cis-aks-v170-2-1-1

name	cis-aks-v170-2.1.1
description	Enable audit Logs (Manual)
category	cis-aks
version	1.7.0
author	cyberstrike-official
tags	["cis","aks","kubernetes","azure","control-plane","logging","audit-logs"]
cis_id	2.1.1
cis_benchmark	CIS Azure Kubernetes Service (AKS) Benchmark v1.7.0
tech_stack	["kubernetes","azure","aks"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

2.1.1 Enable audit Logs (Manual)

Profile Applicability

• Level 1

Description

With Azure Kubernetes Service (AKS), the control plane components such as the kube-apiserver and kube-controller-manager are provided as a managed service. You create and manage the nodes that run the kubelet and container runtime, and deploy your applications through the managed Kubernetes API server. To help troubleshoot your application and services, you may need to view the logs generated by these control plane components.

To help collect and review data from multiple sources, Azure Monitor logs provides a query language and analytics engine that provides insights to your environment. A workspace is used to collate and analyze the data, and can integrate with other Azure services such as Application Insights and Security Center.

Rationale

Exporting logs and metrics to a dedicated, persistent datastore ensures availability of audit data following a cluster security event, and provides a central location for analysis of log and metric data collated from multiple sources.

Impact

What is collected from Kubernetes clusters Container insights includes a predefined set of metrics and inventory items collected that are written as log data in your Log Analytics workspace. All metrics listed below are collected by default every one minute.

Node metrics collected (24 metrics per node): cpuUsageNanoCores, cpuCapacityNanoCores, cpuAllocatableNanoCores, memoryRssBytes, memoryWorkingSetBytes, memoryCapacityBytes, memoryAllocatableBytes, restartTimeEpoch, used (disk), free (disk), used_percent (disk), io_time (diskio), writes (diskio), reads (diskio), write_bytes (diskio), write_time (diskio), iops_in_progress (diskio), read_bytes (diskio), read_time (diskio), err_in (net), err_out (net), bytes_recv (net), bytes_sent (net), Kubelet_docker_operations (kubelet).

Container metrics (8 metrics per container): cpuUsageNanoCores, cpuRequestNanoCores, cpuLimitNanoCores, memoryRssBytes, memoryWorkingSetBytes, memoryRequestBytes, memoryLimitBytes, restartTimeEpoch.

Cluster inventory collected by default: KubePodInventory (1 per minute per container), KubeNodeInventory (1 per node per minute), KubeServices (1 per service per minute), ContainerInventory (1 per container per minute).

Audit Procedure

Azure audit logs are enabled and managed in the Azure portal.

Remediation

Azure audit logs are enabled and managed in the Azure portal. To enable log collection for the Kubernetes master components in your AKS cluster, open the Azure portal in a web browser and complete the following steps:

1. Select the resource group for your AKS cluster, such as myResourceGroup. Don't select the resource group that contains your individual AKS cluster resources, such as MC_myResourceGroup_myAKSCluster_eastus.