For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/ansible-azure-aks-network-policy-misconfigured.md.
A documentation index is available at /llms.txt.
AKS clusters must have a network policy configured to enforce pod-to-pod network isolation and the principle of least privilege. Without a network policy, pods can communicate freely, increasing the risk of lateral movement and unintended access to services.
For Ansible resources using azure.azcollection.azure_rm_aks or azure_rm_aks, the network_profile.network_policy property must be defined and set to either calico or azure. Tasks that omit network_profile or network_profile.network_policy, or that set the property to any value other than calico or azure, are flagged.
Secure example Ansible task:
- name:Create AKS cluster with network policyazure.azcollection.azure_rm_aks:name:my-aks-clusterresource_group:my-rgdns_prefix:myaksnetwork_profile:network_policy:calico
