Check ID: aks_clusters_created_with_private_nodes
Provider: Azure
Service: aks
Severity: HIGH
Categories: internet-exposed, trust-boundaries, cluster-security
Resource type: microsoft.containerservice/managedclusters

​
What this check verifies

AKS agent pools use only private addressing, with node public IP assignment disabled (enableNodePublicIP=false). Clusters where any pool assigns a public IP to nodes are identified.

​
Risk

Public node IPs expose worker VMs to Internet scanning and exploit attempts against OS or kubelet services. Successful compromise can lead to stolen secrets and images (confidentiality), workload tampering (integrity), and node/resource exhaustion via DDoS or cryptomining (availability).

​
Recommendation

Disable public node IPs on all agent pools (enableNodePublicIP=false) and route egress via a NAT gateway or Azure Firewall. Apply least privilege with NSGs blocking Internet ingress, use private endpoints and bastion/VPN for admin access, and adopt defense in depth with continuous hardening and monitoring.

​
Remediation

# AKS cluster with node public IPs disabled
resource "azurerm_kubernetes_cluster" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<location>"
  resource_group_name = "<example_resource_name>"
  dns_prefix          = "<example_resource_name>"

  default_node_pool {
    name                  = "default"
    node_count            = 1
    vm_size               = "Standard_DS2_v2"
    enable_node_public_ip = false # CRITICAL: ensures nodes have no public IPs
  }

  identity {
    type = "SystemAssigned"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = aks_clusters_created_with_private_nodes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks