Back to Checks
kubernetes

API server pod has --audit-log-maxbackup set to 10 or the configured value

apiserver_audit_log_maxbackup_set
Service: apiserverSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:Pod

Kubernetes API server audit logging uses --audit-log-maxbackup to set how many rotated audit log files are kept. This evaluates whether that value is explicitly configured as 10 or an approved organizational setting across API server containers.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Insufficient audit log retention reduces accountability and hampers forensics. Limited backups cause older events to be overwritten, letting attackers hide activity until rotation. This undermines the confidentiality, integrity, and availability of evidence needed for incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_audit_log_maxbackup_set

Recommendation

Establish explicit audit log retention. Set --audit-log-maxbackup to 10 or higher based on data sensitivity, and align with --audit-log-maxsize and --audit-log-maxage. Forward logs to centralized, immutable storage, restrict access, and monitor rotation. Apply defense in depth and least privilege to audit systems.

Remediation

Other

1SSH to each control plane node
2Edit the static Pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
3Under spec.containers[0].command, add or update this flag:
4- --audit-log-maxbackup=10
5Save the file; the kubelet will restart the API server automatically

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_audit_log_maxbackup_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Audit log max backup is set appropriately in the API server in pod {pod.name}."
            audit_log_maxbackup_set = False
            for container in pod.containers.values():
                audit_log_maxbackup_set = False
                # Check if "--audit-log-maxbackup" is set to 10 or as appropriate
                for command in container.command:
                    if command.startswith("--audit-log-maxbackup"):
                        if int(
                            command.split("=")[1]
                        ) == apiserver_client.audit_config.get(
                            "audit_log_maxbackup", 10
                        ):
                            audit_log_maxbackup_set = True
                            break
                if not audit_log_maxbackup_set:
                    break

            if not audit_log_maxbackup_set:
                report.status = "FAIL"
                report.status_extended = f"Audit log max backup is not set to 10 or as appropriate in pod {pod.name}."

            findings.append(report)
        return findings

References