1 year ago

https://aws.amazon.com/polly/ In March 2020, we introduced https://aws.amazon.com/blogs/aws/amazon-detective-rapid-security-investigation-and-analysis/, a fully managed service that makes it easy to analyze, investigate, and quickly identify the root cause of potential security issues or suspicious activities. Its highly programmatic nature allows thousands of individual container deployments and millions of configuration changes to occur in seconds.

When you enable this new feature, Amazon Detective automatically starts ingesting EKS audit logs to capture chronological API activity from users, applications, and the control plane in Amazon EKS for clusters, pods, container images, and Kubernetes subjects (Kubernetes users and service accounts).

Once enabled, Detective will begin monitoring the Kubernetes audit logs that are generated by Amazon EKS, extracting and correlating information for security usage.

In the Kubernetes API activity tab, you can get an overview of the full API activities involving the EKS cluster.