Manage Kubernetes RBAC users and groups with Microsoft Entra ID

中レベル 2手動レビューaks

説明

Using Microsoft Entra ID for AKS user access helps ensure that Kubernetes permissions are tied to centrally managed enterprise identities and groups instead of disconnected, cluster-local user handling. At a high level, this improves control over who can authenticate to the cluster and lets access decisions follow the organization’s normal identity lifecycle, such as user onboarding, group membership changes, and access removal. The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review the AKS cluster configuration to confirm user authentication is integrated with Microsoft Entra ID and that cluster authorization is being managed through Kubernetes RBAC bindings for Entra users or groups, rather than relying on local cluster credentials. A brief audit should verify that AKS-managed Entra integration is enabled, that appropriate Entra admin group object IDs are configured, and that local accounts are disabled where the security standard requires removal of the alternate --admin access path.

修正方法

修正方法: ガイダンスまたは IaC パッチ

If the cluster isn’t using AKS-managed Microsoft Entra integration with Kubernetes RBAC, enable that identity model and assign access through approved Entra groups that are then mapped to Kubernetes Roles and ClusterRoles by RoleBinding or ClusterRoleBinding. Where the goal is to ensure all human access is Entra-governed, also disable local accounts so static local admin credentials don’t remain available as a parallel access method; AKS guidance notes that if local accounts are disabled on an existing cluster, cluster certificates should be rotated to revoke previously issued local-account credentials.

プロパティ

オペレーティングシステム: すべて
タグ: aksmanaged-servicesrbac
参照: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.5.1 Manage Kubernetes RBAC users and groups with Microsoft Entra ID