---
title: >-
  An EKS Cluster's kubelet configuration file ownership should be assigned to
  root
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > An EKS Cluster's kubelet configuration
  file ownership should be assigned to root
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# An EKS Cluster's kubelet configuration file ownership should be assigned to root
 
## Description{% #description %}

EKS worker nodes that reference a kubelet configuration file with the `--config` argument should set the file ownership to `root:root` to maintain its integrity. Identify the file location reported by `ps -efww | grep kubelet | grep -- '--config'` (commonly `/etc/kubernetes/kubelet/config.json`) and verify its ownership.

## Remediation{% #remediation %}

Using the config file location identified in the audit step, run the following command to set the kubelet configuration file ownership to root. See the [Amazon EKS security best practices](https://docs.aws.amazon.com/eks/latest/userguide/security.html) for more details.

```bash
chown root:root /etc/kubernetes/kubelet/config.json
```

## References{% #references %}

- [Amazon EKS security best practices](https://docs.aws.amazon.com/eks/latest/best-practices/security.html)
- [CIS Amazon EKS Benchmark](https://www.cisecurity.org/benchmark/kubernetes)