AKS cluster not encrypting temp disks, caches, and data flows misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_227
Category - Subcategory	Kubernetes - Native Security Controls
Provider	AZURE
Severity	HIGH
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

This rule checks to verify if the Azure Kubernetes Service (AKS) cluster encrypts temporary disks, caches, and data flows. It's bad not to have encryption because it can lead to unauthorized data access or data loss. Encrypting these disk resources ensures that all data is unreadable by anyone without the correct encryption key, thereby mitigating risks related to data confidentiality and integrity. Without such a rule in place, sensitive data might be exposed to potential threats, making the system vulnerable to harmful security breaches.

How to Fix

Resource: azurerm_kubernetes_cluster

• Arguments: default_node_pool.enable_host_encryption [source,go]

---

resource "azurerm_kubernetes_cluster" "example" { ... default_node_pool {

• enable_host_encryption = true ... } }

---