Encrypt Kubernetes Secrets at rest with AKS KMS protection

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Review each AKS cluster in scope to determine whether Key Management Service (KMS) encryption for Kubernetes Secrets is enabled and correctly configured. Note the Azure platform encryption is always enabled for data at rest, but AKS KMS adds a separate encryption layer that encrypts Kubernetes Secret data before it is written to etcd by using Azure Key Vault–backed keys.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

For AKS clusters that do not use KMS for Kubernetes Secret encryption, enable AKS KMS so Secret data is encrypted before it is written to etcd. AKS distinguishes this from the baseline Azure platform encryption that is always on at the storage layer, and documents AKS KMS as the added Azure Key Vault–backed encryption layer for Kubernetes secrets. For newer supported clusters, use the current KMS data-encryption model; where customer-managed keys are required, configure the Azure Key Vault key, assign the required managed identity and permissions, enable KMS on the cluster, and then verify the cluster security profile reflects the expected KMS settings. 1. Identify AKS clusters where KMS is not enabled for Kubernetes Secret encryption, using cluster configuration review or Azure Policy. 2.