AWS guardduty documentation change
Summary
Updated EKS Protection documentation to clarify monitoring process and added note about optional CloudWatch Logs configuration
Security assessment
The changes clarify operational aspects of EKS audit log monitoring but do not address specific security vulnerabilities or introduce new security features. The added note explains optional logging configuration without security implications.
Diff
diff --git a/guardduty/latest/ug/kubernetes-protection.md b/guardduty/latest/ug/kubernetes-protection.md index 856f092fd..3c2e9c1b3 100644 --- a//guardduty/latest/ug/kubernetes-protection.md +++ b//guardduty/latest/ug/kubernetes-protection.md @@ -11 +11 @@ EKS Protection helps you detect potential security risks in Amazon Elastic Kuber -When you enable EKS Protection, GuardDuty immediately starts monitoring EKS audit logs in EKS Protection from your Amazon EKS clusters, and analyzes them for potentially malicious and suspicious activities. It consumes EKS audit log events directly from the Amazon EKS control plane logging feature through an independent and duplicative stream of audit logs. This process does not require any additional set up or affect any existing Amazon EKS control plane logging configurations that you might have. +When you enable EKS Protection, GuardDuty automatically starts monitoring your Amazon EKS clusters for potential security threats. GuardDuty uses its own independent stream to collect and analyze EKS audit logs in EKS Protection – no additional configuration is required. @@ -14,0 +15,4 @@ When GuardDuty detects a potential threat based on EKS audit log monitoring, it +###### Note + +To view EKS audit logs in your account (optional), you can configure Amazon EKS control plane logging to send audit logs to CloudWatch Logs. This configuration is separate from EKS Protection and is not required for security monitoring capability in GuardDuty. +