# Ensure that the --authorization-mode argument is not set to AlwaysAllow

- Source: https://support.icompaas.com/support/solutions/articles/62000234581-ensure-that-the-authorization-mode-argument-is-not-set-to-alwaysallow
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Azure Kubernetes Service (AKS) Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112691) › [Azure Kubernetes Service (AKS) Benchmark](https://support.icompaas.com/support/solutions/folders/62000169257)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability****:**

-   **Level 1**  
    

**Description:** The --authorization-mode flag in Kubernetes controls the authorization strategy used to determine whether a user or service has permission to perform a specific action. The AlwaysAllow mode allows all requests without any authorization checks, which is a significant security risk. This check ensures that AlwaysAllow is not enabled, thereby enforcing proper authorization checks.

**Rationale:  
** Enabling the AlwaysAllow authorization mode effectively disables authorization checks, allowing any user to perform actions on the cluster. This creates a major security vulnerability and should be avoided. Ensuring that proper authorization mechanisms like RBAC (Role-Based Access Control) are in place improves cluster security.

**Impact:**

-   **Pros:**  
    
    -   Ensures proper authorization checks are enforced for all API requests.  
        
    -   Helps maintain secure access control within the Kubernetes cluster.  
        
-   **Cons:**  
    
    -   May require changes to existing configuration if AlwaysAllow is enabled.  
        

**Default Value:** The default authorization mode may vary, but AlwaysAllow should be disabled in a secure Kubernetes environment.

**Pre-requisites:** Ensure that proper authorization mechanisms (e.g., RBAC) are configured and functioning in the Kubernetes cluster.

### **Remediation**

### **Test Plan:**

**Using Azure Console:**

1.  Navigate to the Kubernetes cluster configuration settings.  
    
2.  Review the kube-apiserver configuration to check if the \--authorization-mode flag is set to AlwaysAllow.  
    

**Using Azure CLI:**

1.  Use the following command to check the current authorization mode:  
    
     ps aux | grep kube-apiserver
    
2.  Ensure that the \--authorization-mode does not include AlwaysAllow.
    

### **Implementation Plan:**

**Using Azure Console:**

1.  Access the kube-apiserver configuration.
    
2.  Modify the \--authorization-mode argument to remove AlwaysAllow and ensure secure authorization modes like RBAC are enabled.
    

**Using Azure CLI:**

1.  Update the \--authorization-mode flag by modifying the kube-apiserver configuration:
    
     kubectl -n kube-system edit deployment kube-apiserver
    
2.  Remove AlwaysAllow and ensure appropriate authorization modes like RBAC are enabled.
    

### **Backout Plan:**

**Using Azure Console:**

1.  If the change causes issues, revert the \--authorization-mode setting to include AlwaysAllow temporarily.
    

**Using Azure CLI:**

1.  Revert the setting to allow AlwaysAllow by running the following command:
    
     kubectl -n kube-system edit deployment kube-apiserver
    
2.  Add AlwaysAllow back to the \--authorization-mode flag if necessary.
    

**References:**

1.  [Kubernetes Authorization Modes Documentation](https://kubernetes.io/docs/reference/access-authn-authz/authorization/)
    
2.  [Kubernetes Security Best Practices](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.