Skip to content

Repository navigation

Security: eknathdj/aks-assessment-repo

Security

docs/SECURITY.md

SECURITY — Policies, scans and remediation guidance

This project integrates Terraform scanning and container scanning at CI time. Remediation guidance for common findings:

Checkov / Terrascan

  • HIGH/CRITICAL findings must be fixed prior to merge. Common fixes:
    • Ensure private_cluster_enabled = true for AKS
    • Use managed identities and avoid client secrets in TF variables
    • Secure storage account for TF state with encryption + soft-delete
    • Avoid default NSG rules that allow wide ingress; lock down subnets

Container scanning (Trivy)

  • Fix by updating base images (use patch releases), remove vulnerable packages, or apply multi-stage builds to reduce attack surface.

Key Vault & Secrets

  • Do not store secrets in repo. Use Azure Key Vault and the Secrets Store CSI driver or Workload Identity for pod access.

If you need help resolving a specific scan result, consult the remediation note in the scan output (Checkov rule id maps to Bridgecrew docs).

There aren't any published security advisories