MEDIUM OCP (Platform) M12: Audit Profile P3
Overview
This remediation configures the OpenShift API server audit logging to capture request and response bodies, providing enhanced visibility into cluster operations.
Settings
| Setting | Value | Description |
|---|---|---|
audit.profile |
WriteRequestBodies |
Enhanced audit logging with request bodies |
Implementation
Modify the APIServer custom resource:
apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
name: cluster
spec:
audit:
profile: WriteRequestBodies
Apply with:
oc patch apiserver cluster --type merge -p '{"spec":{"audit":{"profile":"WriteRequestBodies"}}}'
Audit Profile Options
| Profile | Description |
|---|---|
Default |
Log metadata for all requests |
WriteRequestBodies |
Log metadata and request bodies for write operations |
AllRequestBodies |
Log metadata and request bodies for all operations |
None |
Disable API audit logging (not recommended) |
Compliance Checks Remediated
| Check | Profile | Docs |
|---|---|---|
ocp4-cis-audit-profile-set |
CIS | 📖 |
Source Remediation Files
- medium/ocp4-cis-audit-profile-set.yaml
Verification
Check current audit profile:
oc get apiserver cluster -o jsonpath='{.spec.audit.profile}'
# Expected: WriteRequestBodies
Security Impact
Enhanced audit logging provides:
- Full request body capture for forensic analysis
- Visibility into what was created/modified
- Compliance evidence for security audits
- Incident response capability
Note: WriteRequestBodies increases log volume. Ensure adequate log storage capacity.