Check ID: aks_clusters_public_access_disabled
Provider: Azure
Service: aks
Severity: HIGH
Categories: internet-exposed, trust-boundaries, cluster-security
Resource type: microsoft.containerservice/managedclusters

​
What this check verifies

AKS clusters expose a private control plane FQDN and agent pools have enable_node_public_ip=false. The evaluation focuses on the presence of a private FQDN and the absence of public IPs on nodes.

​
Risk

Exposed node IPs or a publicly reachable API increase attack surface, impacting confidentiality and integrity.
  • Internet scans reach kubelet, NodePort, or management agents
  • Exploits enable RCE and lateral movement
  • Metadata/secret theft leads to credential compromise
Availability is at risk from DDoS on exposed endpoints.

​
Recommendation

Adopt private clusters and eliminate node public IPs:
  • Set enable_node_public_ip=false on all pools
  • Use Private Link or peered VNets with VPN/ExpressRoute for admin access
  • If public API is unavoidable, restrict with IP ranges and strong auth
  • Enforce NSGs/firewalls and least privilege for layered defense

​
Remediation

# AKS cluster with private endpoint and nodes without public IPs
resource "azurerm_kubernetes_cluster" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<location>"
  resource_group_name = "<example_resource_name>"
  dns_prefix          = "dns"

  private_cluster_enabled = true # Critical: enables private cluster (private endpoint/FQDN)

  default_node_pool {
    name                  = "nodepool1"
    node_count            = 1
    vm_size               = "Standard_DS2_v2"
    enable_node_public_ip = false # Critical: disables public IPs on nodes
  }

  identity {
    type = "SystemAssigned"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = aks_clusters_public_access_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks