> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Etcd Data Directory Permissions Are Restrictive

### More Info:

Ensure that the etcd data directory has permissions of 700 or more restrictive.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, identify the etcd data directory:
           ```bash theme={null}
           ps -ef | grep etcd | grep -- --data-dir
           ```
           Note the value passed to `--data-dir` (for example `/var/lib/etcd` or `/var/lib/etcd/default.etcd`).

        2. If no `--data-dir` is visible from the process (for example, etcd not currently running), inspect the static pod manifest to find it:
           ```bash theme={null}
           sudo cat /etc/kubernetes/manifests/etcd.yaml | grep -A2 -- '--data-dir'
           ```

        3. On the same control plane node, ensure the directory exists and has restrictive permissions (replace `/var/lib/etcd` with the directory you found):
           ```bash theme={null}
           sudo test -d /var/lib/etcd || sudo mkdir -p /var/lib/etcd
           sudo chmod 700 /var/lib/etcd
           ```

        4. (Optional but recommended) Confirm the directory owner is the user running etcd (commonly `etcd` or `root`); adjust if needed, replacing `etcd` and the directory as appropriate:
           ```bash theme={null}
           ps -ef | grep etcd | grep -v grep
           stat /var/lib/etcd
           sudo chown etcd:etcd /var/lib/etcd
           ```

        5. Repeat steps 1–4 on every control plane node.

        6. Verification (run on every control plane node):
           ```bash theme={null}
           DATA_DIR=''
           for d in $(ps -ef | grep etcd | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
             if test -d "$d"; then DATA_DIR="$d"; fi
           done
           if ! test -d "$DATA_DIR"; then DATA_DIR=/var/lib/etcd/default.etcd; fi
           stat -c permissions=%a "$DATA_DIR"
           ```
           Confirm the output shows `permissions=700` (or a more restrictive value like `600`).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify filesystem permissions on the etcd data directory or edit host-level files like `/etc/kubernetes/manifests/etcd.yaml`; this must be corrected directly on each control plane node via SSH. Refer to the Manual Steps section for the exact host-level commands to set the etcd data directory to mode `700` or more restrictive.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Purpose: Ensure etcd data directory permissions are 700 or more restrictive
        # Scope:   Run on every control plane node
        # Safe:    Idempotent; can be re-run

        set -euo pipefail

        echo "=== Detecting etcd data directory on this node ==="

        DATA_DIR=""

        # Try to discover the etcd data directory from running processes
        for d in $(ps -ef | grep '[e]tcd' | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
          if [ -d "$d" ]; then
            DATA_DIR="$d"
          fi
        done

        # Fallback to default if nothing discovered
        if [ -z "$DATA_DIR" ]; then
          DEFAULT_DIR="/var/lib/etcd/default.etcd"
          if [ -d "$DEFAULT_DIR" ]; then
            DATA_DIR="$DEFAULT_DIR"
          fi
        fi

        if [ -z "$DATA_DIR" ]; then
          echo "ERROR: Could not determine etcd data directory. Is this a control plane node with etcd running?"
          exit 1
        fi

        echo "Using etcd data directory: $DATA_DIR"

        if [ ! -d "$DATA_DIR" ]; then
          echo "ERROR: Detected etcd data directory does not exist: $DATA_DIR"
          exit 1
        fi

        echo "=== Current permissions ==="
        stat -c 'path=%n permissions=%a owner=%U group=%G' "$DATA_DIR"

        echo "=== Applying restrictive permissions (700) to etcd data directory ==="
        chmod 700 "$DATA_DIR"

        echo "=== Verifying permissions ==="
        PERMS="$(stat -c '%a' "$DATA_DIR")"
        echo "Final permissions on $DATA_DIR: $PERMS"

        if [ "$PERMS" -le 700 ]; then
          echo "SUCCESS: etcd data directory permissions are 700 or more restrictive."
          exit 0
        else
          echo "FAIL: etcd data directory permissions are not restrictive enough (got $PERMS, expected <= 700)."
          exit 2
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://coreos.com/etcd/docs/latest/op-guide/configuration.html#data-dir](https://coreos.com/etcd/docs/latest/op-guide/configuration.html#data-dir)