Check ID: aks_cluster_rbac_enabled
Provider: Azure
Service: aks
Severity: HIGH
Categories: cluster-security, identity-access
Resource type: microsoft.containerservice/managedclusters

​
What this check verifies

AKS clusters with Kubernetes RBAC enforce authorization through roles and bindings mapped to identities and groups. This evaluates whether the cluster has RBAC enabled to control access to namespaces and cluster-wide resources.

​
Risk

Without Kubernetes RBAC, authorization becomes overly broad, weakening least privilege. Compromised credentials could read secrets, alter workloads, or delete services, impacting confidentiality, integrity, and availability, and enabling lateral movement across the cluster.

​
Recommendation

Enable Kubernetes RBAC and design permissions with least privilege: scope roles to namespaces, grant access via groups, apply deny-by-default, and separate duties for admins and operators. Integrate with Microsoft Entra ID and review/audit role bindings to maintain defense in depth.

​
Remediation

# AKS with Kubernetes RBAC enabled
resource "azurerm_kubernetes_cluster" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<example_location>"
  resource_group_name = "<example_resource_name>"
  dns_prefix          = "<example_resource_name>"

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_DS2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  role_based_access_control_enabled = true # Critical: enables Kubernetes RBAC to pass the check
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = aks_cluster_rbac_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks