---
title: >-
  Azure AKS clusters should use private cluster mode and disable the public
  control plane FQDN
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure AKS clusters should use private
  cluster mode and disable the public control plane FQDN
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure AKS clusters should use private cluster mode and disable the public control plane FQDN
 
## Description{% #description %}

This rule verifies that an Azure Kubernetes Service (AKS) cluster is configured as a private cluster and that the public control plane FQDN is disabled. Running the API server in private cluster mode keeps control-plane traffic on the private network, while disabling the public FQDN ensures that the cluster's control plane is not additionally exposed through a publicly resolvable name.

The evaluation inspects the cluster's `api_server_access_profile`:

- `enable_private_cluster` must be `true` so that the API server is provisioned with a private endpoint.
- `enable_private_cluster_public_fqdn` must be `false` (or unset) so that no public FQDN is generated for the private cluster control plane.

When both conditions are met the cluster is reported as **pass**; otherwise it is reported as **fail**.

## Rationale{% #rationale %}

Exposing the AKS control plane through a public FQDN increases the cluster's attack surface and may allow connection attempts from the public internet. Private cluster mode restricts API server access to the cluster's virtual network, and disabling the public FQDN removes a publicly resolvable entry point to the control plane.

## Remediation{% #remediation %}

Enable private cluster mode and disable the public control plane FQDN on the AKS cluster. Private cluster mode can only be configured at cluster creation time, while the public FQDN can be disabled on an existing private cluster. For step-by-step guidance, see the [Create a private Azure Kubernetes Service (AKS) cluster](https://learn.microsoft.com/en-us/azure/aks/private-clusters) documentation.

Confirm in the cluster's API server access profile that `enablePrivateCluster` is `true` and `enablePrivateClusterPublicFQDN` is `false`.

## References{% #references %}

- [Create a private Azure Kubernetes Service (AKS) cluster](https://learn.microsoft.com/en-us/azure/aks/private-clusters)
- [Configure private DNS zone for a private AKS cluster](https://learn.microsoft.com/en-us/azure/aks/private-clusters#configure-a-private-dns-zone)
- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)