Aqua Vulnerability Database

    Get Demo

    Vulnerabilities
    Misconfiguration
    Runtime Security
    Compliance
    Compliance > Kubernetes

    Apply Security Context to Your Pods and Containers

    Audit log aging

    Audit log path is configure

    Audit policy is configure (Manual)

    AWS CIS Foundations V1.2 1.2

    AWS CIS Foundations V1.4 1.4

    Check encryption provider

    Check that encryption resource has been set

    CIS ACK 1.0

    CIS AKS 1.0

    CIS EKS 1.0.1

    CIS EKS 1.1.0

    CIS EKS Stig Kubernetes V1r6

    CIS GKE 1.0

    CIS GKE 1.2.0

    CIS Redhat 0.7

    CIS Redhat 1.0

    CIS 1.20

    CIS 1.23

    CIS 1.24

    CIS 1.25

    CIS 1.5

    CIS 1.6

    CIS 1.6 K3s

    CIS Docker Community Edition Benchmark V1.1.0 1.1.0

    CIS Kubernetes Benchmarks V1.23 1.23

    Client certificate authentication should not be used for users (Manual)

    Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)

    Consider external secret storage (Manual)

    Control plan disable insecure port (Manual)

    Create administrative boundaries between resources using namespaces (Manual)

    disable-unused-credentials

    disable-unused-credentials-45-days

    enable-access-analyzer

    enable-all-regions

    enable-object-read-logging

    enable-object-write-logging

    Encrypt etcd communication

    enforce-root-hardware-mfa

    enforce-root-mfa

    enforce-root-mfa

    enforce-user-mfa

    Ensure a user for the container has been created

    Ensure Content trust for Docker is Enabled (Manual)

    Ensure COPY is used instead of ADD in Dockerfile

    Ensure HEALTHCHECK instructions have been added to the container image

    Ensure kube config file permission (Manual)

    Ensure secrets are not stored in Dockerfiles (Manual)

    Ensure setuid and setgid permissions are removed in the images (Manual)

    Ensure that a minimal audit policy is created (Manual)

    Ensure that all Namespaces have Network Policies defined

    Ensure that containers use trusted base images (Manual)

    Ensure that Service Account Tokens are only mounted where necessary

    Ensure that the --anonymous-auth argument is set to false

    Ensure that the --anonymous-auth argument is set to false

    Ensure that the --audit-log-maxage argument is set to 30 or as appropriate

    Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate

    Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate

    Ensure that the --audit-log-path argument is set

    Ensure that the --authorization-mode argument includes Node

    Ensure that the --authorization-mode argument includes RBAC

    Ensure that the --authorization-mode argument is not set to AlwaysAllow

    Ensure that the --authorization-mode argument is not set to AlwaysAllow

    Ensure that the --auto-tls argument is not set to true

    Ensure that the --bind-address argument is set to 127.0.0.1

    Ensure that the --bind-address argument is set to 127.0.0.1

    Ensure that the --cert-file and --key-file arguments are set as appropriate

    Ensure that the --client-ca-file argument is set appropriate

    Ensure that the --client-ca-file argument is set as appropriate

    Ensure that the --client-cert-auth argument is set to true

    Ensure that the --DenyServiceExternalIPs is not set

    Ensure that the --encryption-provider-config argument is set as appropriate

    Ensure that the --etcd-cafile argument is set as appropriate

    Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate

    Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture

    Ensure that the --hostname-override argument is not set

    Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root

    Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive

    Ensure that the --kubelet-certificate-authority argument is set as appropriate

    Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate

    Ensure that the --kubelet-https argument is set to true

    Ensure that the --make-iptables-util-chains argument is set to true

    Ensure that the --peer-auto-tls argument is not set to true

    Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate

    Ensure that the --peer-client-cert-auth argument is set to true

    Ensure that the --profiling argument is set to false

    Ensure that the --profiling argument is set to false

    Ensure that the --protect-kernel-defaults argument is set to true

    Ensure that the --root-ca-file argument is set as appropriate

    Ensure that the --rotate-certificates argument is not set to false

    Ensure that the --secure-port argument is not set to 0

    Ensure that the --service-account-key-file argument is set as appropriate

    Ensure that the --service-account-lookup argument is set to true

    Ensure that the --service-account-private-key-file argument is set as appropriate

    Ensure that the --streaming-connection-idle-timeout argument is not set to 0

    Ensure that the --terminated-pod-gc-threshold argument is set as appropriate

    Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate

    Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate

    Ensure that the --token-auth-file parameter is not set

    Next >>
    Aqua Container Security
    Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
    Copyright © 2023 Aqua Security Software Ltd.   Privacy Policy | Terms of Use