Kubernetes clusters should have public access restrictions configured
Checks whether a Kubernetes cluster restricts public access. Per the Azure Policy, network traffic between the `API server` and the node pools remains on the private network only, so the cluster control plane is not reached over public routes.
A public AKS API server endpoint increases exposure to unauthorized access or attack. Enable private cluster to ensure the API server endpoint is only accessible from within the virtual network.
What this control checks
AKS clusters must have private cluster enabled (private_cluster_enabled = true).
Common pitfalls
Unset private_cluster_enabled fails the check
KICS flags azurerm_kubernetes_cluster with private_cluster_enabled set to false. A resource that does not set private_cluster_enabled at all is also flagged.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Kubernetes Service Private Clusters should be enabled" (040732e8-d947-40b8-95d6-854c95024bf8); Prowler check aks_clusters_public_access_disabled (prowler azure --checks aks_clusters_public_access_disabled); PowerPipe control azure_compliance.control.kubernetes_cluster_restrict_public_access.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_115; KICS query "AKS Private Cluster Disabled" (599318f2-6653-4569-9e21-041d06c63a89); Trivy check AZU-0065.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...).
PCI DSS v4.0: Mapped to 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.), 1.3.2 (Network access to and from the cardholder data environment is restricted.) and 2 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 2 Risk management policy
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_restrict_public_access - Checkov Check:
CKV_AZURE_115 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_restrict_public_access - Prowler Check:
aks_clusters_public_access_disabled - Azure Policy Definition:
040732e8-d947-40b8-95d6-854c95024bf8 - KICS Query:
599318f2-6653-4569-9e21-041d06c63a89 - Trivy Check:
AZU-0065
Last reviewed: 2026-10-13