Kubernetes.audit_logs: add support for cloud providers

packages/kubernetes/_dev/build/docs/README.md

@@ -114,7 +114,17 @@ By annotating the pod with `elastic.co/preserve_original_event: 'true'`, the int
 
 ### audit-logs
 
-The audit-logs dataset requires access to the log files on each Kubernetes node where the audit logs are stored.
+Audit logs integration collects and parses Kubernetes audit logs.
+
+Audit logs can be collected from managed Kubernetes services in cloud providers:
+
+- Amazon EKS: Configure the aws-cloudwatch input to collect audit logs from a CloudWatch log group where EKS audit logs are published.
+- Azure AKS: Use the azure-eventhub input to receive audit logs from an Event Hub configured to stream AKS diagnostic logs.
+- Google GKE: Use the gcp-pubsub input to subscribe to a Pub/Sub topic that receives GKE audit logs via Log Router sinks.
+
+To enable these, configure the corresponding input with access credentials and the appropriate log stream or topic.
+
+To collect audit logs from local k8s deployments, it requires access to the log files on each Kubernetes node where the audit logs are stored.
 This defaults to `/var/log/kubernetes/kube-apiserver-audit.log`.
 
 ## Compatibility

packages/kubernetes/_dev/build/docs/audit-logs.md

@@ -1,8 +1,16 @@
 # audit-logs
 
-audit-logs integration collects and parses Kubernetes audit logs.
+Audit logs integration collects and parses Kubernetes audit logs.
 
-It requires access to the log files on each Kubernetes node where the audit logs are stored.
+Audit logs can be collected from managed Kubernetes services in cloud providers:
+
+- Amazon EKS: Configure the aws-cloudwatch input to collect audit logs from a CloudWatch log group where EKS audit logs are published.
+- Azure AKS: Use the azure-eventhub input to receive audit logs from an Event Hub configured to stream AKS diagnostic logs.
+- Google GKE: Use the gcp-pubsub input to subscribe to a Pub/Sub topic that receives GKE audit logs via Log Router sinks.
+
+To enable these, configure the corresponding input with access credentials and the appropriate log stream or topic.
+
+To collect audit logs from local k8s deployments, it requires access to the log files on each Kubernetes node where the audit logs are stored.
 This defaults to `/var/log/kubernetes/kube-apiserver-audit.log`.
 
 {{event "audit_logs"}}

packages/kubernetes/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.81.0"
+  changes:
+    - description: Support for collecting audit logs from cloud providers.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/14554
 - version: "1.80.2"
   changes:
     - description: Fixed typos in ssl node descriptions in manifest.yml files.

packages/kubernetes/data_stream/audit_logs/_dev/test/pipeline/test-audit.log

@@ -0,0 +1,4 @@
+{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"abcde12345","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods","verb":"get","user":{"username":"system:serviceaccounts:default:default","uid":"12345678","groups":["system:authenticated"]},"sourceIPs":["67.43.156.1"],"userAgent":"kubectl/v1.26.1","objectRef":{"resource":"pods","namespace":"default","name":"my-pod","apiGroup":"","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2025-03-04T06:22:18.819232Z","stageTimestamp":"2025-03-04T06:22:18.822532Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}
+{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"abcde12345","stage":"ResponseComplete","requestURI":"/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/elastic-agent-cluster-test","verb":"get","user":{"username":"system:serviceaccount:kube-system:elastic-agent","uid":"12345678","groups":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"],"extra":{}},"sourceIPs":["67.43.156.1"],"userAgent":"elastic-agent/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"leases","namespace":"kube-system","name":"elastic-agent-cluster-test","apiGroup":"coordination.k8s.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2025-07-16T10:12:56.525137Z","stageTimestamp":"2025-07-16T10:12:56.563177Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by RoleBinding \"elastic-agent/kube-system\" of Role \"elastic-agent\" to ServiceAccount \"elastic-agent/kube-system\""}}
+{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"abcde12345","stage":"ResponseComplete","requestURI":"/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/elastic-agent-cluster-test","verb":"get","user":{"username":"system:serviceaccount:kube-system:elastic-agent","uid":"12345678","groups":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"],"extra":{}},"sourceIPs":["67.43.156.1"],"userAgent":"elastic-agent/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"leases","namespace":"kube-system","name":"elastic-agent-cluster-test","apiGroup":"coordination.k8s.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2025-07-16T10:12:56.525137Z","stageTimestamp":"2025-07-16T10:12:56.563177Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by RoleBinding \"elastic-agent/kube-system\" of Role \"elastic-agent\" to ServiceAccount \"elastic-agent/kube-system\""}}
+{"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"system:gke-master-healthcheck"},"authorizationInfo":[{"granted":true,"permission":"io.k8s.get","resource":"readyz"}],"methodName":"io.k8s.get","requestMetadata":{"callerIp":"67.43.156.1","callerSuppliedUserAgent":"gke-master-healthcheck"},"resourceName":"readyz","serviceName":"k8s.io","status":{"code":0}},"insertId":"1234abcd","resource":{"type":"k8s_cluster","labels":{"cluster_name":"test-cluster","location":"us-central1","project_id":"elastic-siem"}},"timestamp":"2025-07-13T08:38:39.127266Z","labels":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:public-info-viewer\" of ClusterRole \"system:public-info-viewer\" to Group \"system:authenticated\""},"logName":"projects/elastic-siem/logs/cloudaudit.googleapis.com%2Fdata_access","operation":{"id":"1234abcd","producer":"k8s.io","first":true,"last":true},"receiveTimestamp":"2025-07-13T08:38:41.005864307Z"}

packages/kubernetes/data_stream/audit_logs/_dev/test/pipeline/test-audit.log-config.yml

@@ -0,0 +1,3 @@
+fields:
+   tags:
+     - preserve_original_event