Azure Compliance ControlsAzure Kubernetes Service
Kubernetes clusters should use Role-Based Access Control (RBAC)
Use Role-Based Access Control (RBAC) to manage permissions in Kubernetes Service Clusters. RBAC provides granular filtering on the actions that users can perform. Configure relevant authorization policies.
What this control checks
Kubernetes clusters should use Role-Based Access Control (RBAC)
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.3: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.2.6: Access to system components and data is appropriately defined and assigned.
5 more clauses
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 2 Risk management policy
- AC-3(7): Role-Based Access Control
RBI Cyber Security Framework for UCBs
- Annex I (1.1)
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- AC.L2-3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts
- 1153.01c3System.35-01.c 01.02 Authorized Access to Information Systems
- 1229.09c1Organizational.1-09.c 09.01 Documented Operating Procedures
- 164.308(a)(4)(ii)(B) Access authorization
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_instance_rbac_enabled - Checkov Check:
CKV_AZURE_5 - Powerpipe Control:
azure_compliance.control.kubernetes_instance_rbac_enabled - Prowler Check:
aks_cluster_rbac_enabled - Azure Policy Definition:
ac4a19c2-fa67-49b4-8ae5-0b2e78c49457 - KICS Query:
86f92117-eed8-4614-9c6c-b26da20ff37f - Trivy Check:
AZU-0042
Last reviewed: 2026-10-13