API server pod has --audit-log-path set

​

What this check verifies

Kubernetes API server uses an audit log path configured via --audit-log-path on its containers to persist API request events

​

Risk

Without a configured audit log path, API requests may not be recorded, weakening accountability. Gaps in logs hinder detection of unauthorized changes (integrity) and data access (confidentiality), and impede forensics and incident response.

​

Recommendation

Enable and harden audit logging by setting --audit-log-path. If centralizing, use a webhook backend. Define a focused audit policy, enforce least privilege to logs, rotate/retain them, forward to centralized monitoring, and regularly review events for defense in depth.

​

Remediation

Dashboard steps

1. SSH to the control plane node
2. Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3. Under the kube-apiserver container command args, add this line:
   - --audit-log-path=/var/log/apiserver/audit.log
   
4. Save the file; the kubelet will automatically restart the API server

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
• https://kubernetes.io/docs/concepts/cluster-administration/audit/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_audit_log_path_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks