Checks

Kubernetes API server admission configuration is reviewed for PodSecurityPolicy or SecurityContextDeny, indicating whether pods using high-risk securityContext fields (privileged, host access, extra capabilities) would be blocked during admission.

Kubernetes API server uses --service-account-key-file to supply the public key(s) for validating service account tokens.

Detection looks for API server containers that lack this flag.

Kubernetes API server has service account lookup enabled via --service-account-lookup=true, validating presented service account tokens against currently existing ServiceAccounts during authentication.

Kubernetes API server includes the ServiceAccount admission controller (ServiceAccount)-enabled via --enable-admission-plugins and not listed in --disable-admission-plugins.

It applies service account-related defaults and policies to Pods, such as assigning a service account and governing secret references.

Kubernetes API server restricts TLS to strong cipher suites by configuring --tls-cipher-suites to only modern values such as TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, and TLS_CHACHA20_POLY1305_SHA256

Kubernetes API server configuration is checked for explicit TLS settings via --tls-cert-file and --tls-private-key-file. The presence of both flags indicates HTTPS is configured with a specified certificate and private key for client connections.

Okta API token ownership should avoid Super Admin users because API tokens inherit the admin permissions of the user that created them.

Okta API token network restrictions should prevent token use from Any IP by tying each token to known Okta Network Zones.

Azure App Service apps enforce mutual TLS when client certificate mode is set to Required, meaning every inbound request must present a valid client certificate that the app can validate.

Azure App Service can enforce built-in Authentication/Authorization (Easy Auth) so requests are authenticated by a provider before reaching app code.

This evaluates whether platform auth is enabled for the app and an identity provider is configured.

Azure App Service web apps redirect HTTP traffic to HTTPS when the HTTPS Only setting is enabled. This evaluation identifies apps that do not force secure transport by checking whether plaintext requests are automatically redirected to encrypted endpoints.

Azure App Service web apps that run Java are assessed to ensure their configured runtime uses the latest supported major version (LTS) for the environment, across Linux and Windows.

Only apps with Java enabled are considered.

Azure App Service web apps running PHP are evaluated to ensure the runtime is configured to the latest supported release. The finding compares the app's PHP stack (from linuxFxVersion or php_version) with the newest available version.

Azure App Service web apps using Python are assessed to confirm the runtime is the latest supported version (e.g., 3.12). The evaluation reads the app's stack configuration to detect Python usage and compares the configured runtime against the defined latest baseline.

Azure App Service web apps are evaluated for HTTP/2 support via the http20_enabled configuration, indicating whether the site serves traffic using the HTTP/2 protocol

Azure App Service web apps are evaluated for FTP exposure via the ftpsState setting. Values FtpsOnly or Disabled indicate FTP is not allowed; AllAllowed means both FTP and FTPS are accepted.

Azure Function apps are evaluated for configured function access keys on HTTP endpoints.

The finding distinguishes functions with at least one access key defined from those without any keys configured.

Azure Function apps are configured to send telemetry to Application Insights when application settings include APPLICATIONINSIGHTS_CONNECTION_STRING or APPINSIGHTS_INSTRUMENTATIONKEY.

Azure Function apps redirect HTTP traffic to HTTPS when the HTTPS Only setting is enabled. This evaluation identifies Function apps that do not force secure transport by checking whether plaintext requests are automatically redirected to encrypted endpoints.

Azure Function apps are evaluated for the ftps_state setting that controls FTP/FTPS deployment endpoints. Values AllAllowed or FtpsOnly indicate deployment over FTP/FTPS is enabled, while Disabled indicates both endpoints are turned off.

Azure Function Apps are evaluated for an enabled managed identity (SystemAssigned or UserAssigned) configured on the app.

The finding indicates whether an identity is present to support token-based access to other Azure resources.

Azure Function apps with managed identities are evaluated for assignments to broad administrative roles: Owner, Contributor, User Access Administrator, RBAC Administrator.

The finding highlights functions whose identity carries elevated permissions beyond normal runtime needs.

Azure Function apps are assessed for the runtime version set via FUNCTIONS_EXTENSION_VERSION. The finding identifies apps not configured to use the current supported major version ~4.

Azure Function apps are assessed for whether they are reachable from the public Internet. The evaluation considers the app's publicNetworkAccess state and the presence of access restrictions or private endpoints to limit inbound traffic.