Checks

Ensure AKS logging to Azure Monitoring is configured for containers to monitor the performance of workloads.

The API server is the central way to interact with and manage a cluster. To improve cluster security and minimize attacks, the API server should only be accessible from a limited set of IP address ranges.

Using Kubernetes role-based access control (RBAC), you can grant users, groups, and service accounts access to only the resources they need.

The Kubernetes object type NetworkPolicy should be defined to have opportunity allow or block traffic to pods, as in a Kubernetes cluster configured with default settings, all pods can discover and communicate with each other without any restrictions.

It is recommended that at least one valid contact is configured for the security center.

Microsoft will notify the security contact directly in the event of a security incident using email and require alerting to be turned on.

To benefit from Azure Defender you should use the Standard subscription tier.

Enabling Azure Defender extends the capabilities of the free mode to workloads running in private and other public clouds, providing unified security management and threat protection across your hybrid cloud workloads.

It is recommended that at least one valid contact is configured for the security center.

Microsoft will notify the security contact directly in the event of a security incident and will look to use a telephone number in cases where a prompt response is required.

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

RDP access can be configured on either the network security group or in the network security group rule. RDP access should not be permitted from the internet (*, 0.0.0.0, /0, internet, any). Consider using the Azure Bastion Service.

Flow logs are the source of truth for all network activity in your cloud environment.

To enable analysis in security event that was detected late, you need to have the logs available.

Setting an retention policy will help ensure as much information is available for review.

SSH access can be configured on either the network security group or in the network security group rule. SSH access should not be permitted from the internet (*, 0.0.0.0, /0, internet, any)

Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

Allowing custom roles to include 'roleDefinitions/write' enables privilege escalation. A user could define or alter roles to gain excessive permissions.

Blob soft delete protects blob data from being accidentally or erroneously modified or deleted. When blob soft delete is enabled, deleted blobs are retained in the system for a specified retention period. During the retention period, you can restore a soft-deleted blob to its state at the time it was deleted.

Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Logging should be enabled for at least one storage service type.

Geo-redundant storage (GRS) replicates your data to a secondary region that is hundreds of miles away from the primary region. This provides an additional level of durability for your data in the event of a complete regional outage or a disaster. Options include GRS, RAGRS, GZRS, and RAGZRS for geo-redundancy.

Storage accounts should enforce HTTPS for secure data transfer and use a minimum TLS version of 1.2 or higher. This ensures that logs and data stored in the storage account are encrypted in transit. Azure Storage encrypts all data at rest by default, but transport encryption is also critical.

Storage accounts should use customer-managed keys (CMK) for encryption to provide additional control over the encryption keys. Customer-managed keys allow you to create, rotate, disable, and revoke access controls. They also provide greater flexibility to audit the encryption keys that are used to protect your data.

Infrastructure encryption provides an additional layer of encryption at the infrastructure level. When infrastructure encryption is enabled, data in the storage account is encrypted twice - once at the service level and once at the infrastructure level with two different encryption algorithms. This provides double encryption for enhanced security.

Without a configured security contact email, critical alerts from Microsoft Defender for Cloud may go unnoticed, delaying incident response.

Microsoft will notify the security contact directly in the event of a security incident and will look to use email for notifications.

If Defender for Cloud email alerts are disabled, high-severity issues may go unnoticed.

Email notifications should be enabled to ensure security contacts are notified of critical security alerts and incidents in a timely manner.

If a security contact is disabled, critical alerts from Microsoft Defender for Cloud will not be delivered to that contact, potentially causing security incidents to go unnoticed.

Security contacts should be enabled to ensure that designated personnel receive timely notifications about security threats and incidents.

A public AKS API server endpoint increases exposure to unauthorized access or attack. Enable private cluster to ensure the API server endpoint is only accessible from within the virtual network.

Azure Kubernetes Service should enable Azure Policy Add-On to enforce compliance and governance policies on the cluster. The add-on extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA).