A maximum of 3 owners should be designated for subscriptions
Categories:
2 minute read
Framework: BIO
Access to storage accounts with firewall and VNet config should be restricted
Categories:
Frameworks:
less than a minute
AKS nodes should have vulnerability findings resolved
Categories:
less than a minute
AKS OS and data disks should be encrypted by CMK
Categories:
Frameworks:
less than a minute
Audit diagnostic setting for selected resource types
Categories:
Frameworks:
less than a minute
Azure Automation accounts should use CMK for encryption at rest
Categories:
Frameworks:
less than a minute
Azure Container Instance should use CMK for encryption
Categories:
Frameworks:
less than a minute
Azure Databricks Clusters should disable public IP
Categories:
Frameworks:
less than a minute
Azure Databricks Workspaces should disable public network access
Categories:
Frameworks:
less than a minute
Azure Databricks Workspaces should use private link
Categories:
Frameworks:
less than a minute
Azure Key Vaults should use private link
Categories:
Frameworks:
less than a minute
Container CPU and memory limits should be enforced
Categories:
Frameworks:
less than a minute
Container images should be deployed from trusted registries only
Categories:
Frameworks:
less than a minute
Container registries should be encrypted with CMK
Categories:
Frameworks:
less than a minute
Container registries should not allow unrestricted network access
Categories:
Frameworks:
less than a minute
Container registries should use private link
Categories:
less than a minute
Container with privilege escalation should be avoided
Categories:
Frameworks:
less than a minute
Containers sharing sensitive host namespaces should be avoided
Categories:
Frameworks:
less than a minute
Diagnostic logs in Kubernetes services should be enabled
Categories:
less than a minute
Diagnostic logs in Service Bus should be enabled
Categories:
less than a minute
Immutable (read-only) root filesystem should be enforced for containers
Categories:
Frameworks:
less than a minute
Key vaults should have deletion protection enabled
Categories:
less than a minute
Kubernetes clusters should be accessible only over HTTPS
Categories:
Frameworks:
less than a minute
Kubernetes clusters should disable automounting API credentials
Categories:
Frameworks:
less than a minute
Kubernetes clusters should not use the default namespace
Categories:
less than a minute
Least privileged Linux capabilities should be enforced for containers
Categories:
Frameworks:
less than a minute
OS and data disks should be encrypted with customer-managed key (CMK)
Categories:
Frameworks:
less than a minute
Privileged containers should be avoided
Categories:
Frameworks:
less than a minute
Running containers as root user should be avoided
Categories:
Frameworks:
less than a minute
Saved-queries in Azure Monitor should be saved in customer storage account
Categories:
Frameworks:
less than a minute
Service Bus Premium namespaces should use CMK for encryption
Categories:
Frameworks:
less than a minute
Storage account should use a private link connection
Categories:
Frameworks:
less than a minute
Storage accounts should have infrastructure encryption
Categories:
Frameworks:
less than a minute
Storage accounts should restrict network access using VNet rules
Categories:
Frameworks:
less than a minute
Storage accounts should use CMK for encryption
Categories:
Frameworks:
less than a minute
Temp disks and cache for AKS agent node pools should be encrypted at host
Categories:
Frameworks:
less than a minute
Usage of host networking and ports should be restricted
Categories:
Frameworks:
less than a minute
Usage of pod HostPath volume mounts should be restricted
Categories:
Frameworks:
less than a minute
VMs and VMSS should have encryption at host enabled
Categories:
Frameworks:
less than a minute