Etcd Data Directory Permissions Should Be 700 Or More Restrictive

Manual Steps

On every control plane node, identify the etcd data directory path:
ps -ef | grep [e]tcd | grep -- --data-dir
Note the value of the --data-dir argument (for example /var/lib/etcd or /var/lib/etcd/default.etcd). If no --data-dir is shown, use /var/lib/etcd/default.etcd.
On the same control plane node, confirm the directory exists (replace the path if different):
ls -ld /var/lib/etcd
or, if identified differently:
ls -ld /var/lib/etcd/default.etcd
On the same control plane node, set the directory permissions to 700 (replace with the actual data directory if different):
chmod 700 /var/lib/etcd
or:
chmod 700 /var/lib/etcd/default.etcd
On the same control plane node, ensure the directory is owned by the etcd user and group (adjust user/group if your deployment uses a different account):
chown etcd:etcd /var/lib/etcd
or:
chown etcd:etcd /var/lib/etcd/default.etcd
Repeat steps 1–4 on every control plane node in the cluster.

Verification (on every control plane node): re-run the benchmark’s audit logic to confirm permissions are 700 or more restrictive:

DATA_DIR=''
for d in $(ps -ef | grep etcd | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
  if test -d "$d"; then DATA_DIR="$d"; fi
done
if ! test -d "$DATA_DIR"; then DATA_DIR=/var/lib/etcd/default.etcd; fi
stat -c permissions=%a "$DATA_DIR"

Ensure the output shows permissions=700 (or a more restrictive value such as 600).

Using kubectl

kubectl cannot change file system permissions on control plane nodes, including the etcd data directory at /var/lib/etcd. This finding must be remediated directly on every control plane node via host-level configuration; see the Manual Steps section for how to apply and verify the fix.

Automation

#!/usr/bin/env bash
#
# Remediation for:
# CISKubernetes 1.1.11 - Ensure that the etcd data directory permissions are set to 700 or more restrictive
#
# Usage: run as root on every control plane node
#   sudo bash fix-etcd-data-dir-perms.sh
#
set -euo pipefail

echo "[INFO] Detecting etcd data directory..."

DATA_DIR=""

# Find etcd --data-dir from running processes
while read -r line; do
  dir="$(printf '%s\n' "$line" | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%')"
  if [ -n "$dir" ] && [ -d "$dir" ]; then
    DATA_DIR="$dir"
  fi
done < <(ps -ef | grep etcd | grep -- --data-dir || true)

# Fallback to default if not found
if [ -z "$DATA_DIR" ]; then
  DATA_DIR="/var/lib/etcd/default.etcd"
fi

if [ ! -d "$DATA_DIR" ]; then
  echo "[ERROR] etcd data directory not found: $DATA_DIR"
  echo "        Confirm the etcd --data-dir argument or create the directory if appropriate."
  exit 1
fi

echo "[INFO] etcd data directory detected: $DATA_DIR"

# Show existing permissions
CURRENT_PERMS="$(stat -c '%a' "$DATA_DIR")"
echo "[INFO] Current permissions on $DATA_DIR: $CURRENT_PERMS"

# Apply restrictive permissions (700) idempotently
echo "[INFO] Setting permissions to 700 on $DATA_DIR (idempotent)..."
chmod 700 "$DATA_DIR"

# Verification
NEW_PERMS="$(stat -c '%a' "$DATA_DIR")"
echo "[INFO] New permissions on $DATA_DIR: $NEW_PERMS"

if [ "$NEW_PERMS" -le 700 ]; then
  echo "[SUCCESS] etcd data directory permissions are 700 or more restrictive."
  exit 0
else
  echo "[FAIL] etcd data directory permissions are NOT 700 or more restrictive."
  exit 2
fi

Kubernetes

Kubernetes Misconfigurations

Etcd Data Directory Permissions Should Be 700 Or More Restrictive

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation