> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Etcd Pod Specification File Permissions Should Be 600 Or More Restrictive

### More Info:

Verifies that the etcd pod manifest file has permissions of 600 or more restrictive to protect the datastore configuration.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, check the current permissions of the etcd manifest file:
           ```bash theme={null}
           stat -c 'File: %n  Permissions: %a (%A)' /etc/kubernetes/manifests/etcd.yaml
           ```

        2. On every control plane node, set the permissions of the etcd manifest file to 600:
           ```bash theme={null}
           chmod 600 /etc/kubernetes/manifests/etcd.yaml
           ```

        3. (Optional, on every control plane node) Set the file owner and group to root (if not already):
           ```bash theme={null}
           chown root:root /etc/kubernetes/manifests/etcd.yaml
           ```

        4. On every control plane node, verify the permissions are now 600 or more restrictive:
           ```bash theme={null}
           /bin/sh -c 'if test -e /etc/kubernetes/manifests/etcd.yaml; then find /etc/kubernetes/manifests/etcd.yaml -name "*etcd*" | xargs stat -c permissions=%a; fi'
           ```
           Ensure the output shows:
           ```text theme={null}
           permissions=600
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        `kubectl` cannot modify file permissions on control plane nodes, so it cannot fix the permissions on `/etc/kubernetes/manifests/etcd.yaml`. This must be corrected directly on every control plane node’s filesystem; see the **Manual Steps** section for the required host-level commands.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediate CIS Kubernetes 1.1.7:
        # Ensure that the etcd pod specification file permissions are set to 600 or more restrictive.
        #
        # Run on: every control plane node (with root or sudo access).
        # Safe to re-run (idempotent).

        set -euo pipefail

        ETCD_MANIFEST="/etc/kubernetes/manifests/etcd.yaml"
        DESIRED_MODE="600"

        echo "=== CIS 1.1.7: Fix etcd manifest permissions on this control plane node ==="

        if [[ ! -e "$ETCD_MANIFEST" ]]; then
          echo "Etcd manifest not found at $ETCD_MANIFEST – nothing to do on this node."
          exit 0
        fi

        # Show current permissions
        CURRENT_MODE="$(stat -c '%a' "$ETCD_MANIFEST" || echo 'unknown')"
        echo "Current permissions on $ETCD_MANIFEST: $CURRENT_MODE"

        # Apply fix (idempotent: chmod 600 is safe repeatedly)
        echo "Setting permissions on $ETCD_MANIFEST to $DESIRED_MODE ..."
        chmod "$DESIRED_MODE" "$ETCD_MANIFEST"

        # Verification using the benchmark's audit logic
        echo "Verifying permissions using audit-style command..."
        VERIFY_OUTPUT="$(/bin/sh -c "if test -e $ETCD_MANIFEST; then find $ETCD_MANIFEST -name '*etcd*' | xargs stat -c permissions=%a; fi")"

        echo "Audit output:"
        echo "$VERIFY_OUTPUT"

        # Parse verification result: expect permissions=600
        if echo "$VERIFY_OUTPUT" | grep -q "permissions=${DESIRED_MODE}\b"; then
          echo "SUCCESS: $ETCD_MANIFEST permissions are set to $DESIRED_MODE as required."
          exit 0
        else
          echo "ERROR: $ETCD_MANIFEST permissions are not correctly set. Please investigate manually."
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>