Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
apiserver_always_pull_images_plugin
Kubernetes API server admission configuration includes AlwaysPullImages, which mutates new Pods to set imagePullPolicy=Always so container images are fetched from the registry at startup using the pod's credentials.
apiserver_anonymous_requests
Kubernetes API server anonymous authentication configuration, identified by --anonymous-auth=true. With this setting, unauthenticated requests are mapped to system:anonymous and processed by the server.
apiserver_audit_log_maxage_set
Kubernetes API server audit logging retention is governed by --audit-log-maxage. This evaluates whether the configured value (e.g., 30 days) is set consistently across API server containers to retain audit events for a sufficient period.
apiserver_audit_log_maxbackup_set
Kubernetes API server audit logging uses --audit-log-maxbackup to set how many rotated audit log files are kept. This evaluates whether that value is explicitly configured as 10 or an approved organizational setting across API server containers.
apiserver_audit_log_maxsize_set
Kubernetes API server uses --audit-log-maxsize to cap audit log files. The check expects 100 MB or a policy-approved value, indicating rotation occurs when a log reaches that size.
apiserver_audit_log_path_set
Kubernetes API server uses an audit log path configured via --audit-log-path on its containers to persist API request events
apiserver_auth_mode_include_node
Kubernetes API server authorization settings include the Node authorizer in --authorization-mode. The evaluation looks for Node among the configured modes.
apiserver_auth_mode_include_rbac
Kubernetes API server authorization configuration includes the RBAC authorizer in the enabled modes, i.e., RBAC appears in the authorizer chain.
apiserver_auth_mode_not_always_allow
Kubernetes API server authorization is evaluated via the --authorization-mode setting to detect any use of AlwaysAllow. The focus is whether policy-driven authorizers are configured instead of an allow-all mode.
apiserver_client_ca_file_set
Kubernetes API server uses a configured client CA (--client-ca-file) to validate x509 client certificates presented for API authentication
apiserver_deny_service_external_ips
Kubernetes API server with DenyServiceExternalIPs rejects net-new use of Service.spec.externalIPs and additions to that field on existing Services; existing values can only be removed.
apiserver_disable_profiling
Kubernetes API server runtime profiling is controlled by the --profiling flag. The evaluation inspects API server container arguments to confirm --profiling=false and that profiling endpoints (such as /debug/pprof) are not enabled.
apiserver_encryption_provider_config_set
Kubernetes API server pods include --encryption-provider-config, supplying an EncryptionConfiguration to apply encryption at rest to selected API resources stored in etcd.
apiserver_etcd_cafile_set
Kubernetes API server uses an etcd CA file via --etcd-cafile to verify etcd's TLS certificate.
This evaluates whether API server containers specify that CA file, anchoring TLS trust for etcd connections.
apiserver_etcd_tls_config
Kubernetes API server uses TLS for its etcd client connection, signaled by --etcd-certfile and --etcd-keyfile in the API server pod arguments.
This evaluates whether client-certificate authentication is configured between the API server and etcd.
apiserver_event_rate_limit
Kubernetes API server includes EventRateLimit among its enabled admission plugins, applying rate controls to Kubernetes Event objects during admission
apiserver_kubelet_cert_auth
Kubernetes API server is configured with a kubelet certificate authority via --kubelet-certificate-authority so it can validate kubelet serving certificates during APIkubelet TLS connections.
apiserver_kubelet_tls_auth
Kubernetes API server is configured to use TLS client certificates when communicating with kubelets via --kubelet-client-certificate and --kubelet-client-key.
apiserver_namespace_lifecycle_plugin
Kubernetes API server has the NamespaceLifecycle admission controller active and not disabled, enforcing namespace lifecycle rules by rejecting objects targeting non-existent or terminating namespaces and protecting system namespaces from deletion.
apiserver_no_always_admit_plugin
Kubernetes API server configuration is inspected for the AlwaysAdmit admission plugin in --enable-admission-plugins.
If AlwaysAdmit is configured, the server accepts all admission requests without running other admission controllers.
apiserver_node_restriction_plugin
Kubernetes API server has the NodeRestriction admission controller enabled via --enable-admission-plugins.
This setting confines kubelets to modify only their own Node object and bound Pod objects.
apiserver_no_token_auth_file
Kubernetes API server configuration is reviewed for use of static token file authentication by inspecting API server containers for the --token-auth-file argument
apiserver_request_timeout_set
Kubernetes API server has a global request timeout configured via --request-timeout.
The presence of that flag on API server containers is assessed.
apiserver_security_context_deny_plugin
Kubernetes API server admission configuration is reviewed for PodSecurityPolicy or SecurityContextDeny, indicating whether pods using high-risk securityContext fields (privileged, host access, extra capabilities) would be blocked during admission.