Ensure that the azure.json file has permissions set to 644 or more restrictive

中レベル 1自動aks

説明

The azure.json file in an AKS worker node contains Azure cloud provider configuration used by Kubernetes and related components to interact with Azure resources such as networking, load balancing, and storage. Because this file may contain sensitive cloud configuration details, ensure that its permissions are set to 644 or more restrictive. Runs on each AKS node; SKIPs where /etc/kubernetes/azure.json is absent.

チェック方法

監査方法: シェルコマンド

shell

set -f
f=""; for x in /etc/kubernetes/azure.json; do if [ -e "$x" ]; then f=$x; break; fi; done
[ -n "$f" ] || exit 1
p=$(stat -Lc %a "$f") || exit 1
if [ $((0$p & 0133)) -eq 0 ]; then echo compliant; else echo "noncompliant: $f mode $p"; fi

期待される出力: compliant

修正方法

修正方法: シェルコマンド

shell

chmod u-x,go-wx /etc/kubernetes/azure.json

プロパティ

オペレーティングシステム: すべて
タグ: aksworker-nodefile-permissions
参照: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 3.1.3 Ensure that the azure.json file has permissions set to 644 or more restrictive

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target aks