documentation_complete: true


title: 'Ensure that the ClusterLogging and ClusterLoggingForwarder resources are protected from unauthorized modification'

description: |-
    The ClusterLogging and ClusterLoggingForwarder Custom Resources provide 
    a way to configure the logging forwarding subsystem and modification access to it
    should be restricted to as-needed basis.

    {{{ fix_openshift_logging_rbac("edit") | indent(4) }}}}

rationale: |-
    Protecting audit data also includes identifying and protecting the tools used to view and
    manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized
    operation on audit data.

severity: medium

identifiers:
  cce@ocp4: CCE-90717-0


references:
    nist: AU-9
    srg: SRG-APP-000122-CTR-000260

ocil_clause: 'modification access to ClusterLogging and ClusterLoggingForwarder resources needs review'

ocil: |-
    {{{ ocil_cluster_logging_rbac_review("edit") | indent(4) }}}
