diff --git a/cloudinit/settings.py b/cloudinit/settings.py
index 3a04a58..439eee0 100644
--- a/cloudinit/settings.py
+++ b/cloudinit/settings.py
@@ -45,6 +45,7 @@ CFG_BUILTIN = {
         'None',
     ],
     'def_log_file': '/var/log/cloud-init.log',
+    'def_log_file_mode': 0o600,
     'log_cfgs': [],
     'mount_default_fields': [None, None, 'auto', 'defaults,nofail', '0', '2'],
     'ssh_deletekeys': False,
diff --git a/cloudinit/stages.py b/cloudinit/stages.py
index 71f3a49..68b83af 100644
--- a/cloudinit/stages.py
+++ b/cloudinit/stages.py
@@ -149,8 +149,9 @@ class Init(object):
     def _initialize_filesystem(self):
         util.ensure_dirs(self._initial_subdirs())
         log_file = util.get_cfg_option_str(self.cfg, 'def_log_file')
+        log_file_mode = util.get_cfg_option_int(self.cfg, 'def_log_file_mode')
         if log_file:
-            util.ensure_file(log_file)
+            util.ensure_file(log_file, mode=log_file_mode)
             perms = self.cfg.get('syslog_fix_perms')
             if not perms:
                 perms = {}
diff --git a/doc/examples/cloud-config.txt b/doc/examples/cloud-config.txt
index eb84dcf..0e82b83 100644
--- a/doc/examples/cloud-config.txt
+++ b/doc/examples/cloud-config.txt
@@ -413,10 +413,14 @@ timezone: US/Eastern
 # if syslog_fix_perms is a list, it will iterate through and use the
 # first pair that does not raise error.
 #
+# 'def_log_file' will be created with mode 'def_log_file_mode', which
+# is specified as a numeric value and defaults to 0600.
+#
 # the default values are '/var/log/cloud-init.log' and 'syslog:adm'
 # the value of 'def_log_file' should match what is configured in logging
 # if either is empty, then no change of ownership will be done
 def_log_file: /var/log/my-logging-file.log
+def_log_file_mode: 0600
 syslog_fix_perms: syslog:root
 
 # you can set passwords for a user or multiple users