--- title: Investigate Amazon EKS Audit Logs with Teleport Identity... description: Teleport 18 adds official support for importing Amazon EKS Audit Logs into Teleport Identity Security, giving teams unified visibility into Kubernetes API... canonical: https://daily.dev/posts/investigate-amazon-eks-audit-logs-with-teleport-identity-security-2chgsp7kd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Investigate Amazon EKS Audit Logs with Teleport Identity Security | daily.dev og:description: Teleport 18 adds official support for importing Amazon EKS Audit Logs into Teleport Identity Security, giving teams unified visibility into Kubernetes API... og:url: https://daily.dev/posts/investigate-amazon-eks-audit-logs-with-teleport-identity-security-2chgsp7kd og:image: https://api.daily.dev/og/posts/2ChgSP7kd.png og:image:alt: Investigate Amazon EKS Audit Logs with Teleport Identity Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Investigate Amazon EKS Audit Logs with Teleport Identity Security **[Teleport](https://daily.dev/sources/teleport)** · 3 min read · 0 upvotes · 0 comments ## Summary Teleport 18 adds official support for importing Amazon EKS Audit Logs into Teleport Identity Security, giving teams unified visibility into Kubernetes API activity that bypasses Teleport, including shadow access from Service Accounts and IAM Roles. The feature will be generally available in Teleport 18.3 in November 2025, and lets teams correlate EKS audit events with Teleport Kubernetes Access activity, track kubectl exec sessions, monitor impersonated users, and cross-reference EKS logs with CloudTrail. It is available now for Teleport Identity Security customers, with Teleport Enterprise Cloud support coming soon. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does Teleport 18.3 add for Amazon EKS audit logs? Teleport 18.3, generally available in November 2025, adds official support for importing Amazon EKS Audit Logs into Teleport Identity Security. This lets teams see actions performed directly on EKS clusters that bypass Teleport, correlating Kubernetes API activity from Service Accounts, IAM Roles, and Teleport into one unified view for detecting shadow access. _Teams tracking Kubernetes access changes like this can follow release details on daily.dev._ ### How can I detect shadow access to my EKS clusters that bypasses Teleport? Import Amazon EKS Audit Logs into Teleport Identity Security, which streams Kubernetes API server audit logs from EKS clusters in real time via CloudWatch Metrics. This reveals actions taken outside Teleport, such as a red-blue team exercise where an attacker with a valid Kubernetes EKS cert moved across namespaces and added a reverse shell to circumvent Teleport monitoring. _Security teams investigating Kubernetes shadow access can track tooling updates like this on daily.dev._ ### How do I set up Amazon EKS Audit Log integration with Teleport Identity Security? Configure EKS to export audit logs, optionally add EKS nodes into Teleport via the Amazon AWS integration, add the Amazon EKS Audit Log integration, then start a test session using tsh kube login followed by kubectl get pods. This lets Teleport correlate Kubernetes Access activity with Amazon EKS Audit Logs and CloudTrail for unified investigation. _Engineers setting up EKS audit visibility can find similar integration walkthroughs on daily.dev._ ## Similar posts on daily.dev - [Updates to Kubernetes audit logging, network flow logs, and SSH records](https://daily.dev/posts/updates-to-kubernetes-audit-logging-network-flow-logs-and-ssh-records-p1hc5y2bj) · Tailscale · 3 upvotes · 0 comments - [Dec Recap: New AWS Privileged Permissions and Services](https://daily.dev/posts/dec-recap-new-aws-privileged-permissions-and-services-kdk2ftpel) · Security Boulevard · 1 upvotes · 0 comments - [Amazon OpenSearch Serverless now adds audit logs for data plane APIs](https://daily.dev/posts/amazon-opensearch-serverless-now-adds-audit-logs-for-data-plane-apis-wdhwllb8b) · AWS · 1 upvotes · 0 comments - [Amazon ECS now publishes AWS CloudTrail data events for insight into API activities](https://daily.dev/posts/amazon-ecs-now-publishes-aws-cloudtrail-data-events-for-insight-into-api-activities-mg6vzfihg) · AWS · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/investigate-amazon-eks-audit-logs-with-teleport-identity-security-2chgsp7kd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Investigate Amazon EKS Audit Logs with Teleport Identity Security","url":"https://daily.dev/posts/investigate-amazon-eks-audit-logs-with-teleport-identity-security-2chgsp7kd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/investigate-amazon-eks-audit-logs-with-teleport-identity-security-2chgsp7kd"},"datePublished":"2026-08-23T12:23:09.394Z","dateModified":"2026-08-24T06:52:05.957Z","description":"Teleport 18 adds official support for importing Amazon EKS Audit Logs into Teleport Identity Security, giving teams unified visibility into Kubernetes API...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/investigate-amazon-eks-audit-logs-with-teleport-identity-security-2chgsp7kd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,kubernetes,authentication","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Investigate Amazon EKS Audit Logs with Teleport Identity Security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/investigate-amazon-eks-audit-logs-with-teleport-identity-security-2chgsp7kd#faq","mainEntity":[{"@type":"Question","name":"What does Teleport 18.3 add for Amazon EKS audit logs?","acceptedAnswer":{"@type":"Answer","text":"Teleport 18.3, generally available in November 2025, adds official support for importing Amazon EKS Audit Logs into Teleport Identity Security. This lets teams see actions performed directly on EKS clusters that bypass Teleport, correlating Kubernetes API activity from Service Accounts, IAM Roles, and Teleport into one unified view for detecting shadow access. Teams tracking Kubernetes access changes like this can follow release details on daily.dev."}},{"@type":"Question","name":"How can I detect shadow access to my EKS clusters that bypasses Teleport?","acceptedAnswer":{"@type":"Answer","text":"Import Amazon EKS Audit Logs into Teleport Identity Security, which streams Kubernetes API server audit logs from EKS clusters in real time via CloudWatch Metrics. This reveals actions taken outside Teleport, such as a red-blue team exercise where an attacker with a valid Kubernetes EKS cert moved across namespaces and added a reverse shell to circumvent Teleport monitoring. Security teams investigating Kubernetes shadow access can track tooling updates like this on daily.dev."}},{"@type":"Question","name":"How do I set up Amazon EKS Audit Log integration with Teleport Identity Security?","acceptedAnswer":{"@type":"Answer","text":"Configure EKS to export audit logs, optionally add EKS nodes into Teleport via the Amazon AWS integration, add the Amazon EKS Audit Log integration, then start a test session using tsh kube login followed by kubectl get pods. This lets Teleport correlate Kubernetes Access activity with Amazon EKS Audit Logs and CloudTrail for unified investigation. Engineers setting up EKS audit visibility can find similar integration walkthroughs on daily.dev."}}]} ```