Skip to main content

Enable Role-Based Access Control (RBAC) Within Azure

More Info:​

Ensure that RBAC is enabled on all Azure Kubernetes Services Instances

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS AZURE
  • Cloudanix Best Practice
  • HITRUST CSF
  • SOC2

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of enabling Role-Based Access Control (RBAC) within Azure Kubernetes Services, you can follow the below steps using the Azure console:

  1. Open the Azure Portal and navigate to the Azure Kubernetes Service (AKS) cluster that needs to be remediated.

  2. Click on the "Access Control (IAM)" option from the left-hand menu.

  3. Click on the "Add" button and select "Add role assignment" from the dropdown menu.

  4. In the "Add role assignment" blade, select the desired role from the "Role" dropdown menu. For example, "Owner", "Contributor" or "Reader".

  5. In the "Select" box, search for the user or group that needs to be assigned the role.

  6. Click on the "Save" button to assign the role to the selected user or group.

  7. Repeat steps 4 to 6 to assign roles to other users or groups as needed.

  8. Once all the roles have been assigned, click on the "Save" button to save the changes.

By following these steps, you will be able to enable Role-Based Access Control (RBAC) within Azure Kubernetes Services and remediate the misconfiguration.

Using CLI

To enable Role-Based Access Control (RBAC) within Azure Kubernetes Services (AKS) using AZURE CLI, please follow the below steps:

Step 1: Open the Azure CLI and login to your Azure account using the command:

az login

Step 2: Once you are logged in, set the subscription that contains the AKS cluster using the command:

az account set --subscription <subscription-id>

Step 3: After setting the subscription, enable RBAC on the AKS cluster using the following command:

az aks update --resource-group <resource-group-name> --name <aks-cluster-name> --enable-rbac

Step 4: Verify that RBAC is enabled on the AKS cluster using the following command:

az aks show --resource-group <resource-group-name> --name <aks-cluster-name> --query "servicePrincipalProfile.role"

If the output of the above command is "Contributor", it means that RBAC is enabled on the AKS cluster.

By following the above steps, you can enable Role-Based Access Control (RBAC) within Azure Kubernetes Services (AKS) using AZURE CLI.

Using Python

To enable Role-Based Access Control (RBAC) within Azure Kubernetes Services using python, you can follow the below steps:

  1. Import the required libraries and authenticate to Azure using the Azure Identity library.
from azure.identity import DefaultAzureCredential
from azure.mgmt.containerservice import ContainerServiceClient
from azure.mgmt.authorization import AuthorizationManagementClient
from azure.mgmt.authorization.models import RoleAssignmentCreateParameters

credential = DefaultAzureCredential()
container_service_client = ContainerServiceClient(credential, subscription_id)
authorization_client = AuthorizationManagementClient(credential, subscription_id)
  1. Get the resource group and AKS cluster details.
resource_group_name = "<resource-group-name>"
cluster_name = "<aks-cluster-name>"

cluster = container_service_client.managed_clusters.get(resource_group_name, cluster_name)
  1. Create a role assignment for the AKS cluster.
role_definition_id = "/subscriptions/{0}/providers/Microsoft.Authorization/roleDefinitions/{}".format(subscription_id, "b24988ac-6180-42a0-ab88-20f7382dd24c") # Contributor Role ID
principal_id = "<principal-id>" # Principal ID of the user or group to whom the role is assigned

role_assignment_parameters = RoleAssignmentCreateParameters(role_definition_id=role_definition_id, principal_id=principal_id)

result = authorization_client.role_assignments.create(resource_group_name, role_assignment_name, role_assignment_parameters)

Note: In the above code, replace the values of <resource-group-name>, <aks-cluster-name>, <principal-id> with the actual values.

  1. Verify the role assignment by listing all the role assignments for the resource group.
role_assignments = authorization_client.role_assignments.list_for_resource_group(resource_group_name)

for role_assignment in role_assignments:
    print(role_assignment.name)

This will list all the role assignments for the resource group. You can verify that the role assignment created in step 3 is present in the list.

By following the above steps, you can enable Role-Based Access Control (RBAC) within Azure Kubernetes Services using python.

Using Terraform
resource "azurerm_kubernetes_cluster" "AKS_CLUSTER" {
  name                = "AKS_CLUSTER_NAME"          # replace with your AKS cluster name
  location            = azurerm_resource_group.RG.location
  resource_group_name = azurerm_resource_group.RG.name
  dns_prefix          = "AKS_DNS_PREFIX"            # replace with your DNS prefix
  sku_tier            = "Free"

  default_node_pool {
    name       = "system"
    node_count = 1
    vm_size    = "Standard_DS2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  // This enables Kubernetes RBAC on the cluster
  role_based_access_control_enabled = true

  // Optional but recommended: integrate with Azure AD for RBAC
  azure_active_directory_role_based_access_control {
    managed                = true
    admin_group_object_ids = ["AAD_GROUP_OBJECT_ID"] # replace with Azure AD group object IDs
    azure_rbac_enabled     = false
  }
}

Enabling role_based_access_control_enabled on an existing azurerm_kubernetes_cluster generally forces replacement of the AKS cluster; plan for downtime and data migration before applying.

For Azure App Service, this specific RBAC setting does not apply; RBAC for App Service is configured via Azure role assignments, not via an AKS-style flag in Terraform.

After updating Terraform, terraform plan should show role_based_access_control_enabled changing from false (or null) to true on the AKS cluster (and creation/update of the azure_active_directory_role_based_access_control block if added).

Additional Reading:​