Back to Checks
azure

AKS cluster has Azure Monitor metrics enabled

aks_cluster_azure_monitor_enabled
Service: aksSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.containerservice/managedclusters

Azure Kubernetes Service clusters are evaluated for Azure Monitor managed service for Prometheus (the cluster's azureMonitorProfile.metrics configuration). When enabled, cluster and workload metrics are collected into an Azure Monitor workspace for dashboards and alerting. This is distinct from Container Insights (the omsagent logs addon).

Prowler logoProwlerprowler-provider-azure

Risk

Without Azure Monitor metrics, cluster degradation, resource exhaustion, and anomalous behavior go undetected. Lack of metric-based observability delays incident detection and hampers investigation after a security or availability event.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks aks_cluster_azure_monitor_enabled

Recommendation

Enable Azure Monitor managed service for Prometheus on AKS clusters so cluster and workload metrics are collected into an Azure Monitor workspace. Pair it with alerting on cluster health and resource saturation, and consider also enabling Container Insights (logs) for full observability.

Remediation

CLI

az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --enable-azure-monitor-metrics

Terraform

# Terraform: AKS cluster with Azure Monitor managed Prometheus metrics enabled
resource "azurerm_kubernetes_cluster" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<region>"
  resource_group_name = "<example_resource_name>"
  dns_prefix          = "<example_resource_name>"

  monitor_metrics {} # CRITICAL: enables Azure Monitor managed service for Prometheus (metrics)
}

NativeIaC

// Bicep: AKS cluster with Azure Monitor managed Prometheus metrics enabled
resource aks 'Microsoft.ContainerService/managedClusters@2024-02-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  properties: {
    azureMonitorProfile: {
      metrics: {
        enabled: true // CRITICAL: enables Azure Monitor managed service for Prometheus (metrics)
      }
    }
  }
}

Other

1Sign in to the Azure portal and open your AKS cluster
2In the left menu, select Monitoring > Insights
3Click Configure monitoring
4Ensure 'Enable Prometheus metrics' is selected and choose (or create) an Azure Monitor workspace
5Click Configure to enable Azure Monitor managed Prometheus metrics

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.aks.aks_client import aks_client


class aks_cluster_azure_monitor_enabled(Check):
    """
    Ensure Azure Monitor is enabled for AKS clusters.

    This check evaluates whether each Azure Kubernetes Service cluster has Azure Monitor integration enabled for metrics collection, log aggregation, and alerting.

    - PASS: The cluster has Azure Monitor enabled.
    - FAIL: The cluster does not have Azure Monitor enabled.
    """

    def execute(self) -> list[Check_Report_Azure]:
        findings = []

        for subscription_name, clusters in aks_client.clusters.items():
            for cluster in clusters.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
                report.subscription = subscription_name

                if cluster.azure_monitor_enabled:
                    report.status = "PASS"
                    report.status_extended = f"Cluster '{cluster.name}' has Azure Monitor managed Prometheus metrics enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Cluster '{cluster.name}' does not have Azure Monitor managed Prometheus metrics enabled."

                findings.append(report)

        return findings

References