Microsoft ContainerService

Best practices and references below are based on published guidance from the cloud service provider and may reference native capabilities the cloud service provider offers. If you are not using the native security capabilities, the same security requirement can be met using other security capabilities your organization utilizes
Session Limits
Microsoft.ContainerService/managedClusters
Load Balancer Profile-Idle Timeout In Minutes
​Azure Resource Manager​
​Terraform​
​
Asset Inventory
Design Guidance:
Tag resources, resource groups, and subscriptions for logical organization - Azure Resource Manager
docsmsft
Microsoft.ContainerService/managedClusters
Agent Pool Profiles-Node Labels
​Azure Resource Manager​
​Terraform​
Agent Pool Profiles-Node Taints
​Azure Resource Manager​
​Terraform​
Agent Pool Profiles-Tags
​Azure Resource Manager​
​Terraform​
Tags
​Azure Resource Manager​
​Terraform​
Microsoft.ContainerService/managedClusters/agentPools
Node Labels
​Azure Resource Manager​
​Terraform​
Node Taints
​Azure Resource Manager​
​Terraform​
Tags
​Azure Resource Manager​
​Terraform​
​
Design for High Availability
Design Guidance:
Concepts - Scale applications in Azure Kubernetes Services (AKS) - Azure Kubernetes Service
docsmsft
Use availability zones in Azure Kubernetes Service (AKS) - Azure Kubernetes Service
docsmsft
Microsoft.ContainerService/managedClusters
Agent Pool Profiles-Availability Zones
​Azure Resource Manager​
​Terraform​
Agent Pool Profiles-Count
​Azure Resource Manager​
​Terraform​
Agent Pool Profiles-Enable Auto Scaling
​Azure Resource Manager​
​Terraform​
Agent Pool Profiles-Max Count
​Azure Resource Manager​
​Terraform​
Agent Pool Profiles-Max Pods
​Azure Resource Manager​
​Terraform​
Agent Pool Profiles-Min Count
​Azure Resource Manager​
​Terraform​
Auto Scaler Profile-Balance-similar-node-groups
​Azure Resource Manager​
​Terraform​
Auto Scaler Profile-Max-graceful-termination-sec
​Azure Resource Manager​
​Terraform​
Auto Scaler Profile-Scale-down-delay-after-add
​Azure Resource Manager​
​Terraform​
Auto Scaler Profile-Scale-down-delay-after-delete
​Azure Resource Manager​
​Terraform​
Auto Scaler Profile-Scale-down-delay-after-failure
​Azure Resource Manager​
​Terraform​
Auto Scaler Profile-Scale-down-unneeded-time
​Azure Resource Manager​
​Terraform​
Auto Scaler Profile-Scale-down-unready-time
​Azure Resource Manager​
​Terraform​
Auto Scaler Profile-Scale-down-utilization-threshold
​Azure Resource Manager​
​Terraform​
Auto Scaler Profile-Scan-interval
​Azure Resource Manager​
​Terraform​
Microsoft.ContainerService/managedClusters/agentPools
Availability Zones
​Azure Resource Manager​
​Terraform​
Count
​Azure Resource Manager​
​Terraform​
Enable Auto Scaling
​Azure Resource Manager​
​Terraform​
Max Count
​Azure Resource Manager​
​Terraform​
Min Count
​Azure Resource Manager​
​Terraform​
​
Hardening
Design Guidance:
Concepts - Security in Azure Kubernetes Services (AKS) - Azure Kubernetes Service
docsmsft
Azure Kubernetes Service (AKS) Ubuntu image alignment with Center for Internet Security (CIS) benchmark - Azure Kubernetes Service
docsmsft
Microsoft.ContainerService/managedClusters
Agent Pool Profiles-Os Type
​Azure Resource Manager​
​Terraform​
Microsoft.ContainerService/managedClusters/agentPools
Node Image Version
​Azure Resource Manager​
​Terraform​
Os Type
​Azure Resource Manager​
​Terraform​
​
