Kubernetes clusters should have logging enabled
Checkov CKV_AZURE_4, titled "Ensure AKS logging to Azure Monitoring is Configured", evaluates `azurerm_kubernetes_cluster` resources in Terraform code to verify that the Kubernetes cluster has logging to Azure Monitoring set up.
What this control checks
Kubernetes clusters must have logging enabled
Common pitfalls
Two provider paths are checked
The check reads addon_profile/[0]/oms_agent/[0]/enabled for provider version 2. It reads oms_agent/[0]/log_analytics_workspace_id for provider version 3.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.kubernetes_cluster_logging_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_4.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.SC-07 (The risks posed by a supplier, their products and services, and other third parties are understood, recorded...), GV.SC-09 (Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their...) and PR.PS-04 (Log records are generated and made available for continuous monitoring.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- PR.PS-04
- 10.1 Implement audit trails to link all access to system components to each individual user
- All actions taken by any individual with root or administrative privileges
- Creation and deletion of system- level objects
- Through interviews of responsible personnel, observation of audit logs, and examination of audit log settings
Related controls
- Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs
- Azure Monitor should have activity log collection enabled for all regions
- Search services should have resource logs enabled
- Flow log resources should have flow logging enabled
- Windows Azure Arc machines should have the Log Analytics extension installed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_logging_enabled - Checkov Check:
CKV_AZURE_4 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_logging_enabled
Last reviewed: 2026-10-13