cis-eks-v160-2-1-2

name	cis-eks-v160-2.1.2
description	Ensure audit logs are collected and managed (Manual)
category	cis-eks
version	1.6.0
author	cyberstrike-official
tags	["cis","eks","kubernetes","aws","logging","audit","control-plane"]
cis_id	2.1.2
cis_benchmark	CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.6.0
tech_stack	["kubernetes","aws","eks"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

2.1.2 Ensure audit logs are collected and managed (Manual)

Profile Applicability

• Level 1

Description

Ensure that audit logs are collected and managed in accordance with the enterprise's audit log management process across all Kubernetes components.

Rationale

Audit logs provide visibility into the activities occurring within a Kubernetes cluster, enabling the detection and investigation of security incidents and policy violations. Proper collection and management of audit logs are essential for maintaining an audit trail and ensuring compliance with security policies.

Implementing comprehensive audit logging may require additional storage and processing resources. Care must be taken to ensure that logs are properly secured and managed to avoid any potential security risks associated with log data.

Audit Procedure

1. Verify audit logging is enabled for Kubernetes components:

kubectl get --raw /api/v1/nodes/${NODE_NAME}/proxy/configz | jq '.kubeletConfig.auditPolicy'

2. Ensure the audit logs are being collected and sent to a centralized logging system:

kubectl get --raw /api/v1/nodes/${NODE_NAME}/proxy/stats/summary | jq '.auditLogs'

3. Verify that the audit logs are being monitored and managed according to the enterprise's audit log management process.

Remediation

1. Create or update the audit-policy.yaml to specify the audit logging configuration:

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: Metadata
    resources:
      - group: ""
        resources: ["pods"]

2. Apply the audit policy configuration to the cluster:

kubectl apply -f <path-to-audit-policy>.yaml

3. Ensure audit logs are forwarded to a centralized logging system like CloudWatch, Elasticsearch, or another log management solution: