Ensure container image vulnerability scanning with Defender for Containers or a third-party provider

СреднийУровень 1Ручная проверкаaks

Описание

Ensure vulnerability scanning is enabled for container images that are stored in registries and intended for deployment to AKS, using Microsoft Defender for Containers in Defender for Cloud or an equivalent third-party scanner. This control applies both to registry images and, where enabled and supported, to running containers in AKS. The benchmark marks this recommendation Manual.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Review whether Microsoft Defender for Containers is enabled for the subscription and whether registry image vulnerability assessment is enabled under that plan. For AKS, also verify the cluster Defender profile when cluster-side monitoring is in scope, and confirm Defender for Cloud is generating vulnerability findings for relevant images. • Confirm Microsoft.Security/pricings/Containers uses pricingTier: Standard. • Confirm the ContainerRegistriesVulnerabilityAssessments extension is enabled.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Enable Microsoft Defender for Containers for the subscription, enable the registry vulnerability assessment capability used for container image scanning, and then verify that Defender for Cloud is producing vulnerability findings for the registries and AKS workloads in scope. If the control is intended to cover only registry image scanning, the subscription plan and registry access settings are the key fixes; if it also includes AKS runtime protection, deploy the Defender sensor or AKS built-in integration and confirm the cluster Defender profile is enabled. 1. In the Defender for Cloud Environment settings turn Containers from Free to Standard. 2. Enable the registry image assessment capability by turning on the registry-related extension, including ContainerRegistriesVulnerabilityAssessments and required Registry access for supported registries.a 3.

Свойства

Операционные системы: Любая
Теги: aksmanaged-servicesregistry
Источник: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.1 Ensure container image vulnerability scanning with Defender for Containers or a third-party provider