Azure Kubernetes Service (AKS) Benchmark

Apply Security Context to Your Pods and Containers
Profile Applicability: Level 2 Description:  A security context in Kubernetes defines privilege and access control settings for a Pod or Container. Ap...
Fri, 9 May, 2025 at 2:29 AM
The default namespace should not be used
Profile Applicability: Level 2 Description:  Kubernetes creates a default namespace for all resources that are not explicitly assigned to a namespace....
Fri, 9 May, 2025 at 2:32 AM
Ensure Image Vulnerability Scanning using Microsoft Defender for Cloud (MDC) image scanning or a third-party provider
Profile Applicability: Level 1 Description:  Container images must be scanned for vulnerabilities to identify and mitigate potential security risks be...
Fri, 9 May, 2025 at 2:37 AM
Minimize user access to Azure Container Registry
Profile Applicability: Level 1 Description:  Azure Container Registry (ACR) provides a private registry for storing and managing Docker container imag...
Fri, 9 May, 2025 at 2:42 AM
Minimize cluster access to read-only for Azure Container Registry (ACR)
Profile Applicability: Level 1 Description:  Limiting access to Azure Container Registry (ACR) to read-only ensures that workloads in your cluster can...
Fri, 9 May, 2025 at 2:46 AM
Minimize Container Registries to only those approved
Profile Applicability: Level 2 Description:  In a Kubernetes environment, containers should be pulled only from trusted and approved container registr...
Fri, 9 May, 2025 at 2:51 AM
Prefer using dedicated AKS Service Accounts
Profile Applicability: Level 1 Description:  In Azure Kubernetes Service (AKS), service accounts are used to grant access to Kubernetes resources for ...
Fri, 9 May, 2025 at 2:55 AM
Ensure Kubernetes Secrets are encrypted
Profile Applicability: Level 1 Description:  Kubernetes allows you to store sensitive data such as passwords, API keys, and certificates in Secrets ob...
Fri, 9 May, 2025 at 2:59 AM
Restrict Access to the Control Plane Endpoint
Profile Applicability: Level 1 Description:  The Kubernetes control plane is responsible for managing the cluster, including scheduling and controllin...
Fri, 9 May, 2025 at 3:05 AM
Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled
Profile Applicability: Level 2 Description:  When creating an Azure Kubernetes Service (AKS) cluster, enabling the Private Endpoint and disabling Publ...
Fri, 9 May, 2025 at 3:13 AM