Severity Framework
CCSS (Common Configuration Scoring System) is a set of measures used to determine the severity of the rule.
Snyk CCSS
Rule category
Each rule is associated with a high-level category. For example IAM, Container, Monitoring, Logging, Network, etc.
Network/ Public Access
Is your environment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-ControlsCSA-CCMSOC-2
- Snyk IDSNYK-CC-00514
- creditSnyk Research Team
Description
The Kubernetes API server could be accessible by anyone, which increases attack vector reachability.
How to fix?
Set properties.apiServerAccessProfile.authorizedIPRanges attribute to specific range e.g. 10.0.0.0/16.
Set api_server_authorized_ip_ranges attribute to specific range, e.g. 10.0.0.0/16.
- For AzureRM provider < v4.0.0 set the
api_server_authorized_ip_rangesattribute to a specific range. Note theapi_server_authorized_ip_rangesattribute was deprecated in v3.39.0. - For AzureRM provider >= v4.0.0 set the
api_server_access_profile.authorized_ip_rangesattribute to a specific range.
Example Configuration
# For AzureRM provider < v4.0.0
resource "azurerm_kubernetes_cluster" "allowed" {
name = "example-aks514"
location = azurerm_resource_group.example514.location
resource_group_name = azurerm_resource_group.example514.name
dns_prefix = "exampleaks514"
default_node_pool {
name = "default"
node_count = 1
vm_size = "Standard_D2_v2"
}
identity {
type = "SystemAssigned"
}
api_server_authorized_ip_ranges = ["10.0.0.0/16"]
}
# For AzureRM provider >= v4.0.0
resource "azurerm_kubernetes_cluster" "allowed" {
name = "example-aks514"
location = azurerm_resource_group.example514.location
resource_group_name = azurerm_resource_group.example514.name
dns_prefix = "exampleaks514"
default_node_pool {
name = "default"
node_count = 1
vm_size = "Standard_D2_v2"
}
identity {
type = "SystemAssigned"
}
api_server_access_profile {
authorized_ip_ranges = ["10.0.0.0/16"]
}
}