STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 audit system must protect logon user identifiers (UIDs) from unauthorized change.

DISA Rule

SV-274187r1120715_rule

Vulnerability Number

V-274187

Group Title

SRG-OS-000462-GPOS-00206

Rule Version

AZLX-23-005000

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-000162 - Protect audit information from unauthorized access.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.

Weight

10

Fix Recommendation

Configure Amazon Linux 2023 auditing to prevent modification of login UIDs once they are set by adding the following line to /etc/audit/rules.d/audit.rules:

--loginuid-immutable

To load the rules to the kernel immediately, use the following command:

$ sudo augenrules --load

Check Contents

Verify Amazon Linux 2023 is configured so that the audit system prevents unauthorized changes to login UIDs with the following command:

$ sudo grep -i immutable /etc/audit/audit.rules
--loginuid-immutable

If the "--loginuid-immutable" option is not returned in the "/etc/audit/audit.rules", or the line is commented out, this is a finding.

Vulnerability Number

V-274187

Documentable

False

Rule Version

AZLX-23-005000

Severity Override Guidance

Verify Amazon Linux 2023 is configured so that the audit system prevents unauthorized changes to login UIDs with the following command:

$ sudo grep -i immutable /etc/audit/audit.rules
--loginuid-immutable

If the "--loginuid-immutable" option is not returned in the "/etc/audit/audit.rules", or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

5700