Kubernetes AWS EKS: Find out which specific user ran a specific kubectl command?

0
mapUsers:
----
- userarn: arn:aws:iam::xxxxxxxxxx:user/username1
  username: username1
  groups:
    - system:masters
- userarn: arn:aws:iam::xxxxxxxxxxxx:user/username2
  username: username2
  groups:
    - system:masters
- userarn: arn:aws:iam::xxxxxxxxxxxx:user/username3
  username: username3
  groups:
    - system:masters

I have the above in kubectl -n kube-system describe configmap aws-auth

I'm using AWS EKS for kubernetes I have the above users in configmap aws-auth

Now if a user runs a kubectl command where will it be logged? How do I find out which user ran a particular kubectl command?

I tried looking at aws cloudtrail but can find only the event details and not the user who ran it. I also looked at aws eks control plane audit logs, there too I am not finding any reference to the above mentioned users

Thank

1개 답변
2
수락된 답변

Hello,

You can only use control plane audit logs to track which user ran a particular kubectl command. Use CloudWatch Logs Insights to query through the EKS control plane log data.

The example query below will retrieve all the Kubernetes operations performed by user in your cluster.

fields @timestamp, user.username as user, verb as action, objectRef.name as object
| filter @logStream like /^kube-apiserver-audit/
| filter user.username not like 'system:' 
| filter user.username not like 'eks:'
| filter verb not like 'watch'
| filter verb not like 'list'
| sort @timestamp desc

For example you can query all the activity performed by username1:

fields @logStream, @timestamp, @message
| filter @logStream like /^kube-apiserver-audit/
| filter strcontains(user.username,"username1")
| sort @timestamp desc
| limit 50

To view the logs in Amazon CloudWatch Logs, you must turn on Amazon EKS control plane logging. You can find EKS control plane logs in the /aws/eks/cluster-name/cluster log group.

References

AWS
Olawale
답변함 일 년 전
profile picture
전문가
검토됨 10달 전
profile picture
전문가
검토됨 일 년 전
  • That worked excellent only thing is you should choose the time ranges too properly Thanks

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