MEDIUM OCP (Platform) M12: Audit Profile P3
Verified on cnfdt16 OCP 4.22. Audit profile set to WriteRequestBodies.
Overview
This remediation configures the OpenShift API server audit logging to capture request and response bodies, providing enhanced visibility into cluster operations.
Settings
| Setting | Value | Description |
|---|---|---|
audit.profile |
WriteRequestBodies |
Enhanced audit logging with request bodies |
Implementation
Modify the APIServer custom resource:
apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
name: cluster
spec:
audit:
profile: WriteRequestBodies
Apply with:
oc patch apiserver cluster --type merge -p '{"spec":{"audit":{"profile":"WriteRequestBodies"}}}'
Audit Profile Options
| Profile | Description |
|---|---|
Default |
Log metadata for all requests |
WriteRequestBodies |
Log metadata and request bodies for write operations |
AllRequestBodies |
Log metadata and request bodies for all operations |
None |
Disable API audit logging (not recommended) |
Compliance Checks Remediated
| Check | Profile | Docs |
|---|---|---|
ocp4-cis-audit-profile-set |
CIS | 📖 |
Source Remediation Files
- medium/ocp4-cis-audit-profile-set.yaml
Verification
Check current audit profile:
oc get apiserver cluster -o jsonpath='{.spec.audit.profile}'
# Expected: WriteRequestBodies
Security Impact
Enhanced audit logging provides:
- Full request body capture for forensic analysis
- Visibility into what was created/modified
- Compliance evidence for security audits
- Incident response capability
Note: WriteRequestBodies increases log volume. Ensure adequate log storage capacity.