feat(audit): add AWS encryption provider audit rules and update encryption provider script

2025-05-12 17:24:58 +02:00
parent 05d1624bdd
commit 4cd933f9f8
4 changed files with 12 additions and 1 deletions
@@ -10,6 +10,6 @@ auditd_mode: 1
 auditd_num_logs: 5
 auditd_space_left: 75
 auditd_space_left_action: email
+auditd_encryption_kms_socket:
 grub_audit_backlog_cmdline: audit_backlog_limit=8192
 grub_audit_cmdline: audit=1
-...
@@ -150,6 +150,11 @@
 -w /usr/sbin/runc -p rwxa -k docker
 -w /var/run/docker.sock -p rwxa -k docker

+{% if auditd_encryption_kms_socket is defined %}
+# AWS encryption provider
+-w {{ auditd_encryption_kms_socket | dirname }} -p rwxa -k aws-encryption-provider
+{% endif %}
+
 # Group modifications
 -w /etc/group -p wa -k group-modification
 -w /etc/gshadow -p wa -k group-modification