Azure Json File Permissions Set To 644 Or More Restrictive

More Info:

The azure.json file holds cloud provider credentials and should have permissions of 644 or more restrictive to limit access.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS AKS

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, confirm the azure.json file exists and note its current permissions:

   sudo stat -c 'File=%n Permissions=%a Owner=%U Group=%G' /etc/kubernetes/azure.json
   

2. On every worker node, set the file permissions to 644 (or more restrictive if desired, e.g., 640 or 600):

   sudo chmod 644 /etc/kubernetes/azure.json
   

3. (Optional but recommended) On every worker node, ensure ownership is appropriate (typically root:root):

   sudo chown root:root /etc/kubernetes/azure.json
   

4. On every worker node, verify the permissions are now 644 or more restrictive:

   sudo stat -c 'File=%n Permissions=%a Owner=%U Group=%G' /etc/kubernetes/azure.json
   

Using kubectl

kubectl cannot be used to modify file permissions on worker node files like /etc/kubernetes/azure.json; this must be fixed directly on each worker node’s host OS. Refer to the Manual Steps section for the exact commands to run on the nodes.

Automation

#!/usr/bin/env bash
#
# Fix CIS AKS 3.1.3: Ensure /etc/kubernetes/azure.json has permissions 644 or more restrictive
# Scope: run on every worker node
#
# Idempotent: safe to re-run; only adjusts permissions if needed.

set -euo pipefail

AZURE_JSON="/etc/kubernetes/azure.json"

echo "=== CIS AKS 3.1.3: Fixing permissions on ${AZURE_JSON} ==="

if [ ! -e "${AZURE_JSON}" ]; then
  echo "File not found: ${AZURE_JSON}"
  echo "Nothing to change on this node."
  exit 0
fi

# Show current permissions
current_perm="$(stat -c '%a' "${AZURE_JSON}")"
echo "Current permissions: ${current_perm}"

# If more permissive than 644, tighten to 644
# (e.g. 646, 664, 666, 700 are all “644 or more restrictive” already)
if [ "${current_perm}" -gt 644 ]; then
  echo "Permissions are more permissive than 644; tightening to 644..."
  chmod 644 "${AZURE_JSON}"
else
  echo "Permissions are already 644 or more restrictive; no change needed."
fi

# Verification (adapted from the audit concept, but for azure.json)
final_perm="$(stat -c 'permissions=%a' "${AZURE_JSON}")"
echo "Final permissions: ${final_perm}"

# Explicit compliance check
numeric_perm="${final_perm#permissions=}"
if [ "${numeric_perm}" -le 644 ]; then
  echo "Compliance PASSED: ${AZURE_JSON} permissions are ${numeric_perm} (<= 644)."
  exit 0
else
  echo "Compliance FAILED: ${AZURE_JSON} permissions are ${numeric_perm} (> 644)." >&2
  exit 1
fi

Usage:

• Copy this script to each worker node, for example /usr/local/sbin/fix-azure-json-perms.sh.
• On every worker node, run:
  sudo bash /usr/local/sbin/fix-azure-json-perms.sh