For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-vni.md. A documentation index is available at /llms.txt.

An EKS Cluster's kubelet configuration file should have permissions set to 644 or more restrictive

eks

Description

EKS worker node kubelet configuration files referenced with the --config argument should have permissions set to 644 or more restrictive. Restricting the file permissions maintains the integrity of the configuration file and ensures it is writable only by system administrators.

Remediation

Using the configuration file location identified during the audit (commonly /etc/kubernetes/kubelet/config.json on EKS), run the following command on each node to restrict the kubelet configuration file’s permissions. See the Amazon EKS security best practices documentation for more details.

chmod 644 /etc/kubernetes/kubelet/config.json

References