Ensure authorized access to OCI Audit logs for OKE activity

CaoCấp 1Xem xét thủ côngoke

Mô tả

OCI Audit logs are separate from OKE managed Kubernetes control plane service logs. OKE integrates with the Oracle Cloud Infrastructure Audit service to record operations performed by Kubernetes Engine and the Kubernetes API server as Audit log events. Operations performed by Kubernetes Engine and the Kubernetes API server are visible as log events in the Oracle Cloud Infrastructure Audit service. The benchmark marks this recommendation Manual.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

To monitor and manage operations performed by Container Engine for Kubernetes on a particular cluster: Review IAM policies and confirm that only authorized groups are granted access to read OCI Audit events for the tenancy or approved compartment. The read audit-events permission allows access to Audit log events. To view operations performed by Container Engine for Kubernetes and the Kubernetes API server as log events in the Oracle Cloud Infrastructure Audit service: Open the navigation menu, select Identity & Security, and then select Audit.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Update OCI IAM policies so only approved security, operations, or audit groups can read OCI Audit events for the required tenancy or compartment. Remove broad or unnecessary Audit access from users or groups that do not require it, and validate that authorized users can view OKE related events in the Audit service using the appropriate compartment and filters.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: okecontrol-planerbaclogging
Tham chiếu: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 2.2.1 Ensure authorized access to OCI Audit logs for OKE activity