azure_scan_aks_full
Run comprehensive security scans on Azure AKS clusters with multiple modes including live API analysis, IMDS exploitation, pod identity, and admission controller bypass detection.
Instructions
🚀 COMPREHENSIVE AKS SECURITY SCAN - Flexible AKS security analysis with multiple scan modes: 'full' (all checks), 'live' (K8s API analysis), 'imds' (IMDS exploitation), 'pod_identity' (identity analysis), 'admission' (admission controller bypass). Covers cluster security, RBAC, secrets, service accounts, IMDS access, identity risks, and policy violations.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| subscriptionId | Yes | Azure subscription ID | |
| resourceGroup | Yes | Resource group containing the AKS cluster | |
| clusterName | Yes | AKS cluster name | |
| scanMode | No | Scan mode: 'full' (all security checks), 'live' (live K8s API scanning), 'imds' (IMDS exploitation), 'pod_identity' (Pod Identity/Workload Identity analysis), 'admission' (admission controller bypass detection) | |
| namespace | No | Specific namespace to scan (for live/imds modes, scans all if not specified) | |
| podName | No | Specific pod to execute from (for imds mode, auto-selects if not specified) | |
| deepScan | No | Enable deep resource enumeration (for imds mode). Default: true | |
| testDataPlane | No | Test actual data plane access (for imds mode). Default: true | |
| exportTokens | No | Export stolen tokens to temp file (for imds mode). Default: false | |
| deepDataPlane | No | Actually READ secret values, DOWNLOAD blob contents (for imds mode). Default: false | |
| scanAllPods | No | Scan ALL pods cluster-wide for IMDS exposure (for imds mode). Default: false | |
| format | No | Output format: 'markdown' (default, human-readable) or 'json' (machine-readable) |