Cluster Should Have Limited Service Account Access
More Info:
Ensures Kubernetes clusters are created with limited service account access scopes. Kubernetes service accounts should be limited in scope to the services necessary to operate the clusters.Risk Level
MediumAddress
SecurityCompliance Standards
CISGCPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Cluster Should Have Limited Service Account Access” for GCP using GCP console, follow these steps:
- Open the Google Kubernetes Engine (GKE) console.
- Select the cluster that needs to be remediated.
- Click on the “Security” tab.
- Scroll down to the “Service Accounts” section.
- Click on the “Edit” button.
- In the “Service Accounts” section, select the option “Limit service account access to this cluster”.
- Select the service account that needs access to the cluster.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Cluster Should Have Limited Service Account Access” for GCP using GCP CLI, you can follow the below steps:Step 1: Open the Cloud Shell from the GCP console or install the GCP CLI on your local machine.Step 2: Authenticate with your GCP account using the below command:Step 3: Set the project where the cluster is located using the below command:Step 4: Get the name of the cluster that needs to be remediated using the below command:Step 5: Fetch the current IAM policy for the cluster using the below command:Step 6: Identify the service accounts that have access to the cluster and need to be removed from the IAM policy.Step 7: Remove the service accounts from the IAM policy using the below command:Step 8: Verify the changes by fetching the updated IAM policy using the below command:By following these steps, you can remediate the misconfiguration “Cluster Should Have Limited Service Account Access” for GCP using GCP CLI.
Using Python
Using Python
To remediate the misconfiguration “Cluster Should Have Limited Service Account Access” for GCP using Python, follow these steps:
-
Install the required libraries:
-
Authenticate to GCP:
-
Retrieve the cluster object:
-
Update the cluster’s
master_authfield to limit service account access: -
Verify that the update was successful:
<...>) with your own values.