last sync: 2025-Apr-29 17:44:12 Etc/UTC

Managed Clusters - Microsoft Azure Resource type
microsoft.containerservice/managedclusters

Azure Resource Provider Resource provider (RP) - Microsoft Container Service [Microsoft.ContainerService]
RP Microsoft.ContainerService
RP display name Microsoft Container Service
Azure Resource Type
RP Resource types
Resource types: 444
Azure Policy Alias
RP aliases
RP aliases: 918
Azure Policy definition
RP Azure Policy
Azure Policy definitions: 160
if: 160
then.deployment: 10
then.details: 0
then.existenceCondition: 0
then.operations: 0
Azure RBAC Role Based Access Control
RP RBAC operations
RP RBAC operations: 780
RP RBAC operationType action: 43
RP RBAC operationType delete: 150
RP RBAC operationType read: 422
RP RBAC operationType write: 165
Azure RBAC Role definition
RP RBAC Roles & Operation actions
Unique RBAC Roles: 35
RBAC Roles with action operationType: 19
RBAC Roles with delete operationType: 14
RBAC Roles with read operationType: 35
RBAC Roles with write operationType: 16
Azure Application
RP related 1st party Service Principals
RP related 1st party Service Principals: 4
• AzureContainerService (appId: 7319c514-987d-4e9b-ac3d-d38c4f427f4c)
• Azure Kubernetes Service AAD Server (appId: 6dae42f8-4368-4678-94ff-3960e28e3630) [ JSON;CSV]
• Azure Kubernetes Service - Fleet RP (appId: 609d2f62-527f-4451-bfd2-ac2c7850822c)
• AKS Deployment Safeguards (appId: 589ce44b-ca13-4384-89e2-dd4e642a4b37)
All Azure RPs Microsoft Learn
AzResourceTypesAdvertizer (Microsoft only)
Azure Resource Type Resource type (RT) - Managed Clusters [microsoft.containerservice/managedclusters]
RT information
RT microsoft.containerservice/managedclusters
RT display name Managed Clusters
RT type only
(without RP)
managedClusters
RT sub- Resource types sub-Resource types: 225
RT schema RT schema API versions: 87
All Microsoft Azure RTs AzResourceTypesAdvertizer
Aliases and Azure Policy
Azure Policy Alias
Aliases
aliases: 502
Azure Policy definition
Azure Policy
Azure Policy definitions: 158
if: 158
then.deployment: 9
then.details: 0
then.existenceCondition: 0
then.operations: 0
RBAC Operations and Roles & Roles related operation actions
Azure RBAC Role Based Access Control
RBAC operations
RBAC operations: 16
RBAC operationType action: 13
RBAC operationType delete: 1
RBAC operationType read: 1
RBAC operationType write: 1
Azure RBAC Role definition
RBAC Roles & Operation actions
Unique RBAC Roles: 25
RBAC Roles with action operationType: 5
RBAC Roles with delete operationType: 5
RBAC Roles with read operationType: 23
RBAC Roles with write operationType: 6
Capabilities & Locations
Azure Resource Diagnostic settings logs
Diagnostic logs
True
log-categories
Azure Resource Diagnostic settings metrics
Diagnostic metrics
True
metrics
Azure Customer-managed key
Customer-managed key (CMK) [experimental]
Unknown
Enforce Encryption with a customer-managed key (CMK) at scale
Azure Managed identity
System-Assigned-Resource-Identity
True
Azure Resource Mover
Cross-ResourceGroup-Resource-Move
False
Azure Resource Mover
Cross-Subscription-Resource-Move
False
Azure Resource Tags
Tags
True
Azure Extension
Extension
False
Azure Private Endpoint
Private-Endpoint
True
Azure Private Endpoint location Azure Private Endpoint location
Supported Locations for Private-Endpoint
Supported Locations for Private-Endpoint: 44
australiacentral, australiaeast, australiasoutheast, brazilsouth, canadacentral, canadaeast, centralindia, centralus, eastasia, eastus, eastus2, francecentral, germanywestcentral, indonesiacentral, israelcentral, italynorth, japaneast, japanwest, jioindiawest, koreacentral, koreasouth, mexicocentral, newzealandnorth, northcentralus, northeurope, norwayeast, polandcentral, qatarcentral, southafricanorth, southcentralus, southeastasia, southindia, spaincentral, swedencentral, switzerlandnorth, uaenorth, uksouth, ukwest, westcentralus, westeurope, westindia, westus, westus2, westus3
Non supported Locations for Private-Endpoint Non supported Locations for Private-Endpoint: 14
brazilus, eastusstg, centraluseuap, eastus2euap, southcentralusstg, southafricawest, australiacentral2, jioindiacentral, francesouth, germanynorth, norwaywest, switzerlandwest, uaecentral, brazilsoutheast
Azure location
Location
True
Azure Resource type location Azure Resource type location
Locations
Locations: 50
australiacentral, australiacentral2, australiaeast, australiasoutheast, brazilsouth, brazilsoutheast, canadacentral, canadaeast, centralindia, centralus, eastasia, eastus, eastus2, francecentral, francesouth, germanynorth, germanywestcentral, indonesiacentral, israelcentral, italynorth, japaneast, japanwest, koreacentral, koreasouth, mexicocentral, newzealandnorth, northcentralus, northeurope, norwayeast, norwaywest, polandcentral, qatarcentral, southafricanorth, southafricawest, southcentralus, southeastasia, southindia, spaincentral, swedencentral, switzerlandnorth, switzerlandwest, uaecentral, uaenorth, uksouth, ukwest, westcentralus, westeurope, westus, westus2, westus3
Not locations Not locations: 47
asia, asiapacific, australia, brazil, brazilus, canada, centraluseuap, centralusstage, eastasiastage, eastus2euap, eastus2stage, eastusstage, eastusstg, europe, france, germany, global, india, indonesia, israel, italy, japan, jioindiacentral, jioindiawest, korea, mexico, newzealand, northcentralusstage, norway, poland, qatar, singapore, southafrica, southcentralusstage, southcentralusstg, southeastasiastage, spain, sweden, switzerland, taiwan, uae, uk, unitedstates, unitedstateseuap, westindia, westus2stage, westusstage
Assessment tooling
Azure Advisor
Azure Advisor
Azure Advisor recommendations: 65
Cost [Medium] Consider Spot nodes for workloads that can handle interruptions
Cost [Medium] Enable Vertical Pod Autoscaler recommendation mode to rightsize resource requests and limits
Cost [Medium] Fine-tune the cluster autoscaler profile for rapid scale down and cost savings
Cost [Medium] Use Azure Kubernetes Service Cost Analysis
HighAvailability [High] Create a dedicated system node pool
HighAvailability [High] Enable Autoscaling for your system node pools
HighAvailability [High] Have at least 2 nodes in your system node pool
HighAvailability [High] Upgrade to Standard tier for mission-critical and production clusters
HighAvailability [Medium] Ensure B-series Virtual Machine's (VMs) are not used in production environments
HighAvailability [Medium] Use AKS Backup for a cluster with persistent volumes
OperationalExcellence [High] Deprecated Kubernetes APIs are found. Avoid using deprecated API.
OperationalExcellence [High] Monitoring addon workspace is deleted
OperationalExcellence [Low] Enable the Cluster Autoscaler
OperationalExcellence [Low] Use Ephemeral OS disk
OperationalExcellence [Low] Use the latest generation VM series such as Ddv5 series
OperationalExcellence [Medium] Disable the Application Routing Addon
OperationalExcellence [Medium] Enable Container Insights
OperationalExcellence [Medium] Expired ETCD cert
OperationalExcellence [Medium] Outdated Azure Linux (Mariner) OS SKUs Found
OperationalExcellence [Medium] Update cluster's service principal
OperationalExcellence [Medium] Use the Standard Load Balancer
Performance [Medium] Clusters with a Single Node Pool
Performance [Medium] Unsupported Kubernetes version is detected
Security [High] [Preview] Vulnerable Azure Kubernetes Service should be updated to resolve vulnerability findings
Security [High] Access to secret objects should be restricted on Azure Kubernetes Services (AKS) clusters
Security [High] Anonymous authentication should be disabled on nodes in Azure Kubernetes Service (AKS) clusters
Security [High] Azure Kubernetes Service clusters should have Defender profile enabled
Security [High] Azure Kubernetes Service clusters should have the Azure Policy add-on for Kubernetes installed
Security [High] Azure running container images should have vulnerabilities resolved
Security [High] Client certificate authentication should be enabled on nodes in Azure Kubernetes Services (AKS) clusters
Security [High] Container images should be deployed from trusted registries only
Security [High] Containers should only use allowed AppArmor profiles
Security [High] Explicit request authorization should be enabled on nodes in Azure Kubernetes Service (AKS) clusters
Security [High] Kubernetes API server should be configured with restricted access
Security [High] Kubernetes clusters should be accessible only over HTTPS
Security [High] Kubernetes clusters should disable automounting API credentials
Security [High] Kubernetes clusters should not grant CAPSYSADMIN security capabilities
Security [High] Network policies should be defined for namespaces in Azure Kubernetes Service (AKS) clusters
Security [High] Permissions to create pods should be restricted on Azure Kubernetes Services (AKS) clusters
Security [High] Private endpoint access should be enabled for the control plane in Azure Kubernetes Service (AKS) clusters
Security [High] Private nodes should be configured on Azure Kubernetes Service (AKS) clusters
Security [High] Public endpoints should be disabled on private Azure Kubernetes Service (AKS) clusters
Security [High] Role-Based Access Control should be used on Kubernetes Services
Security [High] Running containers as root user should be avoided
Security [High] Service account tokens should not be automatically mounted in Azure Kubernetes Service (AKS) cluster pods
Security [High] The cluster admin role should not be used in Azure Kubernetes Service (AKS) clusters
Security [High] Wildcards in roles should be removed in Azure Kubernetes Services (AKS) clusters
Security [Low] Automatic iptables management should be enabled on nodes in Azure Kubernetes Service (AKS) clusters
Security [Low] Diagnostic logs in Kubernetes services should be enabled
Security [Low] Ensure that the --eventRecordQPS argument is set to 0 or a level which ensures appropriate event capture
Security [Low] Kubernetes clusters should not use the default namespace
Security [Low] Server certificate rotation should be enabled on nodes in Azure Kubernetes Service (AKS) clusters
Security [Medium] CNI plugins should be configured on Azure Kubernetes Services (AKS) clusters
Security [Medium] Container CPU and memory limits should be enforced
Security [Medium] Container with privilege escalation should be avoided
Security [Medium] Containers sharing sensitive host namespaces should be avoided
Security [Medium] Default service accounts should not be used on Azure Kubernetes Service (AKS) clusters
Security [Medium] Idle timeout should be configured on nodes in Azure Kubernetes Service (AKS) clusters
Security [Medium] Immutable (read-only) root filesystem should be enforced for containers
Security [Medium] Least privileged Linux capabilities should be enforced for containers
Security [Medium] Network policy should be enabled for Azure Kubernetes Service (AKS) clusters
Security [Medium] Privileged containers should be avoided
Security [Medium] Services should listen on allowed ports only
Security [Medium] Usage of host networking and ports should be restricted
Security [Medium] Usage of pod HostPath volume mounts should be restricted to a known list to restrict node access from compromised containers
Azure Proactive Resilience Library v2 (APRLv2)
Azure Proactive Resilience Library v2 (APRLv2)
Azure Proactive Resilience Library v2 recommendations: 18
PSRule for Azure
PSRule for Azure
PSRule for Azure rules: 33
Cost Optimization [Important] kube-audit-admin
Operational Excellence [Awareness] Use valid AKS cluster DNS prefix
Operational Excellence [Awareness] Use valid AKS cluster names
Operational Excellence [Important] AKS clusters should collect platform diagnostic logs
Operational Excellence [Important] Enable AKS Container insights
Operational Excellence [Important] Kubernetes Cluster version is not automatically upgraded
Performance Efficiency [Important] AKS clusters use VM scale sets
Performance Efficiency [Important] Enable AKS cluster autoscaler
Performance Efficiency [Important] Nodes use a minimum number of pods
Performance Efficiency [Important] Use AKS Ephemeral OS disk
Performance Efficiency [Important] Use the Standard load balancer SKU
Reliability [Important] AKS clusters should use Availability zones in supported regions
Reliability [Important] AKS clusters using Azure CNI should use large subnets
Reliability [Important] Customer-controlled maintenance window configuration
Reliability [Important] Kubernetes Cluster version is old
Reliability [Important] Minimum number of nodes in a user node pool
Reliability [Important] Minimum number of system nodes in an AKS cluster
Reliability [Important] Upgrade AKS node pool version
Reliability [Important] Use AKS Uptime SLA
Security [Important] AKS clusters refresh secrets from Key Vault
Security [Important] AKS clusters should collect security-based audit logs
Security [Important] AKS clusters use Key Vault to store secrets
Security [Important] AKS clusters use RBAC
Security [Important] AKS network policies are not configured
Security [Important] Disable AKS local accounts
Security [Important] Disable HTTP application routing add-on
Security [Important] Enable AKS-managed Azure AD
Security [Important] Enable Defender profile
Security [Important] Kubernetes Cluster nodes are not automatically patched
Security [Important] Restrict access to AKS API server endpoints
Security [Important] Use Azure Policy Add-on with AKS clusters
Security [Important] Use Azure RBAC for Kubernetes Authorization
Security [Important] Use managed identities for AKS cluster authentication
Azure Quick Review (AZQR)
Azure Quick Review (AZQR)
Azure Quick Review (AZQR) recommendations: 25
DisasterRecovery [Low] Back up Azure Kubernetes Service
Governance [Low] AKS Name should comply with naming conventions
Governance [Low] AKS should have tags
Governance [Low] Enable and remediate Azure Policies configured for AKS
HighAvailability [High] AKS Cluster should have an SLA
HighAvailability [High] Configure system nodepool count
HighAvailability [High] Configure user nodepool count
HighAvailability [High] Deploy AKS cluster across availability zones
HighAvailability [High] Isolate system and application pods
HighAvailability [High] Nodepool subnet size needs to accommodate maximum auto-scale settings
HighAvailability [High] Update AKS tier to Standard or Premium
HighAvailability [High] Use Azure Linux for Linux nodepools
MonitoringAndAlerting [High] Enable AKS Monitoring
MonitoringAndAlerting [Low] AKS Cluster should have diagnostic settings enabled
OtherBestPractices [Low] Enable GitOps when using DevOps frameworks
Scalability [High] Enable the cluster auto-scaler on an existing cluster
Scalability [Low] AKS Node Pools should have MaxSurge set
Scalability [Medium] Configure Azure CNI networking for dynamic allocation of IPs or use CNI overlay
Scalability [Medium] Use Ephemeral OS disks on AKS clusters
Security [High] AKS Cluster should be private
Security [High] AKS should have outbound type set to user defined routing
Security [High] Disable local accounts
Security [Medium] AKS should be RBAC enabled.
Security [Medium] AKS should have httpApplicationRouting disabled
Security [Medium] AKS should integrate authentication with AAD (Managed)
Infrastructure as Code (IaC)
ARM (Azure Resource Manager)
ARM (Azure Resource Manager) templates
ARM (Azure Resource Manager) template API versions: 87
latest
Azure Bicep
Bicep templates
Bicep template API versions: 87
latest
Terraform
Terraform provider
Terraform providers: 1
kubernetes_cluster
AzAPI Terraform
AzAPI Terraform templates
AzAPI Terraform template API versions: 87
latest
Pulumi
Pulumi provider
Pulumi providers: 1
containerservice/managedcluster
OpenTofu
OpenTofu provider
OpenTofu TF providers: 1
kubernetes_cluster
Azure Verified Modules (AVM) Bicep Azure Verified Modules (AVM) Bicep
Azure Verified Modules (AVM) Bicep
Azure Kubernetes Service (AKS) Managed Cluster
Azure Verified Modules (AVM) Terraform Azure Verified Modules (AVM) Terraform
Azure Verified Modules (AVM) Terraform
• GitHub: AKS managed clusters
• Terraform registry: AKS managed clusters
REST-API (Representational State Transfer - Application Programming Interface)
REST-API versions REST-API versions: 71
2025-03-02-preview
2025-03-01
2025-02-02-preview
2025-02-01
2025-01-02-preview
2025-01-01
2024-10-02-preview
2024-10-01
2024-09-02-preview
2024-09-01
2024-08-02-preview
2024-08-01
2024-07-02-preview
2024-07-01
2024-06-02-preview
2024-06-01
2024-05-02-preview
2024-05-01
2024-04-02-preview
2024-03-02-preview
2024-02-02-preview
2024-02-01
2024-01-02-preview
2024-01-01
2023-11-02-preview
2023-11-01
2023-10-02-preview
2023-10-01
2023-09-02-preview
2023-09-01
2023-08-01
2023-07-01
2023-06-01
2023-05-01
2023-04-01
2023-03-01
2023-02-01
2023-01-01
2022-11-01
2022-09-01
2022-08-01
2022-07-01
2022-06-01
2022-04-01
2022-03-01
2022-02-01
2022-01-01
2021-10-01
2021-09-01
2021-08-01
2021-07-01
2021-05-01
2021-03-01
2021-02-01
2020-12-01
2020-11-01
2020-09-01
2020-07-01
2020-06-01
2020-04-01
2020-03-01
2020-02-01
2020-01-01
2019-11-01
2019-10-01
2019-08-01
2019-06-01
2019-04-01
2019-02-01
2018-03-31
2017-08-31
REST-API version default 2023-08-01
API profiles n/a
Resource naming
Azure Naming Tool
Azure Naming Tool
The Azure Naming Tool was created to help administrators define and manage their naming conventions, while providing a simple interface for users to generate a compliant name.
Resource naming details
{
  "property": "",
  "ShortName": "aks",
  "scope": "resource group",
  "lengthMin": "1",
  "lengthMax": "63",
  "validText": "Alphanumerics, underscores, and hyphens. Start and end with alphanumeric.",
  "invalidText": "",
  "invalidCharacters": "",
  "invalidCharactersStart": "",
  "invalidCharactersEnd": "",
  "invalidCharactersConsecutive": "",
  "regx": "^(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9_-]{0,61}[a-zA-Z0-9])$",
  "staticValues": ""
}