Transparent Data Encryption
Design Guidance:
Enable host-based encryption on Azure Kubernetes Service (AKS) - Azure Kubernetes Service
docsmsft
Microsoft.ContainerService/managedClusters
Disk Encryption Set Id
​Azure Resource Manager​
​Terraform​
​
IP Whitelisting
Microsoft.ContainerService/managedClusters
Api Server Access Profile-Authorized Ipranges
​Azure Resource Manager​
​Terraform​
​
Deployment Security
Microsoft.ContainerService/managedClusters
Agent Pool Profiles-Orchestrator Version
​Azure Resource Manager​
​Terraform​
Microsoft.ContainerService/managedClusters/agentPools
Orchestrator Version
​Azure Resource Manager​
​Terraform​
​
Identification and Authentication
Design Guidance:
Best practices for managing identity - Azure Kubernetes Service
docsmsft
Microsoft.ContainerService/managedClusters
SSH-Public Keys
​Azure Resource Manager​
​Terraform​
Service Principal Profile-Client Id
​Azure Resource Manager​
​Terraform​
Service Principal Profile-Secret
​Azure Resource Manager​
​Terraform​
​
Subnet Isolation
Microsoft.ContainerService/managedClusters
Agent Pool Profiles-Enable Node Public Ip
​Azure Resource Manager​
​Terraform​
Agent Pool Profiles-Vnet Subnet Id
​Azure Resource Manager​
​Terraform​
​
Network Isolation and Segregation
Design Guidance:
Best practices for network resources - Azure Kubernetes Service
docsmsft
Microsoft.ContainerService/managedClusters
Api Server Access Profile-Enable Private Cluster
​Azure Resource Manager​
​Terraform​
Microsoft.ContainerService/managedClusters/agentPools
Enable Node Public Ip
​Azure Resource Manager​
​Terraform​
Mode
​Azure Resource Manager​
​Terraform​
Vnet Subnet Id
​Azure Resource Manager​
​Terraform​
​
Information Systems Enforcing Network Access
Design Guidance:
Secure pod traffic with network policy - Azure Kubernetes Service
docsmsft
Microsoft.ContainerService/managedClusters
Outbound Ips-Public Ips
​Azure Resource Manager​
​Terraform​
Network Profile-Network Policy
​Azure Resource Manager​
​Terraform​
​
Identity Lifecycle Management
Microsoft.ContainerService/managedClusters
Aad Profile-Admin Group Object Ids
​Azure Resource Manager​
​Terraform​
Aad Profile-Client App Id
​Azure Resource Manager​
​Terraform​
Aad Profile-Managed
​Azure Resource Manager​
​Terraform​
Aad Profile-Server App Id
​Azure Resource Manager​
​Terraform​
Aad Profile-Server App Secret
​Azure Resource Manager​
​Terraform​
Aad Profile-Tenant Id
​Azure Resource Manager​
​Terraform​
​
Utilize Role-based Access Control
Design Guidance:
Use Azure AD and Kubernetes RBAC for clusters - Azure Kubernetes Service
docsmsft
Manage Azure RBAC in Kubernetes From Azure - Azure Kubernetes Service
docsmsft
Microsoft.ContainerService/managedClusters
Aad Profile-Enable Azure Rbac
​Azure Resource Manager​
​Terraform​
Enable Rbac
​Azure Resource Manager​
​Terraform​
​
Use Enterprise Accounts and Disable Local Accounts
Microsoft.ContainerService/managedClusters
Identity-Type
​Azure Resource Manager​
​Terraform​
Additional Properties-Client Id
​Azure Resource Manager​
​Terraform​
Additional Properties-Object Id
​Azure Resource Manager​
​Terraform​
Additional Properties-Resource Id
​Azure Resource Manager​
​Terraform​
​
Patch Management
Design Guidance:
Upgrade an Azure Kubernetes Service (AKS) cluster - Azure Kubernetes Service
docsmsft
Microsoft.ContainerService/managedClusters
Kubernetes Version
​Azure Resource Manager​
​Terraform​
​

