feat(aws): make check eks_control_plane_logging_all_types_enabled configurable (#4553)

tests/config/config_test.py

@@ -62,6 +62,13 @@ old_config_aws = {
     "organizations_trusted_delegated_administrators": [],
     "check_rds_instance_replicas": False,
     "days_to_expire_threshold": 7,
+    "eks_required_log_types": [
+        "api",
+        "audit",
+        "authenticator",
+        "controllerManager",
+        "scheduler",
+    ],
 }
 config_aws = {
     "mute_non_default_regions": False,
@@ -255,6 +262,13 @@ config_aws = {
     ],
     "check_rds_instance_replicas": False,
     "days_to_expire_threshold": 7,
+    "eks_required_log_types": [
+        "api",
+        "audit",
+        "authenticator",
+        "controllerManager",
+        "scheduler",
+    ],
 }
 
 config_azure = {

tests/config/fixtures/config.yaml

@@ -272,6 +272,19 @@ aws:
   # aws.acm_certificates_expiration_check
   days_to_expire_threshold: 7
 
+  # AWS EKS Configuration
+  # aws.eks_control_plane_logging_all_types_enabled
+  # EKS control plane logging types that must be enabled
+  eks_required_log_types:
+    [
+        "api",
+        "audit",
+        "authenticator",
+        "controllerManager",
+        "scheduler",
+    ]
+
+
 # Azure Configuration
 azure:
   # Azure Network Configuration

tests/config/fixtures/config_old.yaml

@@ -80,3 +80,16 @@ check_rds_instance_replicas: False
 # AWS ACM Configuration
 # aws.acm_certificates_expiration_check
 days_to_expire_threshold: 7
+
+# AWS EKS Configuration
+# aws.eks_control_plane_logging_all_types_enabled
+# EKS control plane logging types that must be enabled
+eks_required_log_types:
+  [
+      "api",
+      "audit",
+      "authenticator",
+      "controllerManager",
+      "scheduler",
+  ]
+

tests/providers/aws/services/eks/eks_control_plane_logging_all_types_enabled/eks_control_plane_logging_all_types_enabled_test.py

@@ -74,6 +74,15 @@ class Test_eks_control_plane_logging_all_types_enabled:
                 ),
             )
         )
+        eks_client.audit_config = {
+            "eks_required_log_types": [
+                "api",
+                "audit",
+                "authenticator",
+                "controllerManager",
+                "scheduler",
+            ]
+        }
 
         with mock.patch(
             "prowler.providers.aws.services.eks.eks_service.EKS",
@@ -88,7 +97,7 @@ class Test_eks_control_plane_logging_all_types_enabled:
             assert len(result) == 1
             assert result[0].status == "FAIL"
             assert search(
-                "Control plane logging enabled but not all log types collected",
+                "Control plane logging is enabled but not all required log types are enabled for EKS cluster cluster_test. Required log types: api, audit, authenticator, controllerManager, scheduler. Enabled log types: api, audit, authenticator, controllerManager.",
                 result[0].status_extended,
             )
             assert result[0].resource_id == cluster_name
@@ -114,6 +123,15 @@ class Test_eks_control_plane_logging_all_types_enabled:
                 ),
             )
         )
+        eks_client.audit_config = {
+            "eks_required_log_types": [
+                "api",
+                "audit",
+                "authenticator",
+                "controllerManager",
+                "scheduler",
+            ]
+        }
 
         with mock.patch(
             "prowler.providers.aws.services.eks.eks_service.EKS",
@@ -128,7 +146,7 @@ class Test_eks_control_plane_logging_all_types_enabled:
             assert len(result) == 1
             assert result[0].status == "PASS"
             assert search(
-                "Control plane logging enabled and correctly configured",
+                "Control plane logging and all required log types are enabled for EKS cluster",
                 result[0].status_extended,
             )
             assert result[0].resource_id == cluster_name