> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Audit Logs

### More Info:

Audit logs record all requests made to the Kubernetes master components in the AKS cluster. Enabling collection of kube-audit and kube-audit-admin logs via Azure Diagnostic settings provides an authoritative record of activity for security investigations and compliance.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS AKS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify the AKS cluster and its resource group**
           * On any machine with Azure CLI access:
             ```bash theme={null}
             az aks list -o table
             ```
           * Note the `name` of the cluster and its `resourceGroup` (for example, `myAKSCluster` and `myResourceGroup`). Do **not** use the `MC_...` node resource group.

        2. **List existing diagnostic settings on the AKS resource**
           * On any machine with Azure CLI access:
             ```bash theme={null}
             az monitor diagnostic-settings list \
               --resource "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerService/managedClusters/<AKS_CLUSTER_NAME>" \
               -o json
             ```
           * Review the output to see if there is a diagnostic setting that sends logs to a Log Analytics workspace and includes `kube-audit` and `kube-audit-admin` in `logs[].category`.

        3. **Confirm Log Analytics workspace details (if present)**
           * If a diagnostic setting already sends logs to a workspace, get the workspace info:
             ```bash theme={null}
             az monitor diagnostic-settings show \
               --name <DIAGNOSTIC_SETTING_NAME> \
               --resource "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerService/managedClusters/<AKS_CLUSTER_NAME>" \
               -o json
             ```
           * Verify that `logs[].category` includes `kube-audit` and `kube-audit-admin` and that `workspaceId` is populated.

        4. **Decision: adjust an existing diagnostic setting or plan a new one**
           * If an existing diagnostic setting targets a Log Analytics workspace but is missing `kube-audit` or `kube-audit-admin`, plan to modify it in the Azure portal (as per the benchmark steps) to add these categories.
           * If no diagnostic setting sends logs to Log Analytics, plan to create one in the Azure portal on the AKS cluster resource, choosing or creating an appropriate Log Analytics workspace and enabling `kube-audit` and `kube-audit-admin`.

        5. **Implement changes in Azure portal (manual UI action)**
           * In a browser, open the Azure portal and navigate to the AKS cluster’s resource group (not the `MC_...` group).
           * Use **Diagnostic settings** on the AKS cluster resource to either:
             * Edit an existing diagnostic setting to ensure `Send to Log Analytics` is enabled and both `kube-audit` and `kube-audit-admin` logs are selected, or
             * Add a new diagnostic setting configured as above, following the benchmark remediation steps exactly.

        6. **Verify that kube-audit logs are enabled**
           * After saving the diagnostic setting, re-run on any machine with Azure CLI:
             ```bash theme={null}
             az monitor diagnostic-settings list \
               --resource "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.ContainerService/managedClusters/<AKS_CLUSTER_NAME>" \
               -o json
             ```
           * Confirm in the JSON output that at least one diagnostic setting for the AKS cluster has `logs[].category` including both `kube-audit` and `kube-audit-admin`, and that it is configured to send data to a Log Analytics workspace.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot enable or configure AKS control‑plane audit logs, because this setting is managed at the Azure resource/diagnostic level, not via Kubernetes API objects. To remediate this finding, use the Azure portal/CLI or your IaC to configure Diagnostic settings for the AKS cluster as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Purpose:
        #   Report whether kube-audit and kube-audit-admin logs are enabled for each AKS cluster
        #   in the currently selected Azure subscription, so you can review CIS AKS 2.1.1 at scale.
        #
        # Requirements:
        #   - Azure CLI installed and logged in
        #   - az extension add --name aks-preview   (if prompted)
        #   - Sufficient RBAC to read AKS and diagnostic settings
        #
        # This script does NOT make any changes.

        set -euo pipefail

        echo "Subscription: $(az account show --query name -o tsv)  (ID: $(az account show --query id -o tsv))"
        echo

        # Get list of AKS clusters (name and resource group)
        mapfile -t CLUSTERS < <(az aks list --query "[].{name:name, rg:resourceGroup}" -o tsv)

        if [ "${#CLUSTERS[@]}" -eq 0 ]; then
          echo "No AKS clusters found in this subscription."
          exit 0
        fi

        printf "%-40s %-35s %-40s %-10s %-10s\n" "AKS Cluster" "AKS RG (management RG)" "Diag Setting Name" "kube-audit" "kube-audit-admin"
        printf "%0.s-" {1..140}; echo

        for LINE in "${CLUSTERS[@]}"; do
          AKS_NAME=$(echo "$LINE" | awk '{print $1}')
          AKS_RG=$(echo "$LINE"   | awk '{print $2}')

          # The CIS text refers to the *management* RG (the one you see in 'resourceGroup' field above).
          # Diagnostic settings are attached to the AKS resource itself, not the MC_* RG.
          AKS_ID=$(az aks show -g "$AKS_RG" -n "$AKS_NAME" --query "id" -o tsv)

          # List diagnostic settings on the AKS resource
          DIAG_JSON=$(az monitor diagnostic-settings list --resource "$AKS_ID" 2>/dev/null || echo "{}")
          DIAG_COUNT=$(echo "$DIAG_JSON" | jq '.value | length')

          if [ "$DIAG_COUNT" -eq 0 ]; then
            # No diagnostic settings configured at all
            printf "%-40s %-35s %-40s %-10s %-10s\n" "$AKS_NAME" "$AKS_RG" "NONE" "NO" "NO"
            continue
          fi

          # For each diagnostic setting, check whether kube-audit and kube-audit-admin are enabled
          echo "$DIAG_JSON" | jq -c '.value[]' | while read -r DIAG; do
            DS_NAME=$(echo "$DIAG" | jq -r '.name')
            # Look at enabled log categories
            KUBE_AUDIT_ENABLED=$(echo "$DIAG" \
              | jq -r '.logs[] | select(.category=="kube-audit") | select(.enabled==true) | "YES"' \
              | head -n1)
            KUBE_AUDIT_ADMIN_ENABLED=$(echo "$DIAG" \
              | jq -r '.logs[] | select(.category=="kube-audit-admin") | select(.enabled==true) | "YES"' \
              | head -n1)

            # Normalize empty -> NO
            [ -z "$KUBE_AUDIT_ENABLED" ] && KUBE_AUDIT_ENABLED="NO"
            [ -z "$KUBE_AUDIT_ADMIN_ENABLED" ] && KUBE_AUDIT_ADMIN_ENABLED="NO"

            printf "%-40s %-35s %-40s %-10s %-10s\n" "$AKS_NAME" "$AKS_RG" "$DS_NAME" "$KUBE_AUDIT_ENABLED" "$KUBE_AUDIT_ADMIN_ENABLED"
          done
        done

        cat <<'EOF'

        How to interpret the output:

        - Problem cases (need manual review/fix via Azure Portal/CLI/IaC):
          - Diag Setting Name = "NONE"
              -> No diagnostic settings are configured for this AKS cluster.
                 kube-audit and kube-audit-admin are NOT being collected.
          - kube-audit = NO or kube-audit-admin = NO
              -> That diagnostic setting does not collect the required log type.
                 If no diagnostic setting for that cluster has both values = YES,
                 the cluster does not meet CIS AKS 2.1.1.

        - Acceptable cases:
          - At least one row per AKS cluster where:
                kube-audit       = YES
                kube-audit-admin = YES
            and that diagnostic setting is configured to send logs to Log Analytics
            (you must confirm the "Send to Log Analytics" target separately, as this
            script only checks which categories are enabled).

        The actual enabling of these logs must be done manually in the Azure Portal
        (or equivalent IaC), following the benchmark remediation steps.
        EOF
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>