Cis Aks V170 5.1.4
DevOps & Securitycis-aks-v170-5.1.4Cis Aks V170 5.1.4 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Minimize Container Registries to only those approved (Manual)
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_Azure_Kubernetes_Service_AKS_Benchmark_v1.7.0/cis-aks-v170-5.1.4/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aks-v170-5-1-4, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
5.1.4 Minimize Container Registries to only those approved (Manual)
Profile Applicability
- Level 2
Description
Use approved container registries.
Rationale
Allowing unrestricted access to external container registries provides the opportunity for malicious or unapproved containers to be deployed into the cluster. Allowlisting only approved container registries reduces this risk.
Impact
All container images to be deployed to the cluster must be hosted within an approved container image registry.
Audit
Review the list of container registries accessible from the AKS cluster and ensure only approved registries are allowed.
Remediation
If you are using Azure Container Registry you have this option: https://docs.microsoft.com/en-us/azure/container-registry/container-registry-firewall-access-rules
For other non-AKS repos using admission controllers or Azure Policy will also work.
Limiting or locking down egress traffic is also recommended: https://docs.microsoft.com/en-us/azure/aks/limit-egress-traffic
References
- https://docs.microsoft.com/security/benchmark/azure/security-controls-v2-asset-management#am-6-use-only-approved-applications-in-compute-resources
- https://docs.microsoft.com/en-us/azure/aks/limit-egress-traffic
- https://docs.microsoft.com/en-us/azure/container-registry/container-registry-firewall-access-rules
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 2.5 Allowlist Authorized Software | x | x | |
| v7 | 5.2 Maintain Secure Images | x | x | |
| v7 | 5.3 Securely Store Master Images | x | x |