Project: KICS (Provisioning / Security & Compliance)
File: 13a49a2e-488e-4309-a7c0-d6b05577a5fb.md

title: Audit Policy File Not Defined hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 13a49a2e-488e-4309-a7c0-d6b05577a5fb Query name: Audit Policy File Not Defined Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: When using kube-apiserver command, the '--audit-policy-file' flag should be defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver","--audit-policy-file=./not/valid/file.yaml"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="12" apiVersion: serving.knative.dev/v1 kind: Service metadata: name: dummy namespace: knative-sequence spec: template: spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: [] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-policy-file=/home/foo/cx/kics/assets/queries/k8s/auditpolicyfilenotdefined/test/negative1.yaml"] restartPolicy: OnFailure apiVersion: audit.k8s.io/v1 # This is required. kind: Policy omitStages: "RequestReceived" rules: level: RequestResponse resources: group: "" resources: ["pods"] level: Metadata resources: group: "" resources: ["pods/log", "pods/status"] level: None resources: group: "" resources: ["configmaps"] resourceNames: ["controller-leader"] level: None users: ["system:kube-proxy"] verbs: ["watch"] resources: group: "" # core API group resources: ["endpoints", "services"] level: None userGroups: ["system:authenticated"] nonResourceURLs: "/api*" # Wildcard matching. "/version" level: Request resources: group: "" # core API group resources: ["configmaps"] namespaces: ["kube-system"] level: Metadata resources: group: "" # core API group resources: ["secrets", "configmaps"] level: Request resources: group: "" # core API group group: "extensions" # Version of group should NOT be included. level: Metadata omitStages: "RequestReceived" ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver","--audit-policy-file=/home/foo/cx/kics/assets/queries/k8s/auditpolicyfilenotdefined/test/negative2.yaml"] args: [] restartPolicy: OnFailure apiVersion: audit.k8s.io/v1 # This is required. kind: Policy omitStages: "RequestReceived" rules: level: RequestResponse resources: group: "" resources: ["pods"] level: Metadata resources: group: "" resources: ["pods/log", "pods/status"] level: None resources: group: "" resources: ["configmaps"] resourceNames: ["controller-leader"] level: None users: ["system:kube-proxy"] verbs: ["watch"] resources: group: "" # core API group resources: ["endpoints", "services"] level: None userGroups: ["system:authenticated"] nonResourceURLs: "/api*" # Wildcard matching. "/version" level: Request resources: group: "" # core API group resources: ["configmaps"] namespaces: ["kube-system"] level: Metadata resources: group: "" # core API group resources: ["secrets", "configmaps"] level: Request resources: group: "" # core API group group: "extensions" # Version of group should NOT be included. level: Metadata omitStages: "RequestReceived" ```