Back to Checks
kubernetes

API server pod has --audit-log-maxage set to 30 (or the cluster-configured value)

apiserver_audit_log_maxage_set
Service: apiserverSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:Pod

Kubernetes API server audit logging retention is governed by --audit-log-maxage. This evaluates whether the configured value (e.g., 30 days) is set consistently across API server containers to retain audit events for a sufficient period.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Short audit retention limits visibility into historical API actions. Credential abuse, privilege escalation, or cluster tampering may evade detection, and investigations lack evidence for timeline reconstruction-degrading data integrity and confidentiality through undetected unauthorized changes and exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_audit_log_maxage_set

Recommendation

Set --audit-log-maxage to at least 30 days (or your policy) to support forensics. Align rotation with --audit-log-maxbackup and --audit-log-maxsize. Forward logs to a tamper-resistant central store, enforce least privilege on access, and periodically validate retention coverage.

Remediation

Other

1SSH to a control plane node
2Edit the API server static pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
3Under spec.containers[0].command add:
4- --audit-log-maxage=30
5(Use your cluster-required value instead of 30 if different.)
6Save the file; the kubelet will restart the API server automatically

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_audit_log_maxage_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Audit log max age is set appropriately in the API server in pod {pod.name}."
            audit_log_maxage_set = False
            for container in pod.containers.values():
                audit_log_maxage_set = False
                # Check if "--audit-log-maxage" is set to 30 or as appropriate
                for command in container.command:
                    if command.startswith("--audit-log-maxage"):
                        if int(
                            command.split("=")[1]
                        ) == apiserver_client.audit_config.get("audit_log_maxage", 30):
                            audit_log_maxage_set = True
                            break
                if not audit_log_maxage_set:
                    break

            if not audit_log_maxage_set:
                report.status = "FAIL"
                report.status_extended = f"Audit log max age is not set to 30 or as appropriate in pod {pod.name}."

            findings.append(report)
        return findings

References