Cis Aks V170 5.5.2
DevOps & Securitycis-aks-v170-5.5.2Cis Aks V170 5.5.2 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Use Azure RBAC for Kubernetes Authorization (Manual)
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_Azure_Kubernetes_Service_AKS_Benchmark_v1.7.0/cis-aks-v170-5.5.2/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aks-v170-5-5-2, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
5.5.2 Use Azure RBAC for Kubernetes Authorization (Manual)
Profile Applicability
- Level 2
Description
Azure RBAC for Kubernetes Authorization allows unified management and access control across Azure resources and AKS clusters. This feature enables Azure role assignments to directly control access to Kubernetes resources, providing a single pane of glass for managing both Azure and Kubernetes permissions.
Rationale
Using Azure RBAC for Kubernetes Authorization centralizes authorization management and provides consistent role-based access control across both Azure and Kubernetes resources. This reduces the complexity of managing separate RBAC systems and ensures that the principle of least privilege is enforced uniformly.
Audit
Verify that Azure RBAC for Kubernetes Authorization is enabled on the AKS cluster:
az aks show --name ${CLUSTER_NAME} --resource-group ${RESOURCE_GROUP} --query "aadProfile.enableAzureRbac"
The output should be true if Azure RBAC for Kubernetes Authorization is enabled.
Remediation
Enable Azure RBAC for Kubernetes Authorization on the AKS cluster:
az aks update --name ${CLUSTER_NAME} --resource-group ${RESOURCE_GROUP} --enable-azure-rbac
For new clusters:
az aks create \
--resource-group ${RESOURCE_GROUP} \
--name ${CLUSTER_NAME} \
--enable-aad \
--enable-azure-rbac
References
- https://docs.microsoft.com/en-us/azure/aks/manage-azure-rbac
- https://docs.microsoft.com/security/benchmark/azure/security-controls-v2-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.6 Centralize Account Management | x | x | |
| v8 | 6.8 Define and Maintain Role-Based Access Control | x | ||
| v7 | 16.2 Configure Centralized Point of Authentication | x | x |