Kubernetes cluster nodes should prohibit public access
Ensure Kubernetes cluster nodes do not have public IP addresses. The control is non-compliant if Kubernetes cluster nodes have a public IP address assigned. AKS agent pools should use only private addressing.
Public node IPs expose worker VMs to Internet scanning and exploit attempts against OS or kubelet services. Successful compromise can lead to stolen secrets and images (confidentiality), workload tampering (integrity), and node/resource exhaustion via DDoS or cryptomining (availability).
What this control checks
AKS agent pool nodes must not have a public IP address (enableNodePublicIP=false).
Common pitfalls
Any pool with a public IP is flagged
Clusters where any pool assigns a public IP to nodes are identified.
Audit evidence
Evidence that deployed resources meet this control: Prowler check aks_clusters_created_with_private_nodes (prowler azure --checks aks_clusters_created_with_private_nodes); PowerPipe control azure_compliance.control.kubernetes_cluster_node_restrict_public_access.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...) and 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;).
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 11 Access control
RBI Cyber Security Framework for UCBs
- Annex I (1.1)
- 164.308(a)(1)(ii)(B) Risk management
Related controls
- Container Instance container groups should be in a virtual network
- Virtual machines should be in an approved virtual network
- Virtual machines should have management ports closed
- Managed disks should not have 'Disk Network Access' set to 'Enable public access from all networks'
- Network security groups should have HTTP(S) access from the internet evaluated and restricted
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_node_restrict_public_access - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_node_restrict_public_access - Prowler Check:
aks_clusters_created_with_private_nodes
Last reviewed: 2026-10-13