Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
apiserver_service_account_key_file_set
Kubernetes API server uses --service-account-key-file to supply the public key(s) for validating service account tokens.
Detection looks for API server containers that lack this flag.
apiserver_service_account_lookup_true
Kubernetes API server has service account lookup enabled via --service-account-lookup=true, validating presented service account tokens against currently existing ServiceAccounts during authentication.
apiserver_service_account_plugin
Kubernetes API server includes the ServiceAccount admission controller (ServiceAccount)-enabled via --enable-admission-plugins and not listed in --disable-admission-plugins.
It applies service account-related defaults and policies to Pods, such as assigning a service account and governing secret references.
apiserver_strong_ciphers_only
Kubernetes API server restricts TLS to strong cipher suites by configuring --tls-cipher-suites to only modern values such as TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, and TLS_CHACHA20_POLY1305_SHA256
apiserver_tls_config
Kubernetes API server configuration is checked for explicit TLS settings via --tls-cert-file and --tls-private-key-file. The presence of both flags indicates HTTPS is configured with a specified certificate and private key for client connections.
controllermanager_bind_address
Kubernetes controller manager uses the loopback bind address 127.0.0.1 via --bind-address or --address, keeping its health, metrics, and debug endpoints reachable only from the host
controllermanager_disable_profiling
Kubernetes Controller Manager is evaluated for the --profiling argument. --profiling=false disables runtime profiling; absence or a different value means profiling is enabled.
controllermanager_garbage_collection
Kubernetes controller manager terminated Pod garbage collection threshold is evaluated. The finding highlights use of the default --terminated-pod-gc-threshold=12500 instead of a value tuned to cluster size and workload churn. The threshold controls when terminated Pods are automatically removed.
controllermanager_root_ca_file_set
Kubernetes Controller Manager uses --root-ca-file to reference a certificate bundle so pods get a ca.crt for validating the API server's TLS certificate.
controllermanager_rotate_kubelet_server_cert
Kubernetes controller manager configuration includes the RotateKubeletServerCertificate=true feature gate for automatic rotation of kubelet server certificates
controllermanager_service_account_credentials
Evaluates whether the Kubernetes controller manager uses per-controller service account credentials via --use-service-account-credentials=true, meaning each controller runs with its own identity rather than a shared credential.
controllermanager_service_account_private_key_file
Kubernetes controller manager uses a service account signing key configured via --service-account-private-key-file.
The evaluation identifies whether this argument is present, indicating the component can sign service account tokens.
core_cpu_limits_set
Ensure CPU limits are set for containers to prevent noisy neighbors and resource exhaustion.
core_cpu_requests_set
Ensure CPU requests are set for containers to enable proper scheduling and resource guarantees.
core_image_tag_fixed
Kubernetes Pods are evaluated for containers using images without a fixed version tag, such as latest or no tag at all, which results in unpredictable image versions being pulled.
core_liveness_probe_configured
Ensure each regular pod container has a liveness probe configured to detect and restart unhealthy containers.
core_memory_limits_set
Kubernetes Pods are evaluated for containers without memory limits configured in resources.limits.memory, indicating unbounded memory consumption is permitted.
core_memory_requests_set
Kubernetes Pods are evaluated for containers without memory requests configured in resources.requests.memory, indicating the scheduler cannot guarantee memory allocation.
core_minimize_admission_hostport_containers
Kubernetes Pods are inspected for any container declaring ports[].hostPort. The finding highlights workloads that bind container ports directly to the node's network stack via HostPorts.
core_minimize_admission_windows_hostprocess_containers
Kubernetes Pods are evaluated for Windows settings where securityContext.windowsOptions.hostProcess is set to true, indicating they can run Windows HostProcess containers.
core_minimize_allowPrivilegeEscalation_containers
Kubernetes Pods are evaluated for containers that enable allowPrivilegeEscalation. The finding highlights pods where any container permits processes to gain extra privileges; pods whose containers set allowPrivilegeEscalation: false are noted as not allowing escalation.
core_minimize_containers_added_capabilities
Kubernetes Pods and containers are evaluated for added Linux capabilities via capabilities.add in their security context; presence of added entries indicates elevated privileges beyond defaults.
core_minimize_containers_capabilities_assigned
Kubernetes Pods are inspected for container Linux capabilities. A finding occurs when any container sets capabilities in add or does not fully drop them (e.g., missing ALL), indicating capabilities are assigned instead of removed.
core_minimize_hostIPC_containers
Kubernetes pods are evaluated for use of the host's IPC namespace via the hostIPC setting. Workloads declaring hostIPC: true share node IPC resources (shared memory, semaphores, message queues) instead of isolated container IPC.