Azure Compliance ControlsAzure Kubernetes Service
Kubernetes cluster nodes should prohibit public access
Ensure Kubernetes cluster nodes do not have public IP addresses. The control is non-compliant if Kubernetes cluster nodes have a public IP address assigned. AKS agent pools should use only private addressing.
What this control checks
AKS agent pool nodes must not have a public IP address (enableNodePublicIP=false).
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 11 Access control
RBI Cyber Security Framework for UCBs
- Annex I (1.1)
- 164.308(a)(1)(ii)(B) Risk management
Related controls
- Container Instance container groups should be in a virtual network
- Virtual machines should be in an approved virtual network
- Virtual machines should have management ports closed
- Managed disks should not have 'Disk Network Access' set to 'Enable public access from all networks'
- Network security groups should have HTTP(S) access from the internet evaluated and restricted
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_node_restrict_public_access - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_node_restrict_public_access - Prowler Check:
aks_clusters_created_with_private_nodes
Last reviewed: 2026-10-13