GuardDuty EKS Audit Log Monitoring should be enabled

How to fix it

Have the failing Region's GuardDuty detector carry the EKS_AUDIT_LOGS feature with status ENABLED. The check also fails when the detector itself is not enabled, whatever the feature says, so GuardDuty has to be running in that Region first. GuardDuty then reads the Kubernetes audit logs of every EKS cluster in the Region and bills on their volume.

In the console

GuardDuty → Protection plans → EKS Protection → EKS Audit Log Monitoring

With the AWS CLI

aws guardduty update-detector --detector-id <detector-id> --region <region> --features '[{"Name":"EKS_AUDIT_LOGS","Status":"ENABLED"}]'

With Terraform

resource "aws_guardduty_detector_feature" "this" {
  detector_id = aws_guardduty_detector.this.id
  name        = "EKS_AUDIT_LOGS"
  status      = "ENABLED"
}