Skip to content

Commit ee59940

Browse files
GeekMasherGeekMasher
committed
feat: Add AKS Queries
1 parent 3a49f5a commit ee59940

12 files changed

+632
-0
lines changed

‎ql/src/security/CWE-284/AKSPublicNetworkAccess.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# AKS cluster with public network access enabled
2+
3+
Azure Kubernetes Service (AKS) clusters with public network access enabled can be accessed from any public IP address, which may expose the cluster to potential attackers on the internet.
4+
5+
## Problem statement
6+
7+
When public network access is enabled on an AKS cluster (which is the default setting), the Kubernetes API server is accessible from the internet. This increases the attack surface of the cluster and makes it vulnerable to various attacks including brute force attempts, exploitation of known vulnerabilities, and unauthorized access attempts.
8+
9+
## Recommendation
10+
11+
Disable public network access by setting the `publicNetworkAccess` property to `'Disabled'` and enable private cluster access using `apiServerAccessProfile.enablePrivateCluster` set to `true`. This ensures that the Kubernetes API server is only accessible from within your virtual network.
12+
13+
```bicep
14+
resource aksCluster 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
15+
name: 'secureAksCluster'
16+
location: location
17+
properties: {
18+
// Other properties...
19+
publicNetworkAccess: 'Disabled'
20+
apiServerAccessProfile: {
21+
enablePrivateCluster: true
22+
}
23+
// Other properties...
24+
}
25+
}
26+
```
27+
28+
## Example
29+
30+
### Insecure configuration (Public network access enabled)
31+
32+
```bicep
33+
resource aksClusterInsecure 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
34+
name: 'aksClusterInsecure'
35+
location: location
36+
properties: {
37+
kubernetesVersion: '1.24.9'
38+
dnsPrefix: 'aksdns'
39+
publicNetworkAccess: 'Enabled' // Insecure: Public network access is enabled
40+
// Default with no apiServerAccessProfile is also insecure
41+
// Other properties...
42+
}
43+
}
44+
```
45+
46+
### Secure configuration (Public network access disabled)
47+
48+
```bicep
49+
resource aksClusterSecure 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
50+
name: 'aksClusterSecure'
51+
location: location
52+
properties: {
53+
kubernetesVersion: '1.24.9'
54+
dnsPrefix: 'aksdns'
55+
publicNetworkAccess: 'Disabled' // Secure: Public network access is disabled
56+
apiServerAccessProfile: {
57+
enablePrivateCluster: true // Secure: Private cluster is enabled
58+
}
59+
// Other properties...
60+
}
61+
}
62+
```
63+
64+
## References
65+
66+
* [Azure Kubernetes Service (AKS) network concepts](https://learn.microsoft.com/en-us/azure/aks/concepts-network)
67+
* [Create a private AKS cluster](https://learn.microsoft.com/en-us/azure/aks/private-clusters)

‎ql/src/security/CWE-284/AKSPublicNetworkAccess.ql‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/**
2+
* @name AKS cluster with public network access enabled
3+
* @description Detects Azure Kubernetes Service (AKS) clusters with public network access enabled, which can expose the cluster to potential unauthorized access.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 6.5
7+
* @precision high
8+
* @id bicep/aks-public-network-access
9+
* @tags security
10+
* bicep
11+
* azure
12+
* CWE-284
13+
*/
14+
15+
import codeql.bicep.frameworks.Microsoft.AKS
16+
17+
from AKS::ManagedContainerResource resource, AKS::ManagedContainerProperties::Properties properties
18+
where
19+
properties = resource.getProperties() and
20+
(
21+
(
22+
exists(properties.getPublicNetworkAccess()) and
23+
properties.getPublicNetworkAccess().getValue().toLowerCase() = "enabled"
24+
) or
25+
not exists(properties.getPublicNetworkAccess()) // Default is "enabled" if not specified
26+
) and
27+
// Exclude clusters that have private API server enabled
28+
(
29+
not exists(properties.getApiServerAccessProfile()) or
30+
not exists(properties.getApiServerAccessProfile().getEnablePrivateCluster()) or
31+
properties.getApiServerAccessProfile().enablePrivateCluster() = false
32+
)
33+
select resource, "AKS cluster has public network access enabled, which can expose the cluster to unauthorized access."

