Azure security baseline for Azure Arc enabled Kubernetes
Članak
This security baseline applies guidance from the Microsoft cloud security benchmark version 1.0 to Azure Arc enabled Kubernetes. The Microsoft cloud security benchmark provides recommendations on how you can secure your cloud solutions on Azure. The content is grouped by the security controls defined by the Microsoft cloud security benchmark and the related guidance applicable to Azure Arc enabled Kubernetes.
You can monitor this security baseline and its recommendations using Microsoft Defender for Cloud. Azure Policy definitions will be listed in the Regulatory Compliance section of the Microsoft Defender for Cloud portal page.
When a feature has relevant Azure Policy Definitions, they are listed in this baseline to help you measure compliance with the Microsoft cloud security benchmark controls and recommendations. Some recommendations may require a paid Microsoft Defender plan to enable certain security scenarios.
Description: Service supports deployment into customer's private Virtual Network (VNet). Learn more.
Supported
Enabled By Default
Configuration Responsibility
True
True
Microsoft
Feature notes: The Arc enabled Kubernetes goal is to extend Azure's control plane to the customer environment. The services operate within the customer's network.
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Description: Service network traffic respects Network Security Groups rule assignment on its subnets. Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Configuration Guidance: This feature is not supported to secure this service.
NS-2: Secure cloud services with network controls
Features
Azure Private Link
Description: Service native IP filtering capability for filtering network traffic (not to be confused with NSG or Azure Firewall). Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Feature notes: The customer needs to configure private link support. This feature is about to go public preview.
Configuration Guidance: This feature is not supported to secure this service.
Disable Public Network Access
Description: Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch. Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Configuration Guidance: This feature is not supported to secure this service.
Local Authentication Methods for Data Plane Access
Description: Local authentications methods supported for data plane access, such as a local username and password. Learn more.
Supported
Enabled By Default
Configuration Responsibility
True
True
Microsoft
Feature notes: Avoid the usage of local authentication methods or accounts, these should be disabled wherever possible. Instead use Azure AD to authenticate where possible.
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
IM-3: Manage application identities securely and automatically
Features
Managed Identities
Description: Data plane actions support authentication using managed identities. Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Configuration Guidance: This feature is not supported to secure this service.
Service Principals
Description: Data plane supports authentication using service principals. Learn more.
Supported
Enabled By Default
Configuration Responsibility
True
True
Microsoft
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
IM-7: Restrict resource access based on conditions
Features
Conditional Access for Data Plane
Description: Data plane access can be controlled using Azure AD Conditional Access Policies. Learn more.
Supported
Enabled By Default
Configuration Responsibility
True
False
Customer
Configuration Guidance: By using the Azure RBAC feature, you can use Azure Active Directory (Azure AD) and role assignments in Azure to control authorization checks on the cluster. This implies that you can now use Azure role assignments to granularly control who can read, write, and delete Kubernetes objects like deployment, pod, and service.
You can add further configuration to enable conditional access. See reference link below.
PA-1: Separate and limit highly privileged/administrative users
Features
Local Admin Accounts
Description: Service has the concept of a local administrative account. Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Configuration Guidance: This feature is not supported to secure this service.
PA-7: Follow just enough administration (least privilege) principle
Features
Azure RBAC for Data Plane
Description: Azure Role-Based Access Control (Azure RBAC) can be used to managed access to service's data plane actions. Learn more.
Supported
Enabled By Default
Configuration Responsibility
True
False
Customer
Configuration Guidance: Azure Arc-enabled Kubernetes supports on-premises and other cloud environments that are integrated with different identity and access management systems. In addition to existing Kubernetes cluster role-based access control (RBAC), Azure Arc-enabled Kubernetes supports Azure RBAC to unify access management across Kubernetes clusters and minimize operational overhead.
Note: The Azure RBAC feature for data plane operations can only be configured on Kubernetes clusters that allow configuration of their API servers. This feature is not supported for managed clusters such as EKS and GKE.
DP-1: Discover, classify, and label sensitive data
Features
Sensitive Data Discovery and Classification
Description: Tools (such as Azure Purview or Azure Information Protection) can be used for data discovery and classification in the service. Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Configuration Guidance: This feature is not supported to secure this service.
DP-3: Encrypt sensitive data in transit
Features
Data in Transit Encryption
Description: Service supports data in-transit encryption for data plane. Learn more.
Supported
Enabled By Default
Configuration Responsibility
True
True
Microsoft
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
DP-4: Enable data at rest encryption by default
Features
Data at Rest Encryption Using Platform Keys
Description: Data at-rest encryption using platform keys is supported, any customer content at rest is encrypted with these Microsoft managed keys. Learn more.
Supported
Enabled By Default
Configuration Responsibility
True
True
Microsoft
Feature notes: We use Cosmos DB to store service data, which is encrypted at rest by default.
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
DP-5: Use customer-managed key option in data at rest encryption when required
Features
Data at Rest Encryption Using CMK
Description: Data at-rest encryption using customer-managed keys is supported for customer content stored by the service. Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Feature notes: Since we do not store customer data at rest for more than 48 hours, we have not added support for CMK.
Configuration Guidance: This feature is not supported to secure this service.
DP-6: Use a secure key management process
Features
Key Management in Azure Key Vault
Description: The service supports Azure Key Vault integration for any customer keys, secrets, or certificates. Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Feature notes: While this feature doesn't need to be "enabled", the customer does need to configure the AKV cluster extension to leverage this feature.
This feature is also in preview.
Configuration Guidance: This feature is not supported to secure this service.
DP-7: Use a secure certificate management process
Features
Certificate Management in Azure Key Vault
Description: The service supports Azure Key Vault integration for any customer certificates. Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Feature notes: While the feature doesn't need to be "enabled", the customer does need to configure the AKV cluster extension to leverage this feature.
This feature is also in preview.
Configuration Guidance: This feature is not supported to secure this service.
Description: Service has an offering-specific Microsoft Defender solution to monitor and alert on security issues. Learn more.
Supported
Enabled By Default
Configuration Responsibility
True
False
Customer
Feature notes: While this feature does not need to be "enabled", the customer does need to configure the Defender cluster extension to leverage this feature.
Configuration Guidance: Microsoft Defender for Cloud is a cloud-native tool that allows for implementation of guardrails, controls, reports, alerts and remediation tasks in an automated fashion at scale. By combining it with Azure Arc-enabled Kubernetes, you can extend security checks to any Kubernetes cluster in your on-premises and/or multi-cloud environment.
Description: Service produces resource logs that can provide enhanced service-specific metrics and logging. The customer can configure these resource logs and send them to their own data sink like a storage account or log analytics workspace. Learn more.
Supported
Enabled By Default
Configuration Responsibility
False
Not Applicable
Not Applicable
Feature notes: We do not have support to push service (Arc agentry) logs and metrics to a customer owned LA/data sink; however, a customer can configure the Container Insights cluster extension to push customer workload logs and metrics to LA.
Configuration Guidance: This feature is not supported to secure this service.
Learn about the benefits of and how to onboard Azure Arc-enabled servers to Microsoft Defender for Cloud, Microsoft Defender for Servers, and Microsoft Sentinel.
Demonstrate the skills needed to implement security controls, maintain an organization’s security posture, and identify and remediate security vulnerabilities.