Microsoft Compute

Microsoft DevicesProvisioning

Last modified 7mo ago

Agent Pool Profiles-Node Labels	Azure Resource Manager	Terraform
Agent Pool Profiles-Node Taints	Azure Resource Manager	Terraform
Agent Pool Profiles-Tags	Azure Resource Manager	Terraform
Tags	Azure Resource Manager	Terraform

Node Labels	Azure Resource Manager	Terraform
Node Taints	Azure Resource Manager	Terraform
Tags	Azure Resource Manager	Terraform

Agent Pool Profiles-Availability Zones	Azure Resource Manager	Terraform
Agent Pool Profiles-Count	Azure Resource Manager	Terraform
Agent Pool Profiles-Enable Auto Scaling	Azure Resource Manager	Terraform
Agent Pool Profiles-Max Count	Azure Resource Manager	Terraform
Agent Pool Profiles-Max Pods	Azure Resource Manager	Terraform
Agent Pool Profiles-Min Count	Azure Resource Manager	Terraform
Auto Scaler Profile-Balance-similar-node-groups	Azure Resource Manager	Terraform
Auto Scaler Profile-Max-graceful-termination-sec	Azure Resource Manager	Terraform
Auto Scaler Profile-Scale-down-delay-after-add	Azure Resource Manager	Terraform
Auto Scaler Profile-Scale-down-delay-after-delete	Azure Resource Manager	Terraform
Auto Scaler Profile-Scale-down-delay-after-failure	Azure Resource Manager	Terraform
Auto Scaler Profile-Scale-down-unneeded-time	Azure Resource Manager	Terraform
Auto Scaler Profile-Scale-down-unready-time	Azure Resource Manager	Terraform
Auto Scaler Profile-Scale-down-utilization-threshold	Azure Resource Manager	Terraform
Auto Scaler Profile-Scan-interval	Azure Resource Manager	Terraform

Availability Zones	Azure Resource Manager	Terraform
Count	Azure Resource Manager	Terraform
Enable Auto Scaling	Azure Resource Manager	Terraform
Max Count	Azure Resource Manager	Terraform
Min Count	Azure Resource Manager	Terraform

Node Image Version	Azure Resource Manager	Terraform
Os Type	Azure Resource Manager	Terraform

SSH-Public Keys	Azure Resource Manager	Terraform
Service Principal Profile-Client Id	Azure Resource Manager	Terraform
Service Principal Profile-Secret	Azure Resource Manager	Terraform

Agent Pool Profiles-Enable Node Public Ip	Azure Resource Manager	Terraform
Agent Pool Profiles-Vnet Subnet Id	Azure Resource Manager	Terraform

Enable Node Public Ip	Azure Resource Manager	Terraform
Mode	Azure Resource Manager	Terraform
Vnet Subnet Id	Azure Resource Manager	Terraform

Outbound Ips-Public Ips	Azure Resource Manager	Terraform
Network Profile-Network Policy	Azure Resource Manager	Terraform

Aad Profile-Admin Group Object Ids	Azure Resource Manager	Terraform
Aad Profile-Client App Id	Azure Resource Manager	Terraform
Aad Profile-Managed	Azure Resource Manager	Terraform
Aad Profile-Server App Id	Azure Resource Manager	Terraform
Aad Profile-Server App Secret	Azure Resource Manager	Terraform
Aad Profile-Tenant Id	Azure Resource Manager	Terraform

Aad Profile-Enable Azure Rbac	Azure Resource Manager	Terraform
Enable Rbac	Azure Resource Manager	Terraform

Identity-Type	Azure Resource Manager	Terraform
Additional Properties-Client Id	Azure Resource Manager	Terraform
Additional Properties-Object Id	Azure Resource Manager	Terraform
Additional Properties-Resource Id	Azure Resource Manager	Terraform