feat(audit): add AWS encryption provider audit rules and update encryption provider script

2025-05-12 17:24:58 +02:00
parent 05d1624bdd
commit 4cd933f9f8
4 changed files with 12 additions and 1 deletions
@@ -150,6 +150,11 @@
 -w /usr/sbin/runc -p rwxa -k docker
 -w /var/run/docker.sock -p rwxa -k docker

+{% if auditd_encryption_kms_socket is defined %}
+# AWS encryption provider
+-w {{ auditd_encryption_kms_socket | dirname }} -p rwxa -k aws-encryption-provider
+{% endif %}
+
 # Group modifications
 -w /etc/group -p wa -k group-modification
 -w /etc/gshadow -p wa -k group-modification