Comprehensive Detailed Explanation with all AWS References
To enable GuardDuty to monitor Kubernetes-based applications:
Enable Control Plane Logs:
GuardDuty uses control plane logs to detect malicious or unauthorized activity in Amazon EKS.
Enable EKS control plane logs (API, audit, authenticator) and ingest them into CloudWatch.
[Reference:Amazon GuardDuty EKS Protection, Incorrect Options:, A:VPC flow logs are used for network traffic analysis, not specific to EKS protection., B:CloudWatchEventsFullAccess is unrelated to EKS or GuardDuty functionality., C:The GuardDuty service role already has required permissions when EKS Protection is enabled., , , , , ]
Submit