Back to Checks
kubernetes

API server pod has --audit-log-path set

apiserver_audit_log_path_set
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:Pod

Kubernetes API server uses an audit log path configured via --audit-log-path on its containers to persist API request events

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without a configured audit log path, API requests may not be recorded, weakening accountability. Gaps in logs hinder detection of unauthorized changes (integrity) and data access (confidentiality), and impede forensics and incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_audit_log_path_set

Recommendation

Enable and harden audit logging by setting --audit-log-path. If centralizing, use a webhook backend. Define a focused audit policy, enforce least privilege to logs, rotate/retain them, forward to centralized monitoring, and regularly review events for defense in depth.

Remediation

Other

1SSH to the control plane node
2Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3Under the kube-apiserver container command args, add this line:
4```
5- --audit-log-path=/var/log/apiserver/audit.log
6```
7Save the file; the kubelet will automatically restart the API server

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_audit_log_path_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Audit log path is set in the API server in pod {pod.name}."
            )
            audit_log_path_set = False
            for container in pod.containers.values():
                audit_log_path_set = False
                # Check if "--audit-log-path" is set
                if "--audit-log-path" in str(container.command):
                    audit_log_path_set = True
                if not audit_log_path_set:
                    break

            if not audit_log_path_set:
                report.status = "FAIL"
                report.status_extended = f"Audit log path is not set in pod {pod.name}."

            findings.append(report)
        return findings

References