AKS cluster must enable RBAC

Applies to

• Microsoft.ContainerService/managedClusters

What CGPulse checks

A resource passes this rule when enableRBAC must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable Kubernetes RBAC to enforce granular access control within the cluster. In Azure Portal: AKS cluster > Cluster configuration > enable Kubernetes RBAC. See: https://learn.microsoft.com/en-us/azure/aks/manage-azure-rbac

CLI

az aks update --ids "{id}" --enable-rbac

Terraform

resource "azurerm_kubernetes_cluster" "{name}" {
  role_based_access_control_enabled = true
}

Compliance frameworks

• Critical Security Controls v86.8
• ISO 27001: Information SecurityA.9.1.2
• Well-Architected Cloud Review

Related Azure rules

• Action Group should be enabled
• Activity Log Alert should be enabled
• AKS cluster logs should be sent to Log Analytics
• AKS cluster must enable RBAC
• AKS cluster should be a private cluster
• AKS cluster should disable local accounts
• AKS cluster should enable Azure RBAC for Kubernetes
• AKS cluster should have diagnostic settings configured