Add EKS security rule: EKS control plane logging should be enabled for all log types
varunjain99 opened this issue · 0 comments
-
Follow the directions here to add the rule - https://docs.zeuscloud.io/contribute/add-security-rule
-
Right now, the EKSCluster node has only a field for audit_logging_enabled (https://lyft.github.io/cartography/modules/aws/schema.html#ekscluster). It's set in cartography here (https://github.com/Zeus-Labs/cartography/blob/master/cartography/intel/aws/eks.py#L53). This rule needs to test not just audit logging but 5 types: "api", "audit", "authenticator", "controllerManager", "scheduler". Consider creating a new field for each that is enabled. Or created one field of logging_types_enabled - that field would be a list of a subset of these 5 logging types.
-
The Neo4J query probably should check 5 fields you create (or 1 field if you put all enabled logging types in a list). The rule passes if all 5 are enabled. In the context portion of the query, you should list out which of the logging types are enabled and which aren't.
-
Create a cdk stack (https://github.com/Zeus-Labs/ZeusCloud/blob/main/cdk/bin/cdk.ts) with an EKS cluster that has some subset of the logging. Be sure to give no IAM permissions. Don't make it public facing.
-
Run ZeusCloud and check that the rule works correctly. You can speed up cartography running by commenting out intel modules that are run here: (https://github.com/Zeus-Labs/cartography/blob/master/cartography/intel/aws/resources.py)