Enable Cloud Security Command Center

#!/usr/bin/env bash
#
# Audit Cloud Security Command Center (SCC) enablement for GKE clusters in a GCP project.
# REQUIREMENTS:
#   - gcloud CLI installed and authenticated
#   - IAM permissions:
#       securitycenter.settings.get
#       container.clusters.list
#
# USAGE:
#   ./check_scc_gke.sh PROJECT_ID
#
# NOTES:
#   This does NOT change any configuration. It only reports state.
#   It checks:
#     1) Whether SCC is generally enabled for the org/project.
#     2) Whether the GKE Security Posture integration is enabled per cluster
#        (a primary way SCC surfaces GKE security data).

set -euo pipefail

if [[ $# -ne 1 ]]; then
  echo "Usage: $0 PROJECT_ID" >&2
  exit 1
fi

PROJECT_ID="$1"

# ------------- Helper: check org / project SCC onboarding -------------

echo "=== Checking SCC onboarding state for project: ${PROJECT_ID} ==="

# Get the organization ID that owns this project
ORG_ID="$(gcloud projects get-ancestors --project "${PROJECT_ID}" \
  --format='value(id)' \
  | tail -n1 || true)"

if [[ -z "${ORG_ID}" ]]; then
  echo "WARNING: Could not determine organization for project ${PROJECT_ID}."
  echo "SCC is an organization-level service. Verify in the Cloud Console:"
  echo "  Security > Security Command Center > Settings"
else
  echo "Organization ID: ${ORG_ID}"
  echo
  echo "-> SCC service enablement (organization-level):"
  gcloud scc settings describe "organizations/${ORG_ID}" \
    --project="${PROJECT_ID}" \
    --format='table(name, onboarding_state, service_enablement_state)' || {
      echo "ERROR: Failed to describe SCC organization settings."
    }

  cat <<'EOF'

Interpretation:
  - onboarding_state:
      - ONBOARDED