MEDIUM
Source
Trivy
ID
AVD-AZU-0065

Ensure AKS cluster has private cluster enabled

A public AKS API server endpoint increases exposure to unauthorized access or attack. Enable private cluster to ensure the API server endpoint is only accessible from within the virtual network.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Provision the AKS cluster with private_cluster_enabled = true and use private endpoints.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
resource "azurerm_kubernetes_cluster" "good_example" {
  name                = "example-aks"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  dns_prefix          = "exampleaks"

  private_cluster_enabled = true

  default_node_pool {
    name       = "default"
    node_count = 1
    vm_size    = "Standard_D2_v2"
  }
}