Azure Compliance ControlsAzure Kubernetes Service
Kubernetes clusters should have the Azure Policy add-on enabled
Ensure that AKS uses Azure Policies Add-on. The add-on extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA). It is used to enforce compliance and governance policies on the cluster.
What this control checks
AKS cluster must have the Azure Policy add-on enabled (azure_policy_enabled set to true).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_addon_azure_policy_enabled - Checkov Check:
CKV_AZURE_116 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_addon_azure_policy_enabled - Azure Policy Definitions:
0a15ec92-a229-4763-bb14-0ea34a568f8d,a8eff44f-8c92-45c3-a3fb-9880802d67a7 - KICS Query:
43789711-161b-4708-b5bb-9d1c626f7492 - Trivy Check:
AZU-0066
Last reviewed: 2026-10-13