Azure AKS cluster monitoring not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_4
Category - Subcategory	Kubernetes - Logging And Monitoring
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	455d48c0-5775-4a69-9844-083b33d68781

Impact

The Azure Monitoring service collects and stores valuable telemetry reported by AKS. This includes memory and processor metrics for controllers, nodes and containers logs, and logs from the individual containers. This data is accessible through Azure Log Analytics for the AKS cluster and Azure Monitor instance. We recommend storing memory and processor metrics from containers, nodes, and controllers. This enables strong real-time and post-mortem analysis of unknown behaviors in AKS clusters.

How to Fix

Resource: Microsoft.ContainerService/managedClusters

• Arguments: logAnalyticsWorkspaceResourceID [source,go]

---

{ "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksResourceId": { "type": "string", "metadata": { "description": "AKS Cluster Resource ID" } }, "aksResourceLocation": { "type": "string", "metadata": { "description": "Location of the AKS resource e.g. "East US"" } }, "aksResourceTagValues": { "type": "object", "metadata": { "description": "Existing all tags on AKS Cluster Resource" } }, "workspaceResourceId": { "type": "string", "metadata": { "description": "Azure Monitor Log Analytics Resource ID" } } }, "resources": [ { "name": "[split(parameters('aksResourceId'),'/')[8]]", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('aksResourceLocation')]", "tags": "[parameters('aksResourceTagValues')]", "apiVersion": "2018-03-31", "properties": { "mode": "Incremental", "id": "[parameters('aksResourceId')]", "addonProfiles": { "omsagent": { "enabled": true, "config": {

•         "logAnalyticsWorkspaceResourceID": "[parameters('workspaceResourceId')]"
        }
      }
    }
  }

  } ] }

---