VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

Each AKS cluster should be covered by an enforced Azure Policy assignment that prevents containers from being admitted with allowPrivilegeEscalation set to true. A container that allows privilege escalation can run processes that gain more privileges than their parent, weakening workload isolation and increasing the blast radius of a container compromise.

This rule evaluates each azure_aks_cluster and passes only when an azure_policy_assignment for the built-in “Kubernetes clusters should not allow container privilege escalation” definition both covers the cluster’s scope (the cluster resource, its resource group, or its subscription) and has its enforcement mode set to Default. A cluster with no covering enforced assignment fails. Management-group-scoped assignments are not evaluated.

Remediation

Assign the built-in “Kubernetes clusters should not allow container privilege escalation” policy to each subscription or resource group hosting AKS workloads, and set the enforcement mode to Default so the deny effect is applied. See Azure Policy for Kubernetes for step-by-step guidance.

References

• Azure Policy built-in definitions for AKS
• CIS Kubernetes Benchmark