‎ql/src/security/CWE-284/AKSRbacDisabled.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# AKS cluster with RBAC disabled
2+
3+
Azure Kubernetes Service (AKS) clusters should have Role-Based Access Control (RBAC) enabled to properly restrict access to cluster resources based on user roles and permissions.
4+
5+
## Problem statement
6+
7+
When RBAC is disabled in AKS, anyone with access to the cluster can potentially perform any action on any resource within the cluster. This creates a significant security vulnerability as there's no fine-grained access control to protect sensitive operations.
8+
9+
## Recommendation
10+
11+
Always enable RBAC for AKS clusters by setting `enableRBAC` to `true` in your Bicep template:
12+
13+
```bicep
14+
resource aksCluster 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
15+
name: 'secureAksCluster'
16+
location: location
17+
properties: {
18+
// Other properties...
19+
enableRBAC: true
20+
// Other properties...
21+
}
22+
}
23+
```
24+
25+
## Example
26+
27+
### Insecure configuration (RBAC disabled)
28+
29+
```bicep
30+
resource aksClusterInsecure 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
31+
name: 'aksClusterInsecure'
32+
location: location
33+
properties: {
34+
kubernetesVersion: '1.24.9'
35+
dnsPrefix: 'aksdns'
36+
enableRBAC: false // Insecure: RBAC is disabled
37+
// Other properties...
38+
}
39+
}
40+
```
41+
42+
### Secure configuration (RBAC enabled)
43+
44+
```bicep
45+
resource aksClusterSecure 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
46+
name: 'aksClusterSecure'
47+
location: location
48+
properties: {
49+
kubernetesVersion: '1.24.9'
50+
dnsPrefix: 'aksdns'
51+
enableRBAC: true // Secure: RBAC is enabled
52+
// Other properties...
53+
}
54+
}
55+
```
56+
57+
## References
58+
59+
* [Azure Kubernetes Service RBAC](https://learn.microsoft.com/en-us/azure/aks/concepts-identity#kubernetes-rbac)
60+
* [Security best practices for AKS](https://learn.microsoft.com/en-us/azure/aks/security-best-practices)

‎ql/src/security/CWE-284/AKSRbacDisabled.ql‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* @name AKS cluster with RBAC disabled
3+
* @description Detects Azure Kubernetes Service (AKS) clusters where RBAC is disabled, which can lead to unauthorized access to the cluster.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 7.5
7+
* @precision high
8+
* @id bicep/aks-rbac-disabled
9+
* @tags security
10+
* bicep
11+
* azure
12+
* CWE-284
13+
*/
14+
15+
import codeql.bicep.frameworks.Microsoft.AKS
16+
17+
from AKS::ManagedContainerResource resource, AKS::ManagedContainerProperties::Properties properties
18+
where
19+
properties = resource.getProperties() and
20+
(
21+
// RBAC is explicitly disabled
22+
exists(properties.getEnableRBAC()) and
23+
properties.getEnableRBAC().getBool() = false
24+
)
25+
select resource, "AKS cluster has RBAC disabled, which can lead to unauthorized access to the cluster."

‎ql/src/security/CWE-306/AKSLocalAccountsEnabled.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# AKS cluster with local accounts enabled
2+
3+
Azure Kubernetes Service (AKS) clusters should have local Kubernetes accounts disabled in favor of Azure Active Directory (Azure AD) integration for stronger authentication controls.
4+
5+
## Problem statement
6+
7+
When local accounts are enabled in AKS clusters:
8+
9+
1. Authentication relies on locally stored credentials rather than centralized Azure AD identities
10+
2. User access management is more manual and error-prone
11+
3. Central audit and monitoring of access is more difficult
12+
4. Advanced security features like Conditional Access policies cannot be applied
13+
14+
## Recommendation
15+
16+
Disable local accounts in AKS clusters by setting `disableLocalAccounts` to `true` and configure Azure AD integration:
17+
18+
```bicep
19+
resource aksCluster 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
20+
name: 'secureAksCluster'
21+
location: location
22+
properties: {
23+
// Other properties...
24+
disableLocalAccounts: true
25+
aadProfile: {
26+
managed: true
27+
enableAzureRBAC: true
28+
}
29+
// Other properties...
30+
}
31+
}
32+
```
33+
34+
## Example
35+
36+
### Insecure configuration (Local accounts enabled)
37+
38+
```bicep
39+
resource aksClusterInsecure 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
40+
name: 'aksClusterInsecure'
41+
location: location
42+
properties: {
43+
kubernetesVersion: '1.24.9'
44+
dnsPrefix: 'aksdns'
45+
disableLocalAccounts: false // Insecure: Local accounts are explicitly enabled
46+
// Or omitting disableLocalAccounts entirely (defaults to false)
47+
// Other properties...
48+
}
49+
}
50+
```
51+
52+
### Secure configuration (Local accounts disabled)
53+
54+
```bicep
55+
resource aksClusterSecure 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
56+
name: 'aksClusterSecure'
57+
location: location
58+
properties: {
59+
kubernetesVersion: '1.24.9'
60+
dnsPrefix: 'aksdns'
61+
disableLocalAccounts: true // Secure: Local accounts are disabled
62+
aadProfile: {
63+
managed: true
64+
enableAzureRBAC: true
65+
}
66+
// Other properties...
67+
}
68+
}
69+
```
70+
71+
## References
72+
73+
* [Use Azure AD with AKS](https://learn.microsoft.com/en-us/azure/aks/managed-aad)
74+
* [AKS best practices for authentication and authorization](https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-identity)

‎ql/src/security/CWE-306/AKSLocalAccountsEnabled.ql‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* @name AKS cluster with local accounts enabled
3+
* @description Detects Azure Kubernetes Service (AKS) clusters with local accounts enabled, which can lead to weaker authentication controls.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 5.0
7+
* @precision high
8+
* @id bicep/aks-local-accounts-enabled
9+
* @tags security
10+
* bicep
11+
* azure
12+
* CWE-306
13+
*/
14+
15+
import codeql.bicep.frameworks.Microsoft.AKS
16+
17+
from AKS::ManagedContainerResource resource, AKS::ManagedContainerProperties::Properties properties
18+
where
19+
properties = resource.getProperties() and
20+
(
21+
not exists(properties.getDisableLocalAccounts()) or
22+
properties.getDisableLocalAccounts().getBool() = false
23+
)
24+
select resource, "AKS cluster has local accounts enabled, which can lead to weaker authentication controls compared to Azure AD-backed authentication."

‎ql/src/security/CWE-311/AKSWithoutDiskEncryption.md‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# AKS cluster without disk encryption
2+
3+
Azure Kubernetes Service (AKS) clusters should utilize disk encryption to protect sensitive data at rest. Without disk encryption, data stored on node disks could be vulnerable to unauthorized access if the storage is compromised.
4+
5+
## Problem statement
6+
7+
When an AKS cluster is configured without disk encryption:
8+
9+
1. Node VM disks including OS disks and data disks could store data in an unencrypted format
10+
2. In case of physical theft, hardware decommissioning, or improper disk handling, sensitive data might be exposed
11+
3. Security and compliance requirements (like HIPAA, PCI DSS, or GDPR) may be violated
12+
4. If a node is compromised, an attacker may be able to access data directly from the disk
13+
14+
## Recommendation
15+
16+
Configure disk encryption for your AKS cluster by setting a disk encryption set ID:
17+
18+
```bicep
19+
resource diskEncryptionSet 'Microsoft.Compute/diskEncryptionSets@2022-07-02' = {
20+
name: 'myDiskEncryptionSet'
21+
location: location
22+
identity: {
23+
type: 'SystemAssigned'
24+
}
25+
properties: {
26+
activeKey: {
27+
keyUrl: keyVault.getSecret('encryptionKey').id
28+
}
29+
}
30+
}
31+
32+
resource aksCluster 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
33+
name: 'secureAksCluster'
34+
location: location
35+
properties: {
36+
// Other properties...
37+
diskEncryptionSetID: diskEncryptionSet.id
38+
// Other properties...
39+
}
40+
}
41+
```
42+
43+
## Example
44+
45+
### Insecure configuration (No disk encryption)
46+
47+
```bicep
48+
resource aksClusterInsecure 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
49+
name: 'aksClusterInsecure'
50+
location: location
51+
properties: {
52+
kubernetesVersion: '1.24.9'
53+
dnsPrefix: 'aksdns'
54+
// Missing diskEncryptionSetID
55+
// Other properties...
56+
}
57+
}
58+
```
59+
60+
### Secure configuration (With disk encryption)
61+
62+
```bicep
63+
resource aksClusterSecure 'Microsoft.ContainerService/managedClusters@2023-02-02-preview' = {
64+
name: 'aksClusterSecure'
65+
location: location
66+
properties: {
67+
kubernetesVersion: '1.24.9'
68+
dnsPrefix: 'aksdns'
69+
diskEncryptionSetID: diskEncryptionSet.id // Secure: Using disk encryption
70+
// Other properties...
71+
}
72+
}
73+
```
74+
75+
## References
76+
77+
* [Azure Disk Encryption for AKS clusters](https://learn.microsoft.com/en-us/azure/aks/azure-disk-customer-managed-keys)
78+
* [Data encryption in AKS](https://learn.microsoft.com/en-us/azure/aks/concepts-data-encryption)

‎ql/src/security/CWE-311/AKSWithoutDiskEncryption.ql‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* @name AKS cluster without disk encryption
3+
* @description Detects Azure Kubernetes Service (AKS) clusters without disk encryption, which can expose sensitive data.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 6.0
7+
* @precision high
8+
* @id bicep/aks-without-disk-encryption
9+
* @tags security
10+
* bicep
11+
* azure
12+
* CWE-311
13+
*/
14+
15+
import codeql.bicep.frameworks.Microsoft.AKS
16+
import bicep
17+
18+
from AKS::ManagedContainerResource resource, AKS::ManagedContainerProperties::Properties properties
19+
where
20+
properties = resource.getProperties() and
21+
not exists(properties.getDiskEncryptionSetID())
22+
select resource, "AKS cluster is configured without disk encryption, which can expose sensitive data at rest."

0 commit comments

Comments
 (0)