Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
controllermanager_service_account_private_key_file
Kubernetes controller manager uses a service account signing key configured via --service-account-private-key-file.
The evaluation identifies whether this argument is present, indicating the component can sign service account tokens.
core_cpu_limits_set
Ensure CPU limits are set for containers to prevent noisy neighbors and resource exhaustion.
core_cpu_requests_set
Ensure CPU requests are set for containers to enable proper scheduling and resource guarantees.
core_image_tag_fixed
Kubernetes Pods are evaluated for containers using images without a fixed version tag, such as latest or no tag at all, which results in unpredictable image versions being pulled.
core_liveness_probe_configured
Ensure each regular pod container has a liveness probe configured to detect and restart unhealthy containers.
core_memory_limits_set
Kubernetes Pods are evaluated for containers without memory limits configured in resources.limits.memory, indicating unbounded memory consumption is permitted.
core_memory_requests_set
Kubernetes Pods are evaluated for containers without memory requests configured in resources.requests.memory, indicating the scheduler cannot guarantee memory allocation.
core_minimize_admission_hostport_containers
Kubernetes Pods are inspected for any container declaring ports[].hostPort. The finding highlights workloads that bind container ports directly to the node's network stack via HostPorts.
core_minimize_admission_windows_hostprocess_containers
Kubernetes Pods are evaluated for Windows settings where securityContext.windowsOptions.hostProcess is set to true, indicating they can run Windows HostProcess containers.
core_minimize_allowPrivilegeEscalation_containers
Kubernetes Pods are evaluated for containers that enable allowPrivilegeEscalation. The finding highlights pods where any container permits processes to gain extra privileges; pods whose containers set allowPrivilegeEscalation: false are noted as not allowing escalation.
core_minimize_containers_added_capabilities
Kubernetes Pods and containers are evaluated for added Linux capabilities via capabilities.add in their security context; presence of added entries indicates elevated privileges beyond defaults.
core_minimize_containers_capabilities_assigned
Kubernetes Pods are inspected for container Linux capabilities. A finding occurs when any container sets capabilities in add or does not fully drop them (e.g., missing ALL), indicating capabilities are assigned instead of removed.
core_minimize_hostIPC_containers
Kubernetes pods are evaluated for use of the host's IPC namespace via the hostIPC setting. Workloads declaring hostIPC: true share node IPC resources (shared memory, semaphores, message queues) instead of isolated container IPC.
core_minimize_hostNetwork_containers
Kubernetes Pods configured with hostNetwork: true are identified, meaning they share the node's network namespace and use the host's IP stack, interfaces, and ports.
core_minimize_hostpath_volume_mounts
Kubernetes Pods are evaluated for volumes of type hostPath, which mount paths from the node filesystem into a pod.
core_minimize_hostPID_containers
Kubernetes Pods configured with hostPID: true are identified, indicating the container shares the node's host PID namespace.
core_minimize_net_raw_capability_admission
Kubernetes pods where any container's security context adds the NET_RAW Linux capability are identified.
The inspection evaluates container securityContext.capabilities.add entries to detect explicit requests for NET_RAW.
core_minimize_privileged_containers
Kubernetes Pods are evaluated for containers configured with securityContext.privileged: true, indicating execution in privileged mode.
core_minimize_root_containers_admission
Kubernetes Pods are assessed for containers configured to run as the root user. The evaluation identifies containers whose security context sets runAsUser: 0.
core_no_secrets_envs
Kubernetes Pods containers define environment variables sourced from Secrets via secretKeyRef instead of mounting them as files.
core_readiness_probe_configured
Ensure each regular pod container has a readiness probe configured to signal when it is ready to serve traffic.
core_readonly_root_filesystem_enabled
Kubernetes Pods are evaluated to ensure every container sets readOnlyRootFilesystem: true in its securityContext. A writable root filesystem lets an attacker who gains code execution modify binaries, drop tools, or persist malicious files inside the container.
core_seccomp_profile_docker_default
Kubernetes Pods and their containers specify the runtime default seccomp profile using seccompProfile.type: RuntimeDefault in the security context.
The evaluation looks for this setting at the Pod level or per container.
cosmosdb_account_automatic_failover_enabled
Azure Cosmos DB accounts are evaluated for automatic failover configuration. When enabled, Cosmos DB automatically promotes a secondary region to primary during a regional outage, ensuring continuous availability without manual intervention.