Back to Checks
alibabacloud

Kubernetes cluster has Log Service enabled

cs_kubernetes_log_service_enabled
Service: csSeverity: high
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:ALIYUN::CS::ManagedKubernetesCluster

Alibaba Cloud Log Service supports collection, search, storage, and analysis for container and audit logs in Kubernetes Engine clusters. When enabled, it automatically collects kube-apiserver audit logs, ingress logs, and stdout/stderr from containers. These logs are stored persistently and are essential for operational visibility, security monitoring, and compliance auditing.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without Log Service, there is no centralized collection of container logs or cluster events, impairing incident investigation, compliance auditing, and security monitoring. Attackers could operate undetected with no audit trail of API server calls or pod events, impacting cluster confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks cs_kubernetes_log_service_enabled

Recommendation

Enable Log Service during cluster creation by setting Enable Log Service to Enabled. For existing clusters, verify that AuditProjectName is configured in the cluster metadata.

Remediation

CLI

aliyun cs GET /clusters/<cluster_id> --header 'Content-Type=application/json' | jq '.meta_data' | jq -r 'fromjson | .AuditProjectName'

Other

1Log on to the **ACK Console**.
2Select the target cluster and click its name to open the cluster detail page.
3Select **Cluster Auditing** on the left column and check if the audit page is shown.
4To enable: When creating a new cluster, set `Enable Log Service` to **Enabled**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.cs.cs_client import cs_client


class cs_kubernetes_log_service_enabled(Check):
    """Check if Log Service is enabled on Kubernetes Engine Clusters."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for cluster in cs_client.clusters:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=cluster)
            report.region = cluster.region
            report.resource_id = cluster.id
            report.resource_arn = f"acs:cs:{cluster.region}:{cs_client.audited_account}:cluster/{cluster.id}"

            if cluster.log_service_enabled:
                report.status = "PASS"
                report.status_extended = f"Kubernetes cluster {cluster.name} has Log Service enabled with project: {cluster.audit_project_name}."
            else:
                report.status = "FAIL"
                report.status_extended = f"Kubernetes cluster {cluster.name} does not have Log Service enabled."

            findings.append(report)

        return findings

References