Back to Checks
azure

AKS cluster has RBAC enabled

aks_cluster_rbac_enabled
Service: aksSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:microsoft.containerservice/managedclusters

AKS clusters with Kubernetes RBAC enforce authorization through roles and bindings mapped to identities and groups.

This evaluates whether the cluster has RBAC enabled to control access to namespaces and cluster-wide resources.

Prowler logoProwlerprowler-provider-azure

Risk

Without Kubernetes RBAC, authorization becomes overly broad, weakening least privilege. Compromised credentials could read secrets, alter workloads, or delete services, impacting confidentiality, integrity, and availability, and enabling lateral movement across the cluster.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks aks_cluster_rbac_enabled

Recommendation

Enable Kubernetes RBAC and design permissions with least privilege: scope roles to namespaces, grant access via groups, apply deny-by-default, and separate duties for admins and operators.

Integrate with Microsoft Entra ID and review/audit role bindings to maintain defense in depth.

Remediation

Terraform

# AKS with Kubernetes RBAC enabled
resource "azurerm_kubernetes_cluster" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<example_location>"
  resource_group_name = "<example_resource_name>"
  dns_prefix          = "<example_resource_name>"

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_DS2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  role_based_access_control_enabled = true # Critical: enables Kubernetes RBAC to pass the check
}

NativeIaC

// Enable Kubernetes RBAC on AKS
resource <example_resource_name> 'Microsoft.ContainerService/managedClusters@2024-05-01' = {
  name: '<example_resource_name>'
  location: '<example_location>'
  properties: {
    enableRBAC: true // Critical: turns on Kubernetes RBAC to pass the check
  }
}

Other

1In Azure portal, go to Kubernetes services > Create (or edit your deployment template)
2On the Authentication tab, set Kubernetes RBAC to Enabled
3Review + Create to deploy (re-create the cluster if the setting can't be changed on an existing one)

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.aks.aks_client import aks_client


class aks_cluster_rbac_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for subscription_id, clusters in aks_client.clusters.items():
            subscription_name = aks_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for cluster in clusters.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"RBAC is enabled for cluster '{cluster.name}' in subscription '{subscription_name} ({subscription_id})'."

                if not cluster.rbac_enabled:
                    report.status = "FAIL"
                    report.status_extended = f"RBAC is not enabled for cluster '{cluster.name}' in subscription '{subscription_name} ({subscription_id})'."

                findings.append(report)

        return findings

References