Enable Audit Logs

#!/usr/bin/env bash
# Check EKS control plane logging status for all clusters in all regions
# Requires: aws CLI configured with appropriate permissions
# Run on: any machine with aws CLI access

set -euo pipefail

# Get all regions that support EKS
regions="$(aws ec2 describe-regions --query 'Regions[].RegionName' --output text)"

printf '%-15s %-35s %-12s %-8s %-8s %-14s %-19s %-10s\n' \
  "REGION" "CLUSTER_NAME" "API" "AUDIT" "AUTH" "CTRL-MGR" "SCHEDULER" "STATUS"
printf '%0.s-' {1..130}; echo

for region in $regions; do
  clusters="$(aws eks list-clusters --region "$region" --query 'clusters[]' --output text || true)"
  [ -z "$clusters" ] && continue

  for cluster in $clusters; do
    # Get logging config
    cfg="$(aws eks describe-cluster \
      --region "$region" \
      --name "$cluster" \
      --query 'cluster.logging.clusterLogging' \
      --output json)"

    # Default all to disabled
    api=disabled
    audit=disabled
    auth=disabled
    ctrl=disabled
    sched=disabled

    # Parse enabled types
    enabled_types="$(echo "$cfg" | jq -r '.[] | select(.enabled==true) | .types[]' 2>/dev/null || true)"

    for t in $enabled_types; do
      case "$t" in
        api)               api=enabled ;;
        audit)             audit=enabled ;;
        authenticator)     auth=enabled ;;
        controllerManager) ctrl=enabled ;;
        scheduler)         sched=enabled ;;
      esac
    done

    status="OK"
    if [ "$api" = disabled ] || [ "$audit" = disabled ] || [ "$auth" = disabled ] || \
       [ "$ctrl" = disabled ] || [ "$sched" = disabled ]; then
      status="MISSING"
    fi

    printf '%-15s %-35s %-12s %-8s %-8s %-14s %-19s %-10s\n' \
      "$region" "$cluster" "$api" "$audit" "$auth" "$ctrl" "$sched" "$status"
  done
done