Azure Compliance ControlsAzure Kubernetes Service
AKS clusters should have the Azure Policy Add-on installed and enabled
Azure Policy Add-on for Kubernetes service (AKS) extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA). It applies at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.
What this control checks
Checks whether each AKS cluster has the Azure Policy Add-on turned on
Framework mappings
The clauses this control is mapped to in each framework.
- Configuration Settings (CM-6)
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM-6 Configuration Settings
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_add_on_azure_policy_enabled - Checkov Check:
CKV_AZURE_116 - Powerpipe Controls:
azure_compliance.control.kubernetes_cluster_add_on_azure_policy_enabled,azure_compliance.control.kubernetes_cluster_addon_azure_policy_enabled - Azure Policy Definitions:
0a15ec92-a229-4763-bb14-0ea34a568f8d,a8eff44f-8c92-45c3-a3fb-9880802d67a7 - KICS Query:
43789711-161b-4708-b5bb-9d1c626f7492 - Trivy Check:
AZU-0066
Last reviewed: 2026-10-13