Comprehensive Detailed Explanation with all AWS References
To enable GuardDuty to monitor Kubernetes-based applications:
Enable Control Plane Logs:
GuardDuty uses control plane logs to detect malicious or unauthorized activity in Amazon EKS.
Enable EKS control plane logs (API, audit, authenticator) and ingest them into CloudWatch.
[Reference: Amazon GuardDuty EKS Protection, Incorrect Options:, A: VPC flow logs are used for network traffic analysis, not specific to EKS protection., B: CloudWatchEventsFullAccess is unrelated to EKS or GuardDuty functionality., C: The GuardDuty service role already has required permissions when EKS Protection is enabled., , , ]
Submit