Azure AKS cluster configured with overly permissive API server access misconfiguration detected in c

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_6
Category - Subcategory	Kubernetes - Access Control
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	8d05a24e-e700-41b2-8d9d-56af90e1dcdf

Impact

The AKS API server receives requests to perform actions in the cluster , for example, to create resources, and scale the number of nodes. The API server provides a secure way to manage a cluster. To enhance cluster security and minimize attacks, the API server should only be accessible from a limited set of IP address ranges. These IP ranges allow defined IP address ranges to communicate with the API server. A request made to the API server from an IP address that is not part of these authorized IP ranges is blocked.

How to Fix

Resource: Microsoft.ContainerService/managedClusters

• Arguments: apiServerAuthorizedIPRanges [source,go]

---

{ "name": "string", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2019-06-01", "location": "string", "tags": {}, "properties": { "kubernetesVersion": "string", "dnsPrefix": "string", "agentPoolProfiles": [ { "count": "integer", "vmSize": "string", "osDiskSizeGB": "integer", "vnetSubnetID": "string", "maxPods": "integer", "osType": "string", "maxCount": "integer", "minCount": "integer", "enableAutoScaling": "boolean", "type": "string", "orchestratorVersion": "string", "availabilityZones": [ "string" ], "enableNodePublicIP": "boolean", "scaleSetPriority": "string", "scaleSetEvictionPolicy": "string", "nodeTaints": [ "string" ], "name": "string" } ], "linuxProfile": { "adminUsername": "string", "ssh": { "publicKeys": [ { "keyData": "string" } ] } }, "windowsProfile": { "adminUsername": "string", "adminPassword": "string" }, "servicePrincipalProfile": { "clientId": "string", "secret": "string" }, "addonProfiles": {}, "nodeResourceGroup": "string", "enableRBAC": "boolean", "enablePodSecurityPolicy": "boolean", "networkProfile": { "networkPlugin": "string", "networkPolicy": "string", "podCidr": "string", "serviceCidr": "string", "dnsServiceIP": "string", "dockerBridgeCidr": "string", "loadBalancerSku": "string" }, "aadProfile": { "clientAppID": "string", "serverAppID": "string", "serverAppSecret": "string", "tenantID": "string" },

• "apiServerAuthorizedIPRanges": [ "string" ] }, "identity": { "type": "string" }, "resources": [] }

---