Skip to content

limit-authorized-ips

Explanation

The API server is the central way to interact with and manage a cluster. To improve cluster security and minimize attacks, the API server should only be accessible from a limited set of IP address ranges.

Possible Impact

Any IP can interact with the API server

Suggested Resolution

Limit the access to the API server to a limited IP range

Insecure Example

The following example will fail the azure-container-limit-authorized-ips check.

resource "azurerm_kubernetes_cluster" "bad_example" {

}

Secure Example

The following example will pass the azure-container-limit-authorized-ips check.

resource "azurerm_kubernetes_cluster" "good_example" {
    api_server_authorized_ip_ranges = [
        "1.2.3.4/32"
    ]
}