Security Posture Findings for Kubernetes and AI Services
Security findings are posture checks on live workloads and AI services, listed in the same queue as the cost work they sit next to.
The security category was added alongside the Kubernetes workload rules, and it is where ZopNight reports posture risks that are not configuration-hygiene items. Like compliance, a security finding has no dollar figure and is written in prose. Severity carries the weight instead: a privileged container is rated critical.
Kubernetes workloads
The same rule set runs on EKS, GKE and AKS, instantiated once per cloud. It reads the workload specs ZopNight discovers from each cluster:
- Privileged Container (critical), Container Running As Root and Container With Host Network on Deployments, StatefulSets and DaemonSets.
- Ingress Without TLS on Ingress objects.
- Service Type LoadBalancer and Service Type NodePort, which expose a workload outside the cluster.
These are the checks behind privileged container risk and the broader Kubernetes workload rules. They sit next to the cost findings for the same cluster in Kubernetes cost management.
AI and ML services
- Bedrock Agent Without Guardrail fires on an agent with no guardrail attached.
- Bedrock Guardrail Missing PII / Sensitive-Information Protection reads the guardrail’s own PII setting.
- GCP Vertex AI Workbench Notebook Has Public IP and Secure Boot Disabled cover notebook exposure.
Storage keys
Azure Storage Account Not Using Customer-Managed Key Encryption was deliberately re-scoped. Azure storage is always encrypted at rest, so the finding is about who owns the key, which is a compliance-framework question, not an “encryption is off” alarm.
Handling a finding
Security findings are advisory. The drawer shows why the rule fired and how to fix it, and a finding can be sent to Jira as a ticket whose status stays in sync with the recommendation. Before changing a workload, the blast radius view shows which connected resources a change would touch. For configuration items such as encryption, MFA and public access, see compliance findings; for workload health, reliability findings.
The full per-cloud rule lists are in AWS, GCP and Azure recommendations.
Every security check ZopNight runs has its own page, with the reason it fires and the fix: see the security checks in the ZopNight rule catalogue.