Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
The SecurityContextDeny admission controller can be used to deny pods which make use of some SecurityContext fields which could allow for privilege escalation in the cluster. This should be used where PodSecurityPolicy is not in place within the cluster.
Automate service accounts management.
Reject creating objects in a namespace that is undergoing termination.
Limit the Node and Pod objects that a kubelet could modify.
Do not disable the secure port.
Disable profiling, if not needed.
Enable auditing on the Kubernetes API Server and set the desired audit log path.
Retain the logs for at least 30 days or as appropriate.
Retain 10 or an appropriate number of old log files.
Rotate log files on reaching 100 MB or as appropriate.
Validate service account before validating token.
Explicitly set a service account public key file for service accounts on the apiserver.
etcd should be configured to make use of TLS encryption for client connections.
Setup TLS connection on the API server.
Setup TLS connection on the API server.
etcd should be configured to make use of TLS encryption for client connections.
Encrypt etcd key-value store.
Activate garbage collector on pod termination, as appropriate.
Disable profiling, if not needed.
Use individual service account credentials for each controller.
Explicitly set a service account private key file for service accounts on the controller manager.
Allow pods to verify the API server's serving certificate before establishing connections.
Enable kubelet server certificate rotation on controller-manager.
Do not bind the scheduler service to non-loopback insecure addresses.