Project: KICS (Provisioning / Security & Compliance)
File: 2583fab1-953b-4fae-bd02-4a136a6c21f9.md

title: AKS With Authorized IP Ranges Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2583fab1-953b-4fae-bd02-4a136a6c21f9 Query name: AKS With Authorized IP Ranges Disabled Platform: AzureResourceManager Severity: <span style="color:#edd57e">Low</span> Category: Networking and Firewall URL: Azure Kubernetes Service must have an authorized IP range for API Services enabled<br> ```json title="Positive test num. 1 - json file" hl_lines="8" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2017-08-31", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" } } } ] } ``` ```json title="Positive test num. 2 - json file" hl_lines="39" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2020-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" }, "apiServerAccessProfile": { "authorizedIPRanges": [] } } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` ```json title="Positive test num. 3 - json file" hl_lines="6" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2019-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" } } } ] } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="36" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2019-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" }, "apiServerAuthorizedIPRanges": [] } } ] } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="6" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2020-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion":

"dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" } } } ] } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="37" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2020-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" }, "apiServerAccessProfile": { "authorizedIPRanges": [] } } } ] } ``` </details> <details><summary>Positive test num. 7 - json file</summary> ```json hl_lines="10" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2017-08-31", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" } } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> <details><summary>Positive test num. 8 - json file</summary> ```json hl_lines="8" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2019-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" } } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> <details><summary>Positive test num. 9 - json file</summary> ```json hl_lines="38" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2019-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" }, "apiServerAuthorizedIPRanges": [] } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> <details><summary>Positive test num. 10 - json file</summary> ```json hl_lines="8" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion":

"resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2020-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" } } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> ```json title="Negative test num. 1 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2020-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" }, "apiServerAccessProfile": { "authorizedIPRanges": [ "192.168.0.1", "192.168.0.18" ] } } } ] } ``` ```json title="Negative test num. 2 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2019-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" }, "apiServerAuthorizedIPRanges": [ "192.168.0.1", "192.168.0.18" ] } } ] } ``` ```json title="Negative test num. 3 - json file" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2020-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" }, "apiServerAccessProfile": { "authorizedIPRanges": [ "192.168.0.1", "192.168.0.18" ] } } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "aksCluster1", "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2019-02-01", "location": "[resourceGroup().location]", "properties": { "kubernetesVersion": "1.15.7", "dnsPrefix": "dnsprefix", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "Standard_A1", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "adminUserName", "ssh": { "publicKeys": [ { "keyData": "keyData" } ] } }, "servicePrincipalProfile": { "clientId": "servicePrincipalAppId", "secret": "servicePrincipalAppPassword" }, "apiServerAuthorizedIPRanges": [ "192.168.0.1", "192.168.0.18" ] } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details>