Back to Checks
azure

AKS cluster has automatic upgrade enabled

aks_cluster_auto_upgrade_enabled
Service: aksSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilitiescluster-security
Resource Type:microsoft.containerservice/managedclusters

AKS clusters are evaluated for an automatic upgrade channel other than none. Automatic upgrades keep the Kubernetes control plane and node pools on supported patch/minor versions and reduce version drift across clusters.

Prowler logoProwlerprowler-provider-azure

Risk

Without automatic upgrades, AKS clusters can remain on unsupported or vulnerable Kubernetes versions. Delayed patching increases exposure to known CVEs, control plane/node defects, and exploit chains that can affect workload confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks aks_cluster_auto_upgrade_enabled

Recommendation

Configure an AKS automatic upgrade channel so clusters receive Kubernetes version updates and security patches without relying only on manual upgrade processes. Use patch or stable for conservative production upgrades, reserve faster channels such as rapid for environments that can absorb quicker version changes, and avoid none unless a documented exception and manual patching process exists.

Remediation

CLI

az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --auto-upgrade-channel patch

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.aks.aks_client import aks_client


class aks_cluster_auto_upgrade_enabled(Check):
    def execute(self) -> list[Check_Report_Azure]:
        findings = []

        for subscription_name, clusters in aks_client.clusters.items():
            for cluster in clusters.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
                report.subscription = subscription_name

                auto_upgrade_channel = (
                    (cluster.auto_upgrade_channel or "").strip().lower()
                )
                if auto_upgrade_channel and auto_upgrade_channel != "none":
                    report.status = "PASS"
                    report.status_extended = (
                        f"Cluster '{cluster.name}' has auto-upgrade channel."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Cluster '{cluster.name}' does not have auto-upgrade configured."

                findings.append(report)

        return findings

References