Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
kubelet_disable_read_only_port
Kubernetes Kubelet configuration is inspected for the readOnlyPort setting and whether it is set to 0 to disable the unauthenticated HTTP endpoint.
kubelet_event_record_qps
Kubernetes Kubelet configuration defines event rate limiting via eventRecordQPS. The setting is evaluated for presence and a positive value, where 0 means unlimited event generation.
kubelet_manage_iptables
Kubernetes Kubelet configured with makeIPTablesUtilChains manages iptables utility chains, keeping node firewall primitives aligned with dynamic pod networking. The setting is expected to be present and enabled in kubelet configuration.
kubelet_rotate_certificates
Kubernetes Kubelet configuration is inspected for client TLS credential rotation. The finding determines whether rotateCertificates is enabled so kubelets automatically renew the client certificates they use to authenticate to the API server.
kubelet_service_file_ownership_root
Kubernetes Kubelet service configuration on each node is expected to be owned by root. This assessment inspects the systemd drop-in at /etc/systemd/system/kubelet.service.d/kubeadm.conf and expects ownership root:root, ensuring only privileged users can modify kubelet startup settings.
kubelet_service_file_permissions
Kubernetes Kubelet service file on worker nodes is assessed for restrictive permissions of 600 or tighter. The evaluation reviews the kubelet systemd drop-in configuration to confirm only the owner has read/write access and no broader permissions are granted.
kubelet_streaming_connection_timeout
Kubernetes Kubelet streaming sessions use a non-zero idle timeout via streamingConnectionIdleTimeout for exec, logs, and port-forward connections.
Assesses whether this setting exists and is not 0.
kubelet_strong_ciphers_only
Kubernetes Kubelet HTTPS configuration is assessed for use of strong TLS cipher suites. The presence of tlsCipherSuites is checked and its values are validated against an approved, modern allowlist (e.g., ECDHE with GCM/CHACHA20).
kubelet_tls_cert_and_key
Kubernetes Kubelet configuration includes a TLS serving certificate and private key defined by tlsCertFile and tlsPrivateKeyFile to secure its HTTPS endpoint.
rbac_cluster_admin_usage
RBAC ClusterRoleBindings that bind to the cluster-admin ClusterRole are identified, showing where subjects receive super-user permissions across all namespaces.
rbac_minimize_csr_approval_access
RBAC assignments that grant update or patch on the certificatesigningrequests/approval subresource to users or groups via cluster-wide roles and bindings.
This highlights principals allowed to approve CSRs based on permissions defined in referenced ClusterRoles.
rbac_minimize_node_proxy_subresource_access
RBAC permissions to the nodes/proxy subresource are analyzed. Any user or group granted get, list, or watch via cluster-wide bindings is reported.
rbac_minimize_pod_creation_access
Kubernetes RBAC Roles and ClusterRoles that grant the create verb on pods are identified.
Rules are examined to find permissions allowing pod creation at namespace or cluster scope.
rbac_minimize_pv_creation_access
Kubernetes RBAC mapping of users or groups with the create verb on persistentvolumes through ClusterRoleBindings.
Shows which principals can provision PersistentVolumes cluster-wide.
rbac_minimize_secret_access
RBAC Roles and ClusterRoles granting read permissions to Kubernetes Secrets are identified. The evaluation looks for rules that allow get, list, or watch on secrets, either namespace-scoped or cluster-wide.
rbac_minimize_service_account_token_creation
Cluster-wide RBAC identifies users or groups granted create on serviceaccounts/token via ClusterRoles/ClusterRoleBindings.
Highlights principals allowed to mint service account tokens through the TokenRequest subresource.
rbac_minimize_webhook_config_access
User or group RBAC assignments that grant privileges to create, update, or delete validatingwebhookconfigurations and mutatingwebhookconfigurations are identified.
Focus is on permissions that allow modifying admission webhook configuration objects.
rbac_minimize_wildcard_use_roles
Kubernetes RBAC Roles/ClusterRoles are evaluated for wildcard use in rule resources or verbs. The presence of * means all resources or all actions are granted. This finding highlights roles whose rules include such wildcards.
scheduler_bind_address
Kubernetes scheduler is configured with --bind-address=127.0.0.1 so its health and metrics endpoints listen only on localhost.
The evaluation inspects scheduler pod commands for this bind address.
scheduler_profiling
Kubernetes Scheduler profiling configuration, specifically whether scheduler containers run with --profiling=false to keep the profiling API disabled.