> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Etcd Data Directory Ownership Should Be etcd:etcd

### More Info:

Verifies that the etcd data directory is owned by etcd:etcd so only the etcd service account can access the cluster datastore.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, identify the etcd data directory:
           ```bash theme={null}
           ps -ef | grep '[e]tcd' | grep -- --data-dir
           ```
           From the output, note the value passed to `--data-dir`. If no `--data-dir` is present, use `/var/lib/etcd/default.etcd` as the directory.

        2. On every control plane node, confirm the directory exists (replace the path if different):
           ```bash theme={null}
           ls -ld /var/lib/etcd
           ```
           If your `--data-dir` was different, substitute that exact path in place of `/var/lib/etcd`.

        3. On every control plane node, ensure the `etcd` user and group exist:
           ```bash theme={null}
           id etcd
           ```
           If this command fails, create them according to your OS standards before proceeding.

        4. On every control plane node, change ownership of the etcd data directory (substitute the actual data-dir path if different):
           ```bash theme={null}
           chown -R etcd:etcd /var/lib/etcd
           ```

        5. On every control plane node, verify the ownership is now correct for the etcd data directory (replace the path with your actual data-dir if needed):
           ```bash theme={null}
           stat -c %U:%G /var/lib/etcd
           ```
           The output must be:
           ```text theme={null}
           etcd:etcd
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify host-level file ownership such as the etcd data directory on control plane nodes; this must be corrected directly on each control plane node’s filesystem (for example with `chown` on `/var/lib/etcd`). See the Manual Steps section for the exact commands to run on the nodes.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation for: CISKubernetes 1.1.12
        # Ensure that the etcd data directory ownership is set to etcd:etcd
        #
        # Run this script on every control plane node.
        # It is safe to re-run; it will only change ownership when needed.

        set -euo pipefail

        echo "=== [CIS 1.1.12] Fix etcd data directory ownership to etcd:etcd ==="

        # 1. Detect etcd data directory (mirrors the audit logic)
        DATA_DIR=''
        while read -r line; do
          dir=$(printf '%s\n' "$line" | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%')
          if [ -n "$dir" ] && [ -d "$dir" ]; then
            DATA_DIR="$dir"
          fi
        done < <(ps -ef | grep etcd | grep -- --data-dir || true)

        if [ -z "$DATA_DIR" ]; then
          # Fallback per audit command
          DATA_DIR="/var/lib/etcd/default.etcd"
        fi

        if [ ! -d "$DATA_DIR" ]; then
          echo "ERROR: etcd data directory '$DATA_DIR' does not exist on this node."
          exit 1
        fi

        echo "Detected etcd data directory: $DATA_DIR"

        # 2. Ensure etcd user and group exist
        if ! id -u etcd >/dev/null 2>&1; then
          echo "ERROR: user 'etcd' does not exist. Create the etcd user/group before running this script."
          exit 1
        fi
        if ! getent group etcd >/dev/null 2>&1; then
          echo "ERROR: group 'etcd' does not exist. Create the etcd group before running this script."
          exit 1
        fi

        # 3. Check current ownership
        CURRENT_OWNER=$(stat -c %U:%G "$DATA_DIR")
        echo "Current ownership of $DATA_DIR: $CURRENT_OWNER"

        if [ "$CURRENT_OWNER" = "etcd:etcd" ]; then
          echo "Ownership already set to etcd:etcd. No change required."
        else
          echo "Changing ownership of $DATA_DIR to etcd:etcd (recursive)..."
          chown -R etcd:etcd "$DATA_DIR"
          echo "Ownership change complete."
        fi

        # 4. Verification (mirrors the audit command)
        echo "Verifying ownership..."
        VERIFY_DATA_DIR=''
        for d in $(ps -ef | grep etcd | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
          if [ -d "$d" ]; then VERIFY_DATA_DIR="$d"; fi
        done
        if [ -z "$VERIFY_DATA_DIR" ]; then
          VERIFY_DATA_DIR="/var/lib/etcd/default.etcd"
        fi

        if [ ! -d "$VERIFY_DATA_DIR" ]; then
          echo "ERROR: verification failed, directory '$VERIFY_DATA_DIR' does not exist."
          exit 1
        fi

        VERIFY_OWNER=$(stat -c %U:%G "$VERIFY_DATA_DIR")
        echo "Verified ownership of $VERIFY_DATA_DIR: $VERIFY_OWNER"

        if [ "$VERIFY_OWNER" != "etcd:etcd" ]; then
          echo "ERROR: etcd data directory ownership is NOT etcd:etcd after remediation."
          exit 1
        fi

        echo "SUCCESS: etcd data directory ownership is correctly set to etcd:etcd on this control plane node."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>