UCF STIG Viewer Logo

The Kubernetes API Server audit log retention must be set.


Overview

Finding ID Version Rule ID IA Controls Severity
V-242464 CNTR-K8-003310 SV-242464r754808_rule Medium
Description
The Kubernetes API Server must set enough storage to retain logs for monitoring suspicious activity and system misconfiguration, and provide evidence for Cyber Security Investigations.
STIG Date
Kubernetes Security Technical Implementation Guide 2021-06-17

Details

Check Text ( C-45739r754807_chk )
Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master Node. Run the command:

grep -i audit-log-maxage *

If the setting "audit-log-maxage" is not set in the Kubernetes API Server manifest file or it is set less than "30", this is a finding.
Fix Text (F-45697r712747_fix)
Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the value of "--audit-log-maxage" to a minimum of "30".