Azure Compliance ControlsAzure Kubernetes Service
Kubernetes clusters should have logging enabled
Checkov CKV_AZURE_4, titled "Ensure AKS logging to Azure Monitoring is Configured", evaluates `azurerm_kubernetes_cluster` resources in Terraform code to verify that the Kubernetes cluster has logging to Azure Monitoring set up.
What this control checks
Kubernetes clusters must have logging enabled
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- PR.PS-04
- 10.1 Implement audit trails to link all access to system components to each individual user
- All actions taken by any individual with root or administrative privileges
- Creation and deletion of system- level objects
- Through interviews of responsible personnel, observation of audit logs, and examination of audit log settings
Related controls
- Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs
- Azure Monitor should have activity log collection enabled for all regions
- Search services should have resource logs enabled
- Flow log resources should have flow logging enabled
- Windows Azure Arc machines should have the Log Analytics extension installed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_logging_enabled - Checkov Check:
CKV_AZURE_4 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_logging_enabled
Last reviewed: 2026-10-13