How to Collect EKS Auto Mode Managed Component Logs (Karpenter, EBS CSI, Load Balancer, VPC CNI) with CloudWatch Logs

Background

Auto Mode managed component logs (Compute, Block storage, Load balancing, IPAM) must be configured separately through CloudWatch Vended Logs delivery.

EKS Auto Mode exposes the following log types, and each one is configured as an individual delivery source.

Log type	Component
AUTO_MODE_COMPUTE_LOGS	Compute autoscaling (Karpenter)
AUTO_MODE_BLOCK_STORAGE_LOGS	Block storage (EBS CSI)
AUTO_MODE_LOAD_BALANCING_LOGS	Load balancing (AWS Load Balancer Controller)
AUTO_MODE_IPAM_LOGS	Pod networking (VPC CNI IP Address Management)

In this article, all of these logs are delivered to CloudWatch Logs log groups.

How log delivery works

Delivering Vended Logs to CloudWatch Logs follows the same three steps for every component.

1. Create a delivery source – points to an Auto Mode component on your cluster (PutDeliverySource).
2. Create a delivery destination – points to the CloudWatch Logs log group (PutDeliveryDestination).
3. Create a delivery – connects the source and the destination (CreateDelivery).

You can also reuse these relationships.

• One component (source) → multiple destinations (create multiple deliveries).
• Multiple components (sources) → one destination (create multiple deliveries).

Prerequisites

• An EKS Auto Mode cluster
• AWS CLI v2 configured with credentials that have logs:CreateLogGroup, logs:PutDeliverySource, logs:PutDeliveryDestination, and logs:CreateDelivery permissions
• CloudWatch Logs must be permitted to write to the destination log group. See Configure permissions to send logs to CloudWatch Logs.

Replace the placeholder values in the examples below (region, account ID, cluster name, resource names, etc.) with your own.

Step-by-step CLI: delivering Compute (Karpenter) logs to CloudWatch Logs

1. Create the destination log group

We recommend replacing my-auto-cluster with your own cluster name before using it.

aws logs create-log-group \
  --log-group-name /aws/eks/my-auto-cluster/automode/compute

2. Create the delivery source

Set --resource-arn to your EKS cluster ARN, and --log-type to one of the four Auto Mode log types.

aws logs put-delivery-source \
  --name automode-compute-source \
  --resource-arn arn:aws:eks:us-east-1:111122223333:cluster/my-auto-cluster \
  --log-type AUTO_MODE_COMPUTE_LOGS

3. Create the delivery destination

Point the destination at the log group ARN you created in step 1.

aws logs put-delivery-destination \
  --name automode-compute-cwl-dest \
  --delivery-destination-configuration \
    'destinationResourceArn=arn:aws:logs:us-east-1:111122223333:log-group:/aws/eks/my-auto-cluster/automode/compute:*'

4. Create the delivery

Connect the source and destination using the names from the previous steps. You can look up the delivery destination ARN with get-delivery-destination and pass it in directly.

aws logs create-delivery \
  --delivery-source-name automode-compute-source \
  --delivery-destination-arn "$(aws logs get-delivery-destination \
    --name automode-compute-cwl-dest \
    --query 'deliveryDestination.arn' --output text)"

Configuring the other components

Block storage, Load balancing, and IPAM logs are configured with the exact same three steps as the Compute example above. Just change the log group name, source name, destination name, and --log-type value to match each component.

The values to use for each component are as follows.

Component	--log-type	Example log group	Example source name	Example destination name
Block storage (EBS CSI)	AUTO_MODE_BLOCK_STORAGE_LOGS	/aws/eks/my-auto-cluster/automode/block-storage	automode-blockstorage-source	automode-blockstorage-cwl-dest
Load balancing (AWS Load Balancer Controller)	AUTO_MODE_LOAD_BALANCING_LOGS	/aws/eks/my-auto-cluster/automode/load-balancing	automode-loadbalancing-source	automode-loadbalancing-cwl-dest
Pod networking (VPC CNI IPAM)	AUTO_MODE_IPAM_LOGS	/aws/eks/my-auto-cluster/automode/ipam	automode-ipam-source	automode-ipam-cwl-dest

Simply take the commands from the Compute example above and swap the log group name, source name, destination name, and --log-type value with the values from the table.

Verifying and viewing logs

To verify the delivery configuration you created, use the following commands.

aws logs describe-deliveries
aws logs describe-delivery-sources
aws logs describe-delivery-destinations

You can view logs directly from the destination log group in real time.

aws logs tail /aws/eks/my-auto-cluster/automode/compute --follow

aws logs tail prints output in the order of timestamp, log stream name, and message.

2026-07-29T03:34:12.382000+00:00 EKS_auto_mode_compute_logs {"resource_arn":"arn:aws:eks:us-east-1:975*********:cluster/my-auto-cluster","event_timestamp":1785296052382,"level":"INFO","message":"found provisionable pod(s)","controller":"provisioner","reconcileID":"11b476e5-43de-4e9f-a959-040b6812c788"}
2026-07-29T03:34:12.412000+00:00 EKS_auto_mode_compute_logs {"resource_arn":"arn:aws:eks:us-east-1:975*********:cluster/my-auto-cluster","event_timestamp":1785296052412,"level":"INFO","message":"created nodeclaim","controller":"provisioner","reconcileID":"11b476e5-43de-4e9f-a959-040b6812c788","NodePool":{"name":"app-nodes"},"NodeClaim":{"name":"app-nodes-t26nz"}}

You can also inspect the log group in the CloudWatch Logs console or run richer queries with CloudWatch Logs Insights.

Notes on log format

Logs delivered through Auto Mode Vended Logs do not have exactly the same format as the standard Karpenter controller logs you would see from a self-managed installation. Vended Logs wraps each log event and adds fields such as resource_arn and event_timestamp, and it does not include fields like time, logger, caller, or commit that appear in self-managed Karpenter logs.

In addition, when you export logs from the console or CloudWatch Logs Insights, they are saved as CSV with two columns, timestamp and message, where the message column contains the actual log event as a JSON string. In other words, the record itself is wrapped in CSV while the log body is stored as JSON.

timestamp,message
1785296052382,"{""resource_arn"":""arn:aws:eks:us-east-1:975*********:cluster/my-auto-cluster"",""event_timestamp"":1785296052382,""level"":""INFO"",""message"":""found provisionable pod(s)"",""controller"":""provisioner"",""reconcileID"":""11b476e5-43de-4e9f-a959-040b6812c788""}"

Extracting only the JSON from the message column gives the following.

{
  "resource_arn": "arn:aws:eks:us-east-1:975*********:cluster/my-auto-cluster",
  "event_timestamp": 1785296052382,
  "level": "INFO",
  "message": "found provisionable pod(s)",
  "controller": "provisioner",
  "reconcileID": "11b476e5-43de-4e9f-a959-040b6812c788"
}

{
  "resource_arn": "arn:aws:eks:us-east-1:975*********:cluster/my-auto-cluster",
  "event_timestamp": 1785296052412,
  "level": "INFO",
  "message": "created nodeclaim",
  "controller": "provisioner",
  "reconcileID": "11b476e5-43de-4e9f-a959-040b6812c788",
  "NodePool": { "name": "app-nodes" },
  "NodeClaim": { "name": "app-nodes-t26nz" }
}

{
  "resource_arn": "arn:aws:eks:us-east-1:975*********:cluster/my-auto-cluster",
  "event_timestamp": 1785296056402,
  "level": "INFO",
  "message": "launched nodeclaim",
  "controller": "nodeclaim.lifecycle",
  "controllerGroup": "karpenter.sh",
  "controllerKind": "NodeClaim",
  "reconcileID": "27e6f9d0-d216-43f9-94c3-62ee00d7c69f",
  "NodeClaim": { "name": "app-nodes-t26nz" },
  "allocatable": {
    "cpu": "1780m",
    "ephemeral-storage": "71Gi",
    "memory": "3157224Ki",
    "pods": "27"
  }
}

Pricing

Auto Mode component logs are billed as CloudWatch Vended Logs. Vended Logs offers reliable, secure delivery with built-in AWS authentication and authorization at a reduced price compared to standard CloudWatch Logs. Charges apply for log delivery and storage. See the Vended Logs section of the CloudWatch pricing page for details.

References

Access AWS-Managed Component Logs For EKS Auto