{"id":16931326,"url":"https://github.com/issif/eks-k8s-audit-logs-plugin","last_synced_at":"2025-07-19T02:31:40.569Z","repository":{"id":44609609,"uuid":"455610494","full_name":"Issif/eks-k8s-audit-logs-plugin","owner":"Issif","description":"This is a POC for a Falco Plugin allowing to gather logs and trigger events for k8s audit of a EKS Cluster.","archived":false,"fork":false,"pushed_at":"2022-02-04T19:31:13.000Z","size":17,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2023-08-07T06:42:43.492Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Issif.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-02-04T16:05:05.000Z","updated_at":"2023-08-07T06:42:43.493Z","dependencies_parsed_at":"2022-09-01T09:23:05.517Z","dependency_job_id":null,"html_url":"https://github.com/Issif/eks-k8s-audit-logs-plugin","commit_stats":null,"previous_names":[],"tags_count":0,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Feks-k8s-audit-logs-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Feks-k8s-audit-logs-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Feks-k8s-audit-logs-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Issif%2Feks-k8s-audit-logs-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Issif","download_url":"https://codeload.github.com/Issif/eks-k8s-audit-logs-plugin/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":219851284,"owners_count":16556305,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T20:43:44.656Z","updated_at":"2024-10-13T20:43:45.271Z","avatar_url":"https://github.com/Issif.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# EKS K8S Audit Logs Plugin\n\nThis is a POC for a `Falco Plugin` allowing to gather logs and trigger events for `k8s audit` of a `EKS Cluster`. It scrapes last logs for `EKS` from `Cloudwatch Logs`, parse them and send them to `Plugin Framework` with correct fields.\n\n\u003e :warning: This is a POC, don't use in Production, join us on Slack **kubernetes#falco** to discuss in more detail\n\n\n## Requirements\n\nYou need:\n* `Go` \u003e= 1.17\n* `Falco` \u003e= 0.31\n* `json` plugin for `Falco` \n\n## Build\n\n```shell\nmake\n```\n\n## Configurations\n\n* Authentication to `AWS`:\n  * this plugin uses `aws-sdk-go` for authentication and collect of logs from `Cloudwatch Logs`\n  * you can export `AWS_ACCESS_KEY_ID`\n\n* `falco.yaml`\n\n```yaml\nplugins:\n  - name: eks-k8s-audit-logs\n    library_path: /etc/falco/audit/libeks-k8s-audit-logs.so\n    init_config: ''\n    open_params: '{\"cluster\": \"clusterName\", \"region\": \"eu-west-1\"}'\n  - name: json\n    library_path: /etc/falco/json/libjson.so\n    init_config: \"\"\n\nload_plugins: [eks-k8s-audit-logs,json]\n\nstdout_output:\n  enabled: true\n```\n\n* `rules.yaml`\n\n\u003e :warning: There's currently a conflict with `k8s_audit` source already built in `Falco`, it enforces the usage of `jevt` extractor but it can't work with this plugin and makes `Falco` crash:\n\u003e ```shell\n\u003e Runtime error: invalid formatting token jevt.time:\n\u003e ```\n\u003e The solution is to set a different `event_source` for this plugin and change the `source:` setting of rules, see `k8s_audit_rules.yaml` of this repo.\n\u003e This issue will be fix asap by removing the `k8s_audit` refs from core.\n\n## Usage\n\n```shell\nfalco -c falco.yaml -r k8s_audit_rules.yaml\n```\n\n## Results\n\n```shell\n17:40:05.865829249: Warning K8s Operation performed by user not in allowed list of users (user=eks:certificate-controller target=eks-certificates-controller/configmaps verb=get uri=/api/v1/namespaces/kube-system/configmaps/eks-certificates-controller resp=200)\n17:40:05.865862951: Warning K8s Operation performed by user not in allowed list of users (user=eks:certificate-controller target=eks-certificates-controller/configmaps verb=update uri=/api/v1/namespaces/kube-system/configmaps/eks-certificates-controller resp=200)\n17:40:07.487729013: Warning K8s Operation performed by user not in allowed list of users (user=eks:certificate-controller target=eks-certificates-controller/configmaps verb=get uri=/api/v1/namespaces/kube-system/configmaps/eks-certificates-controller resp=200)\n17:40:07.487766347: Warning K8s Operation performed by user not in allowed list of users (user=eks:certificate-controller target=eks-certificates-controller/configmaps verb=update uri=/api/v1/namespaces/kube-system/configmaps/eks-certificates-controller resp=200)\n17:40:07.488135947: Warning K8s Operation performed by user not in allowed list of users (user=eks:certificate-controller target=eks-certificates-controller/configmaps verb=get uri=/api/v1/namespaces/kube-system/configmaps/eks-certificates-controller resp=200)\n\nEvents detected: 5\nRule counts by severity:\n   WARNING: 5\nTriggered rules by rule name:\n   Disallowed K8s User: 5\nSyscall event drop monitoring:\n   - event drop detected: 0 occurrences\n   - num times actions taken: 0\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fissif%2Feks-k8s-audit-logs-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fissif%2Feks-k8s-audit-logs-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fissif%2Feks-k8s-audit-logs-plugin/lists"}