V-242402—The Kubernetes API Server must have an audit log path set.
CAT II - Medium
CNTR-K8-000610
>Control Description
When Kubernetes is started, components and user services are started for auditing startup events, and events for components and services, it is important that auditing begin on startup. Within Kubernetes, audit data for all components is generated by the API server. To enable auditing to begin, an audit policy must be defined for the events and the information to be stored with each event. It is also necessary to give a secure location where the audit logs are to be stored. If an audit log path is not specified, all audit data is sent to studio.
>Check Content
Change to the /etc/kubernetes/manifests directory on the Kubernetes Control Plane.
$grep -i audit-log-path *If the "--audit-log-path" is not set, this is a finding.
>Remediation
Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Set the value of "--audit-log-path" to a secure location for the audit logs to be written. Note: If the API server is running as a Pod, then the manifest will also need to be updated to mount the host system filesystem where the audit log file is to be written.
>CCI References
Control Correlation Identifiers (CCIs) map STIG findings to NIST 800-53 controls.
>Cross-Framework Mappings
NIST SP 800-53 r5
via DISA CCI ListAsk AI
Configure your API key to use AI features.