CIS Azure Kubernetes Service (AKS) Benchmark

This recommendation verifies that Kubernetes Version Is Current and Supported on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Kubernetes Version Is Current and Supported:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Kubernetes Version Is Current and Supported:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Automatic Upgrades Are Configured on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Automatic Upgrades Are Configured:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Automatic Upgrades Are Configured:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that API Server Authorized IP Ranges Are Configured on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that API Server Authorized IP Ranges Are Configured:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure API Server Authorized IP Ranges Are Configured:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Private Cluster Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Private Cluster Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Private Cluster Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure Policy Add-On Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure Policy Add-On Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure Policy Add-On Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that System and User Node Pools Are Separated on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that System and User Node Pools Are Separated:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure System and User Node Pools Are Separated:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Node Pool OS Disk Encryption Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Node Pool OS Disk Encryption Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Node Pool OS Disk Encryption Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Ephemeral OS Disks Are Used Where Possible on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Ephemeral OS Disks Are Used Where Possible:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Ephemeral OS Disks Are Used Where Possible:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Node Pool Auto-Scaling Is Configured on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Node Pool Auto-Scaling Is Configured:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Node Pool Auto-Scaling Is Configured:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure AD Integration Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure AD Integration Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure AD Integration Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure AD RBAC Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure AD RBAC Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure AD RBAC Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Local Accounts Are Disabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Local Accounts Are Disabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Local Accounts Are Disabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Managed Identity Is Used for Cluster on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Managed Identity Is Used for Cluster:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Managed Identity Is Used for Cluster:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Kubernetes RBAC Is Properly Configured on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Kubernetes RBAC Is Properly Configured:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Kubernetes RBAC Is Properly Configured:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Cluster Admin Role Is Minimized on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Cluster Admin Role Is Minimized:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Cluster Admin Role Is Minimized:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure RBAC for Kubernetes Is Used on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure RBAC for Kubernetes Is Used:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure RBAC for Kubernetes Is Used:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Workload Identity Is Used for Pod Access on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Workload Identity Is Used for Pod Access:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Workload Identity Is Used for Pod Access:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure CNI Networking Is Used on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure CNI Networking Is Used:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure CNI Networking Is Used:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Network Policies Are Configured on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Network Policies Are Configured:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Network Policies Are Configured:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that HTTP Application Routing Is Disabled on the Azure Kubernetes Service managed Kubernetes service. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Azure Kubernetes Service managed Kubernetes service increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Use the Azure CLI or Azure Portal and verify that HTTP Application Routing Is Disabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure HTTP Application Routing Is Disabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation ensures that Authorized IP Ranges Include Only Required IPs on the Azure Kubernetes Service managed Kubernetes service. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Azure Kubernetes Service managed Kubernetes service may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

Use the Azure CLI or Azure Portal and verify that Authorized IP Ranges Include Only Required IPs:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Authorized IP Ranges Include Only Required IPs:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Ingress Controller Uses TLS on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Ingress Controller Uses TLS:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Ingress Controller Uses TLS:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Internal Load Balancer Is Used for Internal Services on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Internal Load Balancer Is Used for Internal Services:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Internal Load Balancer Is Used for Internal Services:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Web Application Firewall Is Enabled for Ingress on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Web Application Firewall Is Enabled for Ingress:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Web Application Firewall Is Enabled for Ingress:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation ensures that Pod Security Standards Are Enforced on the Azure Kubernetes Service managed Kubernetes service. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Azure Kubernetes Service managed Kubernetes service may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

Use the Azure CLI or Azure Portal and verify that Pod Security Standards Are Enforced:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Pod Security Standards Are Enforced:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Containers Run as Non-Root on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Containers Run as Non-Root:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Containers Run as Non-Root:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Read-Only Root Filesystem Is Used on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Read-Only Root Filesystem Is Used:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Read-Only Root Filesystem Is Used:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Privileged Containers Are Not Used on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Privileged Containers Are Not Used:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Privileged Containers Are Not Used:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Host Namespaces Are Not Shared on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Host Namespaces Are Not Shared:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Host Namespaces Are Not Shared:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure Container Registry Is Used on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure Container Registry Is Used:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure Container Registry Is Used:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Image Vulnerability Scanning Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Image Vulnerability Scanning Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Image Vulnerability Scanning Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Only Approved Images Are Deployed on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Only Approved Images Are Deployed:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Only Approved Images Are Deployed:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure Key Vault Provider for Secrets Store CSI Is Used on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure Key Vault Provider for Secrets Store CSI Is Used:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure Key Vault Provider for Secrets Store CSI Is Used:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Kubernetes Secrets Are Encrypted at Rest on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Kubernetes Secrets Are Encrypted at Rest:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Kubernetes Secrets Are Encrypted at Rest:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Secrets Are Not Stored in Environment Variables on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Secrets Are Not Stored in Environment Variables:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Secrets Are Not Stored in Environment Variables:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Persistent Volume Encryption Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Persistent Volume Encryption Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Persistent Volume Encryption Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Storage Classes Use Encryption on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Storage Classes Use Encryption:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Storage Classes Use Encryption:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure Disk Encryption Is Enabled for Node OS Disks on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure Disk Encryption Is Enabled for Node OS Disks:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure Disk Encryption Is Enabled for Node OS Disks:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure Monitor Container Insights Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure Monitor Container Insights Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure Monitor Container Insights Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Diagnostic Settings Are Configured for AKS on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Diagnostic Settings Are Configured for AKS:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Diagnostic Settings Are Configured for AKS:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Kubernetes Audit Logging Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Kubernetes Audit Logging Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Kubernetes Audit Logging Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Azure Defender for Containers Is Enabled on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Azure Defender for Containers Is Enabled:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Azure Defender for Containers Is Enabled:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Cluster Health Alerts Are Configured on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Cluster Health Alerts Are Configured:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Cluster Health Alerts Are Configured:

az aks update --resource-group <rg> --name <cluster> --set ...

This recommendation verifies that Resource Quota Monitoring Is Configured on the Azure Kubernetes Service managed Kubernetes service. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Azure Kubernetes Service managed Kubernetes service vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Use the Azure CLI or Azure Portal and verify that Resource Quota Monitoring Is Configured:

az aks show --resource-group <rg> --name <cluster> --query '...'

Use the Azure CLI to configure Resource Quota Monitoring Is Configured:

az aks update --resource-group <rg> --name <cluster> --set ...