> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Etcd Data Directory Permissions Should Be 700 Or More Restrictive

### More Info:

Verifies that the etcd data directory has permissions of 700 or more restrictive. The etcd datastore holds all cluster state including secrets and must be tightly protected.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, identify the etcd data directory path:
           ```bash theme={null}
           ps -ef | grep [e]tcd | grep -- --data-dir
           ```
           Note the value of the `--data-dir` argument (for example `/var/lib/etcd` or `/var/lib/etcd/default.etcd`). If no `--data-dir` is shown, use `/var/lib/etcd/default.etcd`.

        2. On the same control plane node, confirm the directory exists (replace the path if different):
           ```bash theme={null}
           ls -ld /var/lib/etcd
           ```
           or, if identified differently:
           ```bash theme={null}
           ls -ld /var/lib/etcd/default.etcd
           ```

        3. On the same control plane node, set the directory permissions to 700 (replace with the actual data directory if different):
           ```bash theme={null}
           chmod 700 /var/lib/etcd
           ```
           or:
           ```bash theme={null}
           chmod 700 /var/lib/etcd/default.etcd
           ```

        4. On the same control plane node, ensure the directory is owned by the etcd user and group (adjust user/group if your deployment uses a different account):
           ```bash theme={null}
           chown etcd:etcd /var/lib/etcd
           ```
           or:
           ```bash theme={null}
           chown etcd:etcd /var/lib/etcd/default.etcd
           ```

        5. Repeat steps 1–4 on every control plane node in the cluster.

        6. Verification (on every control plane node): re-run the benchmark’s audit logic to confirm permissions are 700 or more restrictive:
           ```bash theme={null}
           DATA_DIR=''
           for d in $(ps -ef | grep etcd | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
             if test -d "$d"; then DATA_DIR="$d"; fi
           done
           if ! test -d "$DATA_DIR"; then DATA_DIR=/var/lib/etcd/default.etcd; fi
           stat -c permissions=%a "$DATA_DIR"
           ```
           Ensure the output shows `permissions=700` (or a more restrictive value such as `600`).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file system permissions on control plane nodes, including the etcd data directory at `/var/lib/etcd`. This finding must be remediated directly on every control plane node via host-level configuration; see the Manual Steps section for how to apply and verify the fix.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation for:
        # CISKubernetes 1.1.11 - Ensure that the etcd data directory permissions are set to 700 or more restrictive
        #
        # Usage: run as root on every control plane node
        #   sudo bash fix-etcd-data-dir-perms.sh
        #
        set -euo pipefail

        echo "[INFO] Detecting etcd data directory..."

        DATA_DIR=""

        # Find etcd --data-dir from running processes
        while read -r line; do
          dir="$(printf '%s\n' "$line" | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%')"
          if [ -n "$dir" ] && [ -d "$dir" ]; then
            DATA_DIR="$dir"
          fi
        done < <(ps -ef | grep etcd | grep -- --data-dir || true)

        # Fallback to default if not found
        if [ -z "$DATA_DIR" ]; then
          DATA_DIR="/var/lib/etcd/default.etcd"
        fi

        if [ ! -d "$DATA_DIR" ]; then
          echo "[ERROR] etcd data directory not found: $DATA_DIR"
          echo "        Confirm the etcd --data-dir argument or create the directory if appropriate."
          exit 1
        fi

        echo "[INFO] etcd data directory detected: $DATA_DIR"

        # Show existing permissions
        CURRENT_PERMS="$(stat -c '%a' "$DATA_DIR")"
        echo "[INFO] Current permissions on $DATA_DIR: $CURRENT_PERMS"

        # Apply restrictive permissions (700) idempotently
        echo "[INFO] Setting permissions to 700 on $DATA_DIR (idempotent)..."
        chmod 700 "$DATA_DIR"

        # Verification
        NEW_PERMS="$(stat -c '%a' "$DATA_DIR")"
        echo "[INFO] New permissions on $DATA_DIR: $NEW_PERMS"

        if [ "$NEW_PERMS" -le 700 ]; then
          echo "[SUCCESS] etcd data directory permissions are 700 or more restrictive."
          exit 0
        else
          echo "[FAIL] etcd data directory permissions are NOT 700 or more restrictive."
          exit 2
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>