Kubernetes clusters should use Role-Based Access Control (RBAC)

Use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters. RBAC provides granular filtering on the actions that users can perform. Configure relevant authorization policies.

Without Kubernetes RBAC, authorization becomes overly broad, weakening least privilege. Compromised credentials could read secrets, alter workloads, or delete services, impacting confidentiality, integrity, and availability, and enabling lateral movement across the cluster.

What this control checks

Common pitfalls

Checkov evaluates a different attribute from azurerm 2.99.0

Checkov evaluates role_based_access_control/[0]/enabled for azurerm < 2.99.0. It evaluates role_based_access_control_enabled for azurerm >= 2.99.0.

Re-create the cluster when an existing one can't be changed

Re-create the cluster if the setting can't be changed on an existing one.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Role-Based Access Control (RBAC) should be used on Kubernetes Services" (ac4a19c2-fa67-49b4-8ae5-0b2e78c49457); Prowler check aks_cluster_rbac_enabled (prowler azure --checks aks_cluster_rbac_enabled); PowerPipe control azure_compliance.control.kubernetes_instance_rbac_enabled.

Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_5; KICS query "AKS RBAC Disabled" (86f92117-eed8-4614-9c6c-b26da20ff37f); Trivy check AZU-0042.

Framework-specific interpretation

PCI DSS v4.0: Mapped to 7.2.1 (Access to system components and data is appropriately defined and assigned.), 7.2.2 (Access to system components and data is appropriately defined and assigned.), 7.2.3 (Access to system components and data is appropriately defined and assigned.) and 7 more clauses.

NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;).

NIST SP 800-53 Rev 5: Mapped to AC-3(7) (Role-based Access Control).

Framework mappings

The clauses this control is mapped to in each framework.

PCI DSS v4.0

7.2.1: Access to system components and data is appropriately defined and assigned.
7.2.2: Access to system components and data is appropriately defined and assigned.
7.2.3: Access to system components and data is appropriately defined and assigned.
7.2.5: Access to system components and data is appropriately defined and assigned.
7.2.6: Access to system components and data is appropriately defined and assigned.

5 more clauses

7.3.1: Access to system components and data is managed via an access control system(s).
7.3.2: Access to system components and data is managed via an access control system(s).
7.3.3: Access to system components and data is managed via an access control system(s).
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
A3.4.1: Logical access to the cardholder data environment is controlled and managed.

NIS2 Directive (EU 2022/2555)

2 Risk management policy

NIST SP 800-53 Rev 5

AC-3(7): Role-Based Access Control

RBI Cyber Security Framework for UCBs

Annex I (1.1)

CMMC 2.0 Level 2

AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
AC.L2-3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts

HIPAA HITRUST v9.2