k8saudit-eks doesn't seem to include the latest version of the shared aws lib. It doesn't include https://github.com/falcosecurity/plugins/pull/899 specifically. https://github.com/falcosecurity/plugins/blob/main/plugins/k8saudit-eks/go.mod#L8 https://github.com/falcosecurity/plugins/tree/main/shared/go/aws/cloudwatchlogs