Ensure GKE Clusters Are Not Using Default Service Account
More Info:
Create and use minimally privileged Service accounts to run GKE cluster nodes instead of using the Compute Engine default Service account. Unnecessary permissions could be abused in the case of a node compromise.Risk Level
CriticalAddress
Security, Operational Excellence, Best PracticeCompliance Standards
HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Ensure GKE Clusters Are Not Using Default Service Account” in GCP using GCP console, please follow the below steps:Step 1: Login to GCP console (https://console.cloud.google.com/).Step 2: Navigate to Kubernetes Engine and select the cluster that is using the default service account.Step 3: Click on the “Edit” button at the top of the page.Step 4: Scroll down to the “Node Pools” section and click on the “default-pool” node pool.Step 5: Under the “Node pool details” section, click on the “Edit” button.Step 6: Scroll down to the “Security” section and expand it.Step 7: Under the “Service account” section, select “Create a new service account”.Step 8: In the “Service account name” field, enter a name for the new service account.Step 9: In the “Service account ID” field, enter a unique ID for the new service account.Step 10: Click on the “Save” button to save the changes.Step 11: Repeat the above steps for all the node pools that are using the default service account.Step 12: Once all the node pools have been updated, click on the “Save” button at the bottom of the page to save the changes to the cluster.By following these steps, the misconfiguration “Ensure GKE Clusters Are Not Using Default Service Account” will be remediated for GCP using GCP console.
Using CLI
Using CLI
To remediate the misconfiguration “Ensure GKE Clusters Are Not Using Default Service Account” for GCP using GCP CLI, follow the below steps:
- Open the Cloud Shell from the GCP console.
-
Run the following command to list all the GKE clusters in your project:
- Identify the GKE cluster that is using the default service account.
-
Run the following command to get the details of the GKE cluster:
Replace [CLUSTER_NAME] with the name of the GKE cluster that you identified in step 3.
-
Check the output for the field
serviceAccountundernodePools. If the value isdefault, then the GKE cluster is using the default service account. -
To remediate this misconfiguration, you need to create a new service account and then assign it to the GKE cluster. Run the following command to create a new service account:
Replace [SA-NAME] with the name of the new service account and [SA-DISPLAY-NAME] with a display name for the service account.
-
Run the following command to assign the new service account to the GKE cluster:
Replace [CLUSTER_NAME] with the name of the GKE cluster, [ZONE] with the zone in which the cluster is located, and [SA-EMAIL] with the email address of the new service account.
-
Verify that the new service account is assigned to the GKE cluster by running the command in step 4 again and checking the value of the
serviceAccountfield.
Using Python
Using Python
To remediate the misconfiguration “Ensure GKE Clusters Are Not Using Default Service Account” in GCP, you can follow these steps using Python:Note: You will need to have the necessary IAM permissions to create and assign service accounts to GKE clusters.
-
Install the necessary Python packages:
google-authandgoogle-api-python-client. - Authenticate with the GCP API using a service account that has the necessary permissions to manage GKE clusters. You can create a service account and download its credentials in JSON format from the GCP console.
- List all GKE clusters in the project and check if any of them are using the default service account.
- To remediate the misconfiguration, you can create a new service account and assign it to the GKE cluster.