Back to Checks
azure

AKS cluster has network policy enabled

aks_network_policy_enabled
Service: aksSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundariescluster-security
Resource Type:microsoft.containerservice/managedclusters

AKS clusters enforce Kubernetes network policies so that pod-to-pod traffic is governed by explicit ingress and egress rules. The finding evaluates whether a cluster has network policy enforcement enabled to support fine-grained, label-based segmentation between workloads.

Prowler logoProwlerprowler-provider-azure

Risk

Without network policy, pods can talk to any pod:

  • Easy lateral movement after a pod compromise
  • Unrestricted access to backend services and data
  • Covert exfiltration/C2 via East-West traffic

This harms confidentiality and integrity and amplifies the blast radius of runtime exploits.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks aks_network_policy_enabled

Recommendation

Enable network policy enforcement and apply least privilege segmentation.

  • Start with a deny-all baseline, allow only required flows
  • Define both ingress and egress policies
  • Use consistent labels/namespaces
  • Layer with defense in depth (RBAC, node isolation, private networking) for zero-trust East-West control.

Remediation

CLI

az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --network-policy calico

Terraform

# Enable network policy on AKS
resource "azurerm_kubernetes_cluster" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<LOCATION>"
  resource_group_name = "<RESOURCE_GROUP>"
  dns_prefix          = "<example_dns_prefix>"

  default_node_pool {
    name       = "system"
    node_count = 1
    vm_size    = "Standard_DS2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  network_profile {
    network_plugin = "azure"
    network_policy = "calico" # Critical: enables AKS network policy
  }
}

NativeIaC

// Enable network policy on AKS
param location string = resourceGroup().location

resource aks 'Microsoft.ContainerService/managedClusters@2024-05-01' = {
  name: '<example_resource_name>'
  location: location
  dnsPrefix: '<example_dns_prefix>'
  identity: { type: 'SystemAssigned' }
  agentPoolProfiles: [
    {
      name: 'systempool'
      vmSize: 'Standard_DS2_v2'
      count: 1
    }
  ]
  networkProfile: {
    networkPlugin: 'azure'
    networkPolicy: 'calico' // Critical: enables AKS network policy enforcement
  }
}

Other

1In Azure Portal, go to Kubernetes services and select your cluster
2Open Networking (or Settings > Networking)
3Set Network policy to Azure or Calico
4Click Save to apply

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.aks.aks_client import aks_client


class aks_network_policy_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for subscription_id, clusters in aks_client.clusters.items():
            subscription_name = aks_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for cluster_id, cluster in clusters.items():
                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"Network policy is enabled for cluster '{cluster.name}' in subscription '{subscription_name} ({subscription_id})'."

                if not getattr(cluster, "network_policy", False):
                    report.status = "FAIL"
                    report.status_extended = f"Network policy is not enabled for cluster '{cluster.name}' in subscription '{subscription_name} ({subscription_id})'."

                findings.append(report)

        return findings

References