Kubernetes AWS EKS: Find out which specific user ran a specific kubectl command?

Question

```
mapUsers:
----
- userarn: arn:aws:iam::xxxxxxxxxx:user/username1
  username: username1
  groups:
    - system:masters
- userarn: arn:aws:iam::xxxxxxxxxxxx:user/username2
  username: username2
  groups:
    - system:masters
- userarn: arn:aws:iam::xxxxxxxxxxxx:user/username3
  username: username3
  groups:
    - system:masters

```
I have the above in kubectl -n kube-system describe configmap aws-auth

I'm using AWS EKS for kubernetes I have the above users in configmap aws-auth

Now if a user runs a kubectl command where will it be logged? How do I find out which user ran a particular kubectl command?

I tried looking at aws cloudtrail but can find only the event details and not the user who ran it. I also looked at aws eks control plane audit logs, there too I am not finding any reference to the above mentioned users

Thank

Accepted Answer

Hello,

You can only use control plane audit logs to track which user ran a particular `kubectl` command. Use CloudWatch Logs Insights to query through the EKS control plane log data.

The example query below will retrieve all the Kubernetes operations performed by user in your cluster.
```
fields @timestamp, user.username as user, verb as action, objectRef.name as object
| filter @logStream like /^kube-apiserver-audit/
| filter user.username not like 'system:' 
| filter user.username not like 'eks:'
| filter verb not like 'watch'
| filter verb not like 'list'
| sort @timestamp desc
```

For example you can query all the activity performed by username1:
```
fields @logStream, @timestamp, @message
| filter @logStream like /^kube-apiserver-audit/
| filter strcontains(user.username,"username1")
| sort @timestamp desc
| limit 50
```

To view the logs in Amazon CloudWatch Logs, you must turn on Amazon EKS control plane logging. You can find EKS control plane logs in the /aws/eks/cluster-name/cluster log group.

References
- https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html
- https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-examples.html

Kubernetes AWS EKS: Find out which specific user ran a specific kubectl command?

Relevant content