# Ensure that the azure.json file has permissions set to 644 or more restrictive

- Source: https://support.icompaas.com/support/solutions/articles/62000234576-ensure-that-the-azure-json-file-has-permissions-set-to-644-or-more-restrictive
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Azure Kubernetes Service (AKS) Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112691) › [Azure Kubernetes Service (AKS) Benchmark](https://support.icompaas.com/support/solutions/folders/62000169257)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability****:**

-   **Level 1**  
    

**Description:** The azure.json file contains configuration details for accessing and managing Azure resources from a Kubernetes cluster. It is essential to set the correct file permissions to prevent unauthorized access to sensitive information, such as credentials and configuration settings.

**Rationale:** Setting file permissions to 644 or more restrictive ensures that only authorized users can read or modify the azure.json file. This is a security best practice to prevent unauthorized access to the Azure configuration and protect sensitive credentials.

**Impact:**

-   **Pros:**  
    
    -   Prevents unauthorized access to the Azure configuration file.  
        
    -   Enhances security by restricting access to sensitive configuration data.  
        
-   **Cons:**  
    
    -   Requires additional access control management to ensure authorized users can still read and update the file when necessary.  
        

**Default Value:** The default permissions for azure.json can vary, but the file should be configured with restrictive permissions by default for security purposes.

**Pre-requisites:** Ensure that the azure.json file exists and is accessible, and that you have the necessary permissions to modify its file attributes.

### **Remediation**

### **Test Plan:**

**Using Azure Console:**

1.  Use the system’s file management interface to navigate to the azure.json file.  
    
2.  Verify the file permissions to ensure they are set to 644 or more restrictive.  
    

**Using Azure CLI:**

1.  Use the following command to check the permissions of the azure.json file:  
    
    ls -l /etc/kubernetes/azure.json
    
2.  Ensure that the file permissions are set to 644 or more restrictive.
    

### **Implementation Plan:**

**Using Azure Console:**

1.  Navigate to the location of the azure.json file.
    
2.  Modify the file permissions to 644 or more restrictive using the file management interface.
    

**Using Azure CLI:**

1.  Update the file permissions for the azure.json file:
    
     chmod 644 /etc/kubernetes/azure.json
    

### **Backout Plan:**

**Using Azure Console:**

1.  If modifying the file permissions causes issues, revert to the original permissions using the file management interface.  
    

**Using Azure CLI:**

1.  Revert the permissions to the previous state using the following command:  
    
     chmod <previous-permissions> /etc/kubernetes/azure.json
    

**References:**

1.  [Kubernetes Documentation on Azure Config](https://learn.microsoft.com/en-us/azure/azure-app-configuration/quickstart-azure-kubernetes-service?tabs=extension)  
    
2.  [Linux File Permissions Guide](https://www.geeksforgeeks.org/set-file-permissions-linux/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.