A company uses AWS Organizations and runs Amazon Elastic Kubernetes Service (Amazon EKS) clusters in multiple AWS accounts. A security engineer has integrated Amazon EKS with AWS CloudTrail, storing trails in an Amazon S3 bucket in each account to monitor API calls. However, CloudTrail logs do not show Kubernetes pod creation events. To view Kubernetes events in Amazon CloudWatch, what should the security engineer do?

The correct answer is to enable Kubernetes API server (control plane) component logs for each EKS cluster. CloudTrail logs AWS API calls, not events occurring within the Kubernetes control plane itself, such as pod creation. To monitor Kubernetes-specific events like pod creation, you need to enable logging for the EKS control plane components, particularly the API server. These logs are then sent to CloudWatch Logs, where they can be viewed and analyzed. Configuring S3 VPC endpoints and enabling S3 bucket logging would only provide logs related to S3 access, not Kubernetes events. Enabling CORS on the S3 bucket is irrelevant to logging Kubernetes events. While you will ultimately view the events in the CloudWatch console, simply configuring CloudWatch without enabling the source logs (EKS control plane logs) will not make the Kubernetes events appear.