Back to Checks
azure

AKS cluster has Microsoft Defender security profile enabled

aks_cluster_defender_enabled
Service: aksSeverity: high
OfficialBuilt-inVerified
Categories:threat-detectioncluster-security
Resource Type:microsoft.containerservice/managedclusters

AKS clusters are evaluated for the Microsoft Defender security profile (securityProfile.defender.securityMonitoring.enabled=true). Defender for Containers extends security monitoring, threat detection, vulnerability assessment, and security posture insights to Azure Kubernetes Service workloads.

Prowler logoProwlerprowler-provider-azure

Risk

Without the Microsoft Defender security profile, AKS runtime threats such as cryptomining, suspicious Kubernetes API activity, vulnerable container images, and malicious workload behavior may go undetected. Compromised containers can pivot to cluster resources and cloud APIs, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks aks_cluster_defender_enabled

Recommendation

Enable the Microsoft Defender security profile for AKS clusters and ensure the subscription has Defender for Containers enabled. Route security monitoring data to the appropriate workspace and review Defender alerts and recommendations as part of the cluster operations process.

Remediation

CLI

az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --enable-defender

Terraform

resource "azurerm_log_analytics_workspace" "example" {
  name                = "<workspace-name>"
  location            = "<location>"
  resource_group_name = "<resource-group>"
  sku                 = "PerGB2018"
}

resource "azurerm_kubernetes_cluster" "example" {
  name                = "<cluster-name>"
  location            = "<location>"
  resource_group_name = "<resource-group>"
  dns_prefix          = "<dns-prefix>"

  default_node_pool {
    name       = "system"
    node_count = 1
    vm_size    = "Standard_DS2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  microsoft_defender {
    log_analytics_workspace_id = azurerm_log_analytics_workspace.example.id
  }
}

NativeIaC

// AKS cluster with Microsoft Defender security monitoring enabled
resource aks 'Microsoft.ContainerService/managedClusters@2024-05-01' = {
  name: '<CLUSTER_NAME>'
  location: '<LOCATION>'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    dnsPrefix: '<DNS_PREFIX>'
    securityProfile: {
      defender: {
        logAnalyticsWorkspaceResourceId: '<LOG_ANALYTICS_WORKSPACE_RESOURCE_ID>'
        securityMonitoring: {
          enabled: true // Critical: enables Defender security monitoring for AKS
        }
      }
    }
    agentPoolProfiles: [
      {
        name: 'system'
        count: 1
        vmSize: 'Standard_DS2_v2'
        mode: 'System'
      }
    ]
  }
}

Other

1In Microsoft Defender for Cloud, enable the Containers plan for the subscription that contains the AKS cluster
2In the AKS cluster configuration, enable the Microsoft Defender security profile
3Verify that Defender security monitoring is enabled for the managed cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.aks.aks_client import aks_client


class aks_cluster_defender_enabled(Check):
    def execute(self) -> list[Check_Report_Azure]:
        findings = []

        for subscription_name, clusters in aks_client.clusters.items():
            for cluster in clusters.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
                report.subscription = subscription_name

                if cluster.defender_enabled is True:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Cluster '{cluster.name}' has Defender for Containers "
                        "enabled."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Cluster '{cluster.name}' does not have Defender for "
                        "Containers enabled."
                    )

                findings.append(report)

        return findings

References