cis-ocp-v170-3-2-2

name	cis-ocp-v170-3.2.2
description	Ensure audit policy covers key security concerns (Manual)
category	cis-openshift
version	1.7.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","redhat","control-plane-config","logging"]
cis_id	3.2.2
cis_benchmark	CIS Red Hat OpenShift Container Platform Benchmark v1.7.0
tech_stack	["kubernetes","openshift","redhat"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 3.2.2

Profile Applicability

• Level: 2

Description

Ensure that the audit policy created for the cluster covers key security concerns.

Rationale

Security audit logs should cover access and modification of key resources in the cluster, to enable them to form an effective part of a security environment.

Impact

Increasing audit logging will consume resources on the nodes or other log destinations.

Audit Procedure

Review the audit policy provided for the cluster and ensure that it covers the following areas:

• The use of sensitive resources like Secrets, ConfigMaps, and TokenReviews are logged at the Metadata level
• Modifications to pods and deployments are logged at the Request level
• The use of pods/exec, pods/portforward, pods/proxy, and services/proxy are at least logged at the Metadata level

For most requests, minimally logging at the Metadata level is recommended (the most basic level of logging).

You can configure the audit feature to set log level, retention policy, and the type of events to log. You can set the log level settings for an overall component or the API server to one of the following. The setting can be different for each setting.

Use the following command to view the audit policies for the Kubernetes API server:

oc get configmap -n openshift-kube-apiserver kube-apiserver-audit-policies -o json | jq -r '.data."policy.yaml"'

Use the following command to view the audit policies for the OpenShift API server:

oc get configmap -n openshift-apiserver audit -o json | jq -r '.data."policy.yaml"'

Remediation

Update the audit log policy profile to use WriteRequestBodies.

Default Value

Audit logging is configured by default using the Default audit policy, but you are advised to review the log retention settings and log levels to align with your cluster's security posture.

References