Minimize access to the proxy sub-resource of nodes

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Review AKS RBAC to identify custom Role and ClusterRole objects that grant access to the nodes/proxy subresource, and validate that each permission is required for an approved troubleshooting, maintenance, or platform-administration function. This review should focus on customer-managed RBAC because AKS uses Kubernetes RBAC to grant in-cluster permissions, and service accounts continue to rely on Kubernetes RBAC authorization when the identity is outside Microsoft Entra ID.

How it is fixed

Fix method: Guidance or infrastructure patch

Reduce custom RBAC access to the nodes/proxy API path so it is limited to approved administrative identities that require node-level access. In AKS, node access is treated as privileged, and service accounts continue to use Kubernetes RBAC for in-cluster authorization. • Remove nodes/proxy from any custom Role or ClusterRole where node-level proxying is not explicitly required for support, troubleshooting, or platform operations. • Where some node-related access is still needed, replace nodes/proxy with narrower permissions on only the specific resources and verbs required, and reduce scope from ClusterRole to namespace-scoped Role where the function allows it. AKS guidance favors minimum required permissions and separation of access boundaries.