> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Json File Ownership Set To Root Root

### More Info:

The azure.json file should be owned by root:root so only privileged users can access the cloud provider credentials it contains.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS AKS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, confirm the file exists and see current ownership:
           ```bash theme={null}
           ls -l /etc/kubernetes/azure.json
           ```
           Run on: every worker node.

        2. Fix the ownership to root:root:
           ```bash theme={null}
           sudo chown root:root /etc/kubernetes/azure.json
           ```
           Run on: every worker node.

        3. (Optional but recommended) Restrict permissions to owner read/write only:
           ```bash theme={null}
           sudo chmod 600 /etc/kubernetes/azure.json
           ```
           Run on: every worker node.

        4. Verify the ownership is now root:root:
           ```bash theme={null}
           stat -c %U:%G /etc/kubernetes/azure.json
           ```
           Expected output:
           ```text theme={null}
           root:root
           ```
           Run on: every worker node.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change file ownership on node filesystems, including `/etc/kubernetes/azure.json`; this must be fixed directly on every worker node’s host OS. See the Manual Steps section for the exact commands to run on each node to correct ownership and re‑run the audit.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation for:
        # CIS AKS 3.1.4 - Ensure that the azure.json file ownership is set to root:root
        #
        # Scope: run on every worker node (as root)
        # Safe to re-run: yes (idempotent)

        set -euo pipefail

        AZURE_JSON="/etc/kubernetes/azure.json"

        echo "=== CIS AKS 3.1.4: Fix azure.json ownership on this node ==="

        # 1. Check if file exists
        if [ ! -e "$AZURE_JSON" ]; then
          echo "azure.json not found at $AZURE_JSON – nothing to change on this node."
          exit 0
        fi

        # 2. Show current ownership
        current_owner_group="$(stat -c '%U:%G' "$AZURE_JSON")"
        echo "Current ownership of $AZURE_JSON: $current_owner_group"

        # 3. Apply fix (idempotent: chown to root:root even if already correct)
        echo "Setting ownership of $AZURE_JSON to root:root ..."
        chown root:root "$AZURE_JSON"

        # 4. Verify result
        new_owner_group="$(stat -c '%U:%G' "$AZURE_JSON")"
        echo "New ownership of $AZURE_JSON: $new_owner_group"

        if [ "$new_owner_group" != "root:root" ]; then
          echo "ERROR: Failed to set ownership of $AZURE_JSON to root:root" >&2
          exit 1
        fi

        echo "SUCCESS: $AZURE_JSON ownership is correctly set to root:root on this node."
        exit 0
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>