Back to Checks
alibabacloud

Kubernetes cluster has Network policy enabled

cs_kubernetes_network_policy_enabled
Service: csSeverity: medium
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:ALIYUN::CS::ManagedKubernetesCluster

Alibaba Cloud Kubernetes Engine clusters should enable Network Policy via the Terway plugin. A NetworkPolicy defines how pods communicate using label-based rules. By default, pods accept traffic from any source; NetworkPolicy restricts traffic to explicitly allowed connections, enforcing least privilege at the network level.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without Network Policies, all pods communicate freely, creating an unrestricted flat network. An attacker who compromises a single pod can move laterally, accessing sensitive services, databases, and secrets. The absence of network segmentation undermines defense in depth and increases the blast radius of any compromise, impacting confidentiality and integrity of workloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks cs_kubernetes_network_policy_enabled

Recommendation

Select the Terway network plugin during cluster creation to enable Network Policy support. Existing clusters using Flannel cannot be migrated to Terway and must be recreated.

Remediation

CLI

aliyun cs GET /clusters/<cluster_id> --header 'Content-Type=application/json' | jq '.parameters.Network'

Other

1When creating a new cluster in the **ACK Console**, select **Terway** in the `Network Plugin` option to enable Network Policy support.
2Note that existing clusters using **Flannel** cannot be migrated to **Terway**.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.cs.cs_client import cs_client


class cs_kubernetes_network_policy_enabled(Check):
    """Check if Network policy is enabled on Kubernetes Engine Clusters."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for cluster in cs_client.clusters:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=cluster)
            report.region = cluster.region
            report.resource_id = cluster.id
            report.resource_arn = f"acs:cs:{cluster.region}:{cs_client.audited_account}:cluster/{cluster.id}"

            if cluster.network_policy_enabled:
                report.status = "PASS"
                report.status_extended = f"Kubernetes cluster {cluster.name} has Network Policy enabled via Terway plugin."
            else:
                report.status = "FAIL"
                report.status_extended = f"Kubernetes cluster {cluster.name} does not have Network Policy enabled (requires Terway network plugin)."

            findings.append(report)

        return findings

References