'Custom AWS Config rule for EKS

I'm trying to create an AWS Config custom rule to check the compliance of my clusters. For example I would like to check if they have the control plane logging enabled. I've check the AWS::EKS::Cluster documentation reference and I expected those properties to be present in the event received in my lambda, but when AWS Config executes my lambda and prints the event, it looks very different:

console.info("EVENT\n" + JSON.stringify(event, null, 2))

Print:

{
   "configurationItemDiff":null,
   "configurationItem":{
      "relatedEvents":[
         
      ],
      "relationships":[
         
      ],
      "configuration":{
         "Arn":"arn:aws:eks:eu-west-2:XXXXXXX:cluster/eks-cluster",
         "CertificateAuthorityData":"LS0tLS1....",
         "Endpoint":"https://xxxxx.gr7.eu-west-2.eks.amazonaws.com",
         "Name":"eks-cluster",
         "ResourcesVpcConfig":{
            "SecurityGroupIds":[
               "sg-0999999352ef8963b"
            ],
            "SubnetIds":[
               "subnet-08e9879878977832c",
               "subnet-022c665678587c77d",
               "subnet-0143345543345af8c"
            ]
         },
         "RoleArn":"arn:aws:iam::xxxxxx:role/eks-cluster-role",
         "Version":"1.21",
         "Tags":[
            
         ]
      },
      "supplementaryConfiguration":{
         
      },
      "tags":{
         
      },
      "configurationItemVersion":"1.3",
      "configurationItemCaptureTime":"2022-02-15T03:04:01.223Z",
      "configurationStateId":1644894241223,
      "awsAccountId":"xxxxxxx",
      "configurationItemStatus":"OK",
      "resourceType":"AWS::EKS::Cluster",
      "resourceId":"eks-cluster",
      "resourceName":"eks-cluster",
      "ARN":"arn:aws:eks:eu-west-2:xxxxxxxx:cluster/eks-cluster",
      "awsRegion":"eu-west-2",
      "availabilityZone":"Regional",
      "configurationStateMd5Hash":"",
      "resourceCreationTime":null
   },
   "notificationCreationTime":"2022-02-15T10:36:01.432Z",
   "messageType":"ConfigurationItemChangeNotification",
   "recordVersion":"1.3"
}

Is there any way to check those AWS::EKS::Cluster properties (KubernetesNetworkConfig, Logging...) with a custom Lambda in AWS Config?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source