Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Connect Microsoft Sentinel to Amazon Web Services to Ingest AWS EKS Logs

4 September 2026Doc update+20 / −16 lines

In brief

The Microsoft Sentinel AWS EKS connector article now includes guidance for verifying audit-log ingestion and troubleshooting common setup issues. Related content links and setup wording were also revised.

What Defender admins need to know

Administrators can use the added guidance to confirm EKS audit logs are reaching Microsoft Sentinel and resolve common connector setup issues.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

The Amazon Web Services S3 EKS data connector serves the following use cases:

  • Kubernetes security monitoring and threat detection:detection: Analyze AWS EKS audit logs to help identify and respond to security threats such as unauthorized access, privilege escalation, and suspicious API calls within your Kubernetes clusters. By ingesting these logs into Microsoft Sentinel, you can use its advanced analytics and threat intelligence to detect and investigate malicious activities targeting your containerized workloads.

  • Compliance and auditing for containerized environments:environments: AWS EKS audit logs provide detailed records of all API server interactions, which are crucial for compliance reporting and auditing purposes in containerized environments. The connector ensures that these audit logs are available within Microsoft Sentinel for easy access and analysis, helping meet regulatory requirements for container security.

  • DevSecOps and cluster governance:governance: Monitor developer activities, resource access patterns, and configuration changes within your EKS clusters to ensure proper governance and security practices in your DevSecOps workflows.

This article explains how to configure the Amazon Web Services S3 EKS connector. The process of setting it up has two parts: the AWS side and the Microsoft Sentinel side. Each side's process produces information used by the other side. This two-way authenticationThe exchange of configuration details between the AWS setup and the Microsoft Sentinel setup creates secure communication.

Prerequisites

Enable and configure the Amazon Web Services S3 EKS connector

To enable and configure the connector, complete the following tasks:

  • In your AWS environment:

  • In Microsoft Sentinel:

    • Configure the Amazon Web Services S3 EKS Connector in the Microsoft Sentinel portal by adding log collectors that poll the SQS queue and retrieve log data from the S3 bucket. For more information, see Add log collectors.

Set up the AWS environment

- **EKSClusterName**: Enter the name of your existing EKS cluster.
- **Microsoft Sentinel Workspace ID**: To find your Workspace ID:
    - In the Azure portal, in the Microsoft Sentinel navigation menu, expand **Configuration** and select **Settings**. Select the **Workspace settings** tab,tab and find the Workspace ID on the Log Analytics workspace page.
    - In the Defender portal, in the quick launch menu, expand **System** and select **Settings**. Select **Microsoft Sentinel**, then select **Log Analytics settings** under **Settings for `[WORKSPACE_NAME]`**. Find the Workspace ID on the Log Analytics workspace page, which opens in a new browser tab.
- **BucketName**: Enter a unique name for the S3 bucket where EKS audit logs are stored.
- **SentinelSQSQueueName**: Enter a name for the SQS queue (default: MicrosoftSentinelEKSSqs).

Verify data ingestion

Use the following steps to verify that EKS audit log data is being ingested into your Microsoft Sentinel workspace.

  1. After setting up the connector, go to the Logs page (or the Advanced hunting page in the Defender portal) and run the following query. If you get any results, the connector is working properly.

Common issues and solutions

The following common issues and solutions can help you troubleshoot connector setup problems.

  • No data appears in AWSEKSLogs_CL table:
    • Verify that EKS audit logging is enabled on your cluster.
    • Check that the CloudWatch Logs subscription filter is correctly configured.

If you haven't already done so, implement data connector health monitoring so that you can know when connectors aren't receiving data or have other issues. For more information, see Monitor the health of your data connectors.

Next stepsRelated content

In this document, you learned how to connect AWS EKS audit logs to Microsoft Sentinel for comprehensive Kubernetes security monitoring. To learn more about Microsoft Sentinel, see the following articles: