Cis Eks V160 2.1.2

2.1.2 Ensure audit logs are collected and managed (Manual)

Profile Applicability

• Level 1

Description

Ensure that audit logs are collected and managed in accordance with the enterprise's audit log management process across all Kubernetes components.

Rationale

Audit logs provide visibility into the activities occurring within a Kubernetes cluster, enabling the detection and investigation of security incidents and policy violations. Proper collection and management of audit logs are essential for maintaining an audit trail and ensuring compliance with security policies.

Implementing comprehensive audit logging may require additional storage and processing resources. Care must be taken to ensure that logs are properly secured and managed to avoid any potential security risks associated with log data.

Audit Procedure

1. Verify audit logging is enabled for Kubernetes components:

kubectl get --raw /api/v1/nodes/${NODE_NAME}/proxy/configz | jq '.kubeletConfig.auditPolicy'

2. Ensure the audit logs are being collected and sent to a centralized logging system:

kubectl get --raw /api/v1/nodes/${NODE_NAME}/proxy/stats/summary | jq '.auditLogs'

3. Verify that the audit logs are being monitored and managed according to the enterprise's audit log management process.

Remediation

1. Create or update the audit-policy.yaml to specify the audit logging configuration:

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: Metadata
    resources:
      - group: ""
        resources: ["pods"]

2. Apply the audit policy configuration to the cluster:

kubectl apply -f <path-to-audit-policy>.yaml

3. Ensure audit logs are forwarded to a centralized logging system like CloudWatch, Elasticsearch, or another log management solution:

kubectl create configmap cluster-audit-policy --from-file=audit-policy.yaml -n kube-system
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: audit-logging
  namespace: kube-system
spec:
  containers:
  - name: audit-log-forwarder
    image: my-log-forwarder-image
    volumeMounts:
    - mountPath: /etc/kubernetes/audit
      name: audit-config
  volumes:
  - name: audit-config
    configMap:
      name: cluster-audit-policy
EOF

Default Value

By default, Kubernetes does not enable detailed audit logging. Configuration is required to enable and manage audit logs.

References

1. https://kubernetes.io/docs/tasks/debug-application-cluster/audit/
2. https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#audit-policy

CIS Controls