Azure AKS cluster HTTP application routing enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_246
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AZURE
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	9d22d97d-8c3b-49fa-921d-d5f6f3b5a494

Impact

This rule detects whether ingress controllers in AKS clusters are configured to allow HTTP application routing. While convenient for development and testing within your AKS clusters, enabling HTTP application routing for production deployments can introduce security risks. Because publicly accessible DNS names are automatically created for application endpoints, using HTTP instead of HTTPS for these endpoints could expose sensitive data, as HTTP traffic is not encrypted.

How to Fix

Resource: azurerm_kubernetes_cluster

• Arguments: http_application_routing_enabled

To mitigate this issue, set the `http_application_routing_enabled`` attribute to false in your Terraform configuration.

Example: [source,go]

resource "azurerm_kubernetes_cluster" "example" { ...

• http_application_routing_enabled = true
• http_application_routing_enabled = false }

---