PSRule.Rules.Azure
PSRule.Rules.Azure copied to clipboard
Improve guidance of logging kube-audit or kube-audit-admin
Existing rule
Azure.AKS.AuditLogs
Suggested rule
Update the guidance. Both kube-audit or kube-audit-admin should not be enabled. Update the docs to reflect that:
- Either log can be enabled.
- Enabling logging for both would increase cost and duplicate some log data.
Pillar
Security
Additional context
- https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.AuditLogs/
- https://learn.microsoft.com/azure/aks/monitor-aks-reference#resource-logs