Azure Enable Audit Logs - Security Rule

More Info:

Audit logs record all requests made to the Kubernetes master components in the AKS cluster. Enabling collection of kube-audit and kube-audit-admin logs via Azure Diagnostic settings provides an authoritative record of activity for security investigations and compliance.

Risk Level

High

Address

Security

Compliance Standards

CIS AKS

Triage and Remediation

Remediation

Remediation

Manual Steps

Identify the AKS cluster and its resource group
- On any machine with Azure CLI access:
```
az aks list -o table
```
- Note the name of the cluster and its resourceGroup (for example, myAKSCluster and myResourceGroup). Do not use the MC_... node resource group.
List existing diagnostic settings on the AKS resource
- On any machine with Azure CLI access:
```
az monitor diagnostic-settings list \
  --resource "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerService/managedClusters/<AKS_CLUSTER_NAME>" \
  -o json
```
- Review the output to see if there is a diagnostic setting that sends logs to a Log Analytics workspace and includes kube-audit and kube-audit-admin in logs[].category.

Confirm Log Analytics workspace details (if present)

If a diagnostic setting already sends logs to a workspace, get the workspace info:

az monitor diagnostic-settings show \
  --name <DIAGNOSTIC_SETTING_NAME> \
  --resource "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerService/managedClusters/<AKS_CLUSTER_NAME>" \
  -o json

Verify that logs[].category includes kube-audit and kube-audit-admin and that workspaceId is populated.

Decision: adjust an existing diagnostic setting or plan a new one
- If an existing diagnostic setting targets a Log Analytics workspace but is missing kube-audit or kube-audit-admin, plan to modify it in the Azure portal (as per the benchmark steps) to add these categories.
- If no diagnostic setting sends logs to Log Analytics, plan to create one in the Azure portal on the AKS cluster resource, choosing or creating an appropriate Log Analytics workspace and enabling kube-audit and kube-audit-admin.
Implement changes in Azure portal (manual UI action)
- In a browser, open the Azure portal and navigate to the AKS cluster’s resource group (not the MC_... group).
- Use Diagnostic settings on the AKS cluster resource to either:
  - Edit an existing diagnostic setting to ensure Send to Log Analytics is enabled and both kube-audit and kube-audit-admin logs are selected, or
  - Add a new diagnostic setting configured as above, following the benchmark remediation steps exactly.
Verify that kube-audit logs are enabled
- After saving the diagnostic setting, re-run on any machine with Azure CLI:
```
az monitor diagnostic-settings list \
  --resource "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerService/managedClusters/<AKS_CLUSTER_NAME>" \
  -o json
```
- Confirm in the JSON output that at least one diagnostic setting for the AKS cluster has logs[].category including both kube-audit and kube-audit-admin, and that it is configured to send data to a Log Analytics workspace.

Using kubectl

kubectl cannot enable or configure AKS control‑plane audit logs, because this setting is managed at the Azure resource/diagnostic level, not via Kubernetes API objects. To remediate this finding, use the Azure portal/CLI or your IaC to configure Diagnostic settings for the AKS cluster as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Purpose:
#   Report whether kube-audit and kube-audit-admin logs are enabled for each AKS cluster
#   in the currently selected Azure subscription, so you can review CIS AKS 2.1.1 at scale.
#
# Requirements:
#   - Azure CLI installed and logged in
#   - az extension add --name aks-preview   (if prompted)
#   - Sufficient RBAC to read AKS and diagnostic settings
#
# This script does NOT make any changes.

set -euo pipefail

echo "Subscription: $(az account show --query name -o tsv)  (ID: $(az account show --query id -o tsv))"
echo

# Get list of AKS clusters (name and resource group)
mapfile -t CLUSTERS < <(az aks list --query "[].{name:name, rg:resourceGroup}" -o tsv)

if [ "${#CLUSTERS[@]}" -eq 0 ]; then
  echo "No AKS clusters found in this subscription."
  exit 0
fi

printf "%-40s %-35s %-40s %-10s %-10s\n" "AKS Cluster" "AKS RG (management RG)" "Diag Setting Name" "kube-audit" "kube-audit-admin"
printf "%0.s-" {1..140}; echo

for LINE in "${CLUSTERS[@]}"; do
  AKS_NAME=$(echo "$LINE" | awk '{print $1}')
  AKS_RG=$(echo "$LINE"   | awk '{print $2}')

  # The CIS text refers to the *management* RG (the one you see in 'resourceGroup' field above).
  # Diagnostic settings are attached to the AKS resource itself, not the MC_* RG.
  AKS_ID=$(az aks show -g "$AKS_RG" -n "$AKS_NAME" --query "id" -o tsv)

  # List diagnostic settings on the AKS resource
  DIAG_JSON=$(az monitor diagnostic-settings list --resource "$AKS_ID" 2>/dev/null || echo "{}")
  DIAG_COUNT=$(echo "$DIAG_JSON" | jq '.value | length')

  if [ "$DIAG_COUNT" -eq 0 ]; then
    # No diagnostic settings configured at all
    printf "%-40s %-35s %-40s %-10s %-10s\n" "$AKS_NAME" "$AKS_RG" "NONE" "NO" "NO"
    continue
  fi

  # For each diagnostic setting, check whether kube-audit and kube-audit-admin are enabled
  echo "$DIAG_JSON" | jq -c '.value[]' | while read -r DIAG; do
    DS_NAME=$(echo "$DIAG" | jq -r '.name')
    # Look at enabled log categories
    KUBE_AUDIT_ENABLED=$(echo "$DIAG" \
      | jq -r '.logs[] | select(.category=="kube-audit") | select(.enabled==true) | "YES"' \
      | head -n1)
    KUBE_AUDIT_ADMIN_ENABLED=$(echo "$DIAG" \
      | jq -r '.logs[] | select(.category=="kube-audit-admin") | select(.enabled==true) | "YES"' \
      | head -n1)

    # Normalize empty -> NO
    [ -z "$KUBE_AUDIT_ENABLED" ] && KUBE_AUDIT_ENABLED="NO"
    [ -z "$KUBE_AUDIT_ADMIN_ENABLED" ] && KUBE_AUDIT_ADMIN_ENABLED="NO"

    printf "%-40s %-35s %-40s %-10s %-10s\n" "$AKS_NAME" "$AKS_RG" "$DS_NAME" "$KUBE_AUDIT_ENABLED" "$KUBE_AUDIT_ADMIN_ENABLED"
  done
done

cat <<'EOF'

How to interpret the output:

- Problem cases (need manual review/fix via Azure Portal/CLI/IaC):
  - Diag Setting Name = "NONE"
      -> No diagnostic settings are configured for this AKS cluster.
         kube-audit and kube-audit-admin are NOT being collected.
  - kube-audit = NO or kube-audit-admin = NO
      -> That diagnostic setting does not collect the required log type.
         If no diagnostic setting for that cluster has both values = YES,
         the cluster does not meet CIS AKS 2.1.1.

- Acceptable cases:
  - At least one row per AKS cluster where:
        kube-audit       = YES
        kube-audit-admin = YES
    and that diagnostic setting is configured to send logs to Log Analytics
    (you must confirm the "Send to Log Analytics" target separately, as this
    script only checks which categories are enabled).

The actual enabling of these logs must be done manually in the Azure Portal
(or equivalent IaC), following the benchmark remediation steps.
EOF

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​