Use Azure RBAC for Kubernetes Authorization

Trung bìnhCấp 2Xem xét thủ côngaks

Mô tả

Using Azure RBAC for Kubernetes Authorization helps centralize AKS access control in the same Azure IAM model used for other Azure resources, instead of managing human-user permissions only through in-cluster Kubernetes bindings. At a high level, this improves consistency, makes access assignment easier to govern across subscriptions and clusters, and supports least-privilege access by assigning only the Azure roles needed for Kubernetes API use. The benchmark marks this recommendation Manual.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Review the AKS cluster to confirm AKS-managed Microsoft Entra integration is enabled and Azure RBAC for Kubernetes Authorization is turned on, because Azure RBAC for Kubernetes depends on managed Entra integration first. Then verify that access for human users and groups is being granted through Azure role assignments for Kubernetes authorization rather than primarily through in-cluster RoleBinding and ClusterRoleBinding objects for those Entra identities.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

If the cluster is not using Azure RBAC for Kubernetes Authorization, enable AKS-managed Microsoft Entra integration first, then enable Azure RBAC on the cluster and move user access management to Azure role assignments using the built-in AKS Kubernetes RBAC roles or approved custom roles. For stronger control, pair this with disabling local accounts so static --admin access does not remain available as an alternate path; if local accounts are disabled on an existing cluster, rotate cluster certificates to revoke previously issued local-account credentials. Also review any custom role design for CRD coverage, because CRD reads require broader managed-cluster read scope than standard Kubernetes objects.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: aksmanaged-servicesrbac
Tham chiếu: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.5.2 Use Azure RBAC for Kubernetes Authorization