Control: Authorized IP ranges should be defined on Kubernetes Services
Description
ARestrict access to the Kubernetes Service Management API by granting API access only to IP addresses in specific ranges. It is recommended to limit access to authorized IP ranges to ensure that only applications from allowed networks can access the cluster.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.kubernetes_cluster_authorized_ip_range_definedSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.kubernetes_cluster_authorized_ip_range_defined --shareSQL
This control uses a named query:
select c.id as resource, case when api_server_access_profile -> 'AuthorizedIPRanges' is not null then 'ok' else 'alarm' end as status, case when api_server_access_profile -> 'AuthorizedIPRanges' is not null then c.title || ' authorized IP ranges defined.' else c.title || ' authorized IP ranges not defined.' end as reason , c.resource_group as resource_group , sub.display_name as subscriptionfrom azure_kubernetes_cluster as c, azure_subscription as subwhere sub.subscription_id = c.subscription_id;