# Ensure Audit Log Directory Has Permissions Set to 0750 or More Restrictive

- Source: https://support.icompaas.com/support/solutions/articles/62000234996-ensure-audit-log-directory-has-permissions-set-to-0750-or-more-restrictive
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Linux 2 Benchmark v3.0.0](https://support.icompaas.com/support/solutions/62000112696) › [CIS Amazon Linux 2 Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169265)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: • Level 2

Description:  
The audit log directory stores security and system audit logs. Setting its permissions to 0750 or more restrictive limits access to the directory owner and group, preventing unauthorized users from accessing or modifying audit logs.

Rationale:  
 Restricting permissions on the audit log directory protects the confidentiality and integrity of audit data, reducing risks of tampering or unauthorized disclosure.

Impact:  
 Pros:

-   Limits access to audit logs to authorized users.  
    
-   Maintains security and trustworthiness of audit records.  
    

Cons:

-   Overly restrictive permissions might interfere with legitimate audit processes.  
    

Default Value:  
 Permissions on the audit log directory may vary; verification and adjustment may be necessary.

Pre-requisites:

-   Root or sudo privileges to audit and modify directory permissions.  
    

Remediation:

### Test Plan:

Using Linux command line:

Check permissions of the audit log directory:

ls -ld /var/log/audit

1.  Verify permissions are set to 0750 or more restrictive.
    

### Implementation Plan:

Using Linux command line:

Set permissions to 0750 or more restrictive:

chmod 750 /var/log/audit

Verify changes:

ls -ld /var/log/audit

### Backout Plan:

Using Linux command line:

1.  Restore previous permissions from backups if necessary.  
    
2.  Verify audit processes continue to function properly.  
    

References:

-   CIS Amazon Linux 2 Benchmark v3.0.0  
    
-   [NIST SP 800-53 Revision 5 - AU-9  
    ](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final#au-9)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.