> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Json File Permissions Set To 644 Or More Restrictive

### More Info:

The azure.json file holds cloud provider credentials and should have permissions of 644 or more restrictive to limit access.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS AKS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, confirm the azure.json file exists and note its current permissions:
           ```bash theme={null}
           sudo stat -c 'File=%n Permissions=%a Owner=%U Group=%G' /etc/kubernetes/azure.json
           ```

        2. On every worker node, set the file permissions to 644 (or more restrictive if desired, e.g., 640 or 600):
           ```bash theme={null}
           sudo chmod 644 /etc/kubernetes/azure.json
           ```

        3. (Optional but recommended) On every worker node, ensure ownership is appropriate (typically root:root):
           ```bash theme={null}
           sudo chown root:root /etc/kubernetes/azure.json
           ```

        4. On every worker node, verify the permissions are now 644 or more restrictive:
           ```bash theme={null}
           sudo stat -c 'File=%n Permissions=%a Owner=%U Group=%G' /etc/kubernetes/azure.json
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot be used to modify file permissions on worker node files like `/etc/kubernetes/azure.json`; this must be fixed directly on each worker node’s host OS. Refer to the Manual Steps section for the exact commands to run on the nodes.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CIS AKS 3.1.3: Ensure /etc/kubernetes/azure.json has permissions 644 or more restrictive
        # Scope: run on every worker node
        #
        # Idempotent: safe to re-run; only adjusts permissions if needed.

        set -euo pipefail

        AZURE_JSON="/etc/kubernetes/azure.json"

        echo "=== CIS AKS 3.1.3: Fixing permissions on ${AZURE_JSON} ==="

        if [ ! -e "${AZURE_JSON}" ]; then
          echo "File not found: ${AZURE_JSON}"
          echo "Nothing to change on this node."
          exit 0
        fi

        # Show current permissions
        current_perm="$(stat -c '%a' "${AZURE_JSON}")"
        echo "Current permissions: ${current_perm}"

        # If more permissive than 644, tighten to 644
        # (e.g. 646, 664, 666, 700 are all “644 or more restrictive” already)
        if [ "${current_perm}" -gt 644 ]; then
          echo "Permissions are more permissive than 644; tightening to 644..."
          chmod 644 "${AZURE_JSON}"
        else
          echo "Permissions are already 644 or more restrictive; no change needed."
        fi

        # Verification (adapted from the audit concept, but for azure.json)
        final_perm="$(stat -c 'permissions=%a' "${AZURE_JSON}")"
        echo "Final permissions: ${final_perm}"

        # Explicit compliance check
        numeric_perm="${final_perm#permissions=}"
        if [ "${numeric_perm}" -le 644 ]; then
          echo "Compliance PASSED: ${AZURE_JSON} permissions are ${numeric_perm} (<= 644)."
          exit 0
        else
          echo "Compliance FAILED: ${AZURE_JSON} permissions are ${numeric_perm} (> 644)." >&2
          exit 1
        fi
        ```

        Usage:

        * Copy this script to each worker node, for example `/usr/local/sbin/fix-azure-json-perms.sh`.
        * On **every worker node**, run:
          ```bash theme={null}
          sudo bash /usr/local/sbin/fix-azure-json-perms.sh
          ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>