> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure audit aks rbac enabled remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of enabling Role-Based Access Control (RBAC) within Azure Kubernetes Services, you can follow the below steps using the Azure console: 1. Open the Azure Portal and navigate to the Azure Kubernetes Service (AKS) cluster that needs to be remediated. 2. Click on the "Access Control (IAM)" option from the left-hand menu. 3. Click on the "Add" button and select "Add role assignment" from the dropdown menu. 4. In the "Add role assignment" blade, select the desired role from the "Role" dropdown menu. For example, "Owner", "Contributor" or "Reader". 5. In the "Select" box, search for the user or group that needs to be assigned the role. 6. Click on the "Save" button to assign the role to the selected user or group. 7. Repeat steps 4 to 6 to assign roles to other users or groups as needed. 8. Once all the roles have been assigned, click on the "Save" button to save the changes. By following these steps, you will be able to enable Role-Based Access Control (RBAC) within Azure Kubernetes Services and remediate the misconfiguration. # To enable Role-Based Access Control (RBAC) within Azure Kubernetes Services (AKS) using AZURE CLI, please follow the below steps: Step 1: Open the Azure CLI and login to your Azure account using the command: ``` az login ``` Step 2: Once you are logged in, set the subscription that contains the AKS cluster using the command: ``` az account set --subscription ``` Step 3: After setting the subscription, enable RBAC on the AKS cluster using the following command: ``` az aks update --resource-group --name --enable-rbac ``` Step 4: Verify that RBAC is enabled on the AKS cluster using the following command: ``` az aks show --resource-group --name --query "servicePrincipalProfile.role" ``` If the output of the above command is "Contributor", it means that RBAC is enabled on the AKS cluster. By following the above steps, you can enable Role-Based Access Control (RBAC) within Azure Kubernetes Services (AKS) using AZURE CLI. To enable Role-Based Access Control (RBAC) within Azure Kubernetes Services using python, you can follow the below steps: 1. Import the required libraries and authenticate to Azure using the Azure Identity library. ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.containerservice import ContainerServiceClient from azure.mgmt.authorization import AuthorizationManagementClient from azure.mgmt.authorization.models import RoleAssignmentCreateParameters credential = DefaultAzureCredential() container_service_client = ContainerServiceClient(credential, subscription_id) authorization_client = AuthorizationManagementClient(credential, subscription_id) ``` 2. Get the resource group and AKS cluster details. ```python theme={null} resource_group_name = "" cluster_name = "" cluster = container_service_client.managed_clusters.get(resource_group_name, cluster_name) ``` 3. Create a role assignment for the AKS cluster. ```python theme={null} role_definition_id = "/subscriptions/{0}/providers/Microsoft.Authorization/roleDefinitions/{}".format(subscription_id, "b24988ac-6180-42a0-ab88-20f7382dd24c") # Contributor Role ID principal_id = "" # Principal ID of the user or group to whom the role is assigned role_assignment_parameters = RoleAssignmentCreateParameters(role_definition_id=role_definition_id, principal_id=principal_id) result = authorization_client.role_assignments.create(resource_group_name, role_assignment_name, role_assignment_parameters) ``` Note: In the above code, replace the values of ``, ``, `` with the actual values. 4. Verify the role assignment by listing all the role assignments for the resource group. ```python theme={null} role_assignments = authorization_client.role_assignments.list_for_resource_group(resource_group_name) for role_assignment in role_assignments: print(role_assignment.name) ``` This will list all the role assignments for the resource group. You can verify that the role assignment created in step 3 is present in the list. By following the above steps, you can enable Role-Based Access Control (RBAC) within Azure Kubernetes Services using python. ```hcl theme={null} resource "azurerm_kubernetes_cluster" "AKS_CLUSTER" { name = "AKS_CLUSTER_NAME" # replace with your AKS cluster name location = azurerm_resource_group.RG.location resource_group_name = azurerm_resource_group.RG.name dns_prefix = "AKS_DNS_PREFIX" # replace with your DNS prefix sku_tier = "Free" default_node_pool { name = "system" node_count = 1 vm_size = "Standard_DS2_v2" } identity { type = "SystemAssigned" } // This enables Kubernetes RBAC on the cluster role_based_access_control_enabled = true // Optional but recommended: integrate with Azure AD for RBAC azure_active_directory_role_based_access_control { managed = true admin_group_object_ids = ["AAD_GROUP_OBJECT_ID"] # replace with Azure AD group object IDs azure_rbac_enabled = false } } ``` Enabling `role_based_access_control_enabled` on an existing `azurerm_kubernetes_cluster` generally forces replacement of the AKS cluster; plan for downtime and data migration before applying. For Azure App Service, this specific RBAC setting does not apply; RBAC for App Service is configured via Azure role assignments, not via an AKS-style flag in Terraform. After updating Terraform, `terraform plan` should show `role_based_access_control_enabled` changing from `false` (or null) to `true` on the AKS cluster (and creation/update of the `azure_active_directory_role_based_access_control` block if added).