API.
```
aws guardduty update-detector --detector-id 12abc34d567e8fa901bc2d34e56789f0 --region us-east-1 --features [{"Name" : "EKS_AUDIT_LOGS", "Status" : "ENABLED"}]'
```
------