AKS Secrets Store Without Auto-Rotation misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_172
Category - Subcategory	Storage - Alerting
Provider	AZURE
Severity	MEDIUM
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Secrets auto-rotation is crucial for maintaining a secure AKS environment. The Secrets Store CSI Driver for AKS should be configured to auto-rotate secrets. This ensures that if a secret is compromised, it will be rotated according to policy and limit the damage a bad actor can do.

This rule checks that auto-rotation of Secrets Store CSI Driver secrets is enabled for AKS clusters.

How to Fix

Resource: azurerm_kubernetes_cluster

• Arguments: key_vault_secrets_provider/secret_rotation_enabled [source,go]

---

resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name

key_vault_secrets_provider {

• secret_rotation_enabled = true }

default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" }

identity { type = "SystemAssigned" }

tags = { Environment = "production" } }