---
title: >-
  AKS containers should be denied the ability to allow privilege escalation via
  an enforced Azure Policy assignment
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > AKS containers should be denied the
  ability to allow privilege escalation via an enforced Azure Policy assignment
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# AKS containers should be denied the ability to allow privilege escalation via an enforced Azure Policy assignment
 
## Description{% #description %}

Each AKS cluster should be covered by an enforced Azure Policy assignment that prevents containers from being admitted with `allowPrivilegeEscalation` set to `true`. A container that allows privilege escalation can run processes that gain more privileges than their parent, weakening workload isolation and increasing the blast radius of a container compromise.

This rule evaluates each `azure_aks_cluster` and passes only when an `azure_policy_assignment` for the built-in "Kubernetes clusters should not allow container privilege escalation" definition both covers the cluster's scope (the cluster resource, its resource group, or its subscription) and has its enforcement mode set to `Default`. A cluster with no covering enforced assignment fails. Management-group-scoped assignments are not evaluated.

## Remediation{% #remediation %}

Assign the built-in "Kubernetes clusters should not allow container privilege escalation" policy to each subscription or resource group hosting AKS workloads, and set the enforcement mode to `Default` so the deny effect is applied. See [Azure Policy for Kubernetes](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes) for step-by-step guidance.

## References{% #references %}

- [Azure Policy built-in definitions for AKS](https://learn.microsoft.com/en-us/azure/aks/policy-reference)
- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)