Audit Logging Should Be Enabled And Shipped Off-Cluster

#!/usr/bin/env bash
#
# EKS API audit logging state reporter
# Requirements:
#   - aws CLI configured with credentials
#   - jq installed
#
# Usage:
#   ./eks_audit_logging_report.sh <aws-region>
#
# Output:
#   One line per cluster with:
#     - Cluster name
#     - Cluster ARN
#     - Logging types and whether they are enabled
#     - Whether audit logging is enabled
#     - Whether an external, tamper-resistant sink is detected (CloudTrail + CloudWatch Logs / S3)
#
# NOTES:
#   - This script assesses control-plane API audit logging at the EKS level.
#   - It does NOT change any configuration.
#   - “Problem” means: audit logging is disabled OR logs are not going to a durable,
#     off-cluster destination.

set -euo pipefail

REGION="${1:-}"
if [ -z "$REGION" ]; then
  echo "Usage: $0 <aws-region>" >&2
  exit 1
fi

command -v aws >/dev/null 2>&1 || { echo "aws CLI not found in PATH" >&2; exit 1; }
command -v jq  >/dev/null 2>&1 || { echo "jq not found in PATH" >&2; exit 1; }

echo "Region: $REGION"
echo "Timestamp: $(date -u +"%Y-%m-%dT%H:%M:%SZ")"
echo

# Get all EKS clusters in the region
CLUSTERS_JSON="$(aws eks list-clusters --region "$REGION" --output json)"
CLUSTER_NAMES=($(echo "$CLUSTERS_JSON" | jq -r '.clusters[]?'))

if [ "${#CLUSTER_NAMES[@]}" -eq 0 ]; then
  echo "No EKS clusters found in region $REGION."
  exit 0
fi

printf '%-30s %-60s %-30s %-15s %-25s\n' \
  "CLUSTER_NAME" "CLUSTER_ARN" "AUDIT_LOG_ENABLED" "PROBLEM" "NOTES"
printf '%*s\n' 168 | tr ' ' '-'

for CLUSTER in "${CLUSTER_NAMES[@]}"; do
  DESC="$(aws eks describe-cluster --name "$CLUSTER" --region "$REGION" --output json)"

  CLUSTER_ARN=$(echo "$DESC" | jq -r '.cluster.arn')
  LOGGING_JSON=$(echo "$DESC" | jq -r '.cluster.logging.clusterLogging')

  # Determine if audit logging is enabled
  AUDIT_LOG_ENABLED=$(echo "$LOGGING_JSON" \
    | jq -r '.[] | select(.types[]? == "audit") | .enabled' 2>/dev/null || true)

  if [ -z "$AUDIT_LOG_ENABLED" ]; then
    AUDIT_LOG_ENABLED="false"
  fi

  PROBLEM="false"
  NOTES=""

  if [ "$AUDIT_LOG_ENABLED" != "true" ]; then
    PROBLEM="true"
    NOTES="audit logging disabled"
  fi

  # Check CloudTrail and its destinations as a proxy for "shipped off-cluster"
  # This is heuristic and must be reviewed.
  TRAILS_JSON="$(aws cloudtrail describe-trails --region "$REGION" --output json)"
  CT_HAS_ORG_OR_MULTI_REGION=false
  CT_HAS_S3=false
  CT_HAS_CLOUDWATCH=false

  if echo "$TRAILS_JSON" | jq -e '.trailList | length > 0' >/dev/null 2>&1; then
    # Any trail with IsOrganizationTrail or IsMultiRegionTrail set?
    if echo "$TRAILS_JSON" | jq -e '.trailList[] | select(.IsOrganizationTrail == true or .IsMultiRegionTrail == true)' >/dev/null 2>&1; then
      CT_HAS_ORG_OR_MULTI_REGION=true
    fi
    # Any trail with S3BucketName set?
    if echo "$TRAILS_JSON" | jq -e '.trailList[] | select(.S3BucketName != null and .S3BucketName != "")' >/dev/null 2>&1; then
      CT_HAS_S3=true
    fi
    # Any trail with CloudWatchLogsLogGroupArn set?
    if echo "$TRAILS_JSON" | jq -e '.trailList[] | select(.CloudWatchLogsLogGroupArn != null and .CloudWatchLogsLogGroupArn != "")' >/dev/null 2>&1; then
      CT_HAS_CLOUDWATCH=true
    fi
  fi

  # Heuristic: if audit logging is enabled AND there is at least one
  # CloudTrail trail sending to S3 and/or CloudWatch Logs, we consider logs
  # "likely" shipped off-cluster. This still needs human review.
  if [ "$AUDIT_LOG_ENABLED" = "true" ]; then
    if [ "$CT_HAS_S3" = "true" ] || [ "$CT_HAS_CLOUDWATCH" = "true" ]; then
      if [ -z "$NOTES" ]; then
        NOTES="audit logging enabled; CloudTrail with S3/CloudWatch detected (review configuration)"
      else
        NOTES="$NOTES; CloudTrail with S3/CloudWatch detected (review configuration)"
      fi
    else
      PROBLEM="true"
      if [ -z "$NOTES" ]; then
        NOTES="audit logging enabled but no CloudTrail trail with S3/CloudWatch destination detected"
      else
        NOTES="$NOTES; no CloudTrail trail with S3/CloudWatch destination detected"
      fi
    fi
  fi

  printf '%-30s %-60s %-30s %-15s %-25s\n' \
    "$CLUSTER" "$CLUSTER_ARN" "$AUDIT_LOG_ENABLED" "$PROBLEM" "$NOTES"
done