STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

DISA Rule

SV-274111r1210984_rule

Vulnerability Number

V-274111

Group Title

SRG-OS-000063-GPOS-00032

Rule Version

AZLX-23-002240

Severity

CAT II

CCI(s)

CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.

Weight

Fix Recommendation

Configure Amazon Linux 2023 so that files in "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file have a mode of "0600" or less permissive with the following commands:

$ sudo chmod 0600 /etc/audit/rules.d/audit.rules
$ sudo chmod 0600 /etc/audit/rules.d/[customrulesfile].rules
$ sudo chmod 0600 /etc/audit/auditd.conf

Check Contents

Verify Amazon Linux 2023 is configured so that files in "/etc/audit/rules.d/" and the "/etc/audit/auditd.conf" file have a mode of "0600" or less permissive by using the following commands:

$ sudo find /etc/audit/rules.d/ /etc/audit/audit.rules /etc/audit/auditd.conf -type f -exec stat -c "%a %n" {} \;
600 /etc/audit/rules.d/audit.rules
600 /etc/audit/audit.rules
600 /etc/audit/auditd.conf

If the files in the "/etc/audit/rules.d/" directory or the "/etc/audit/auditd.conf" file have a mode more permissive than "0600", this is a finding.

Vulnerability Number

V-274111

Documentable

False

Rule Version

AZLX-23-002240

Severity Override Guidance

Check Content Reference

Target Key

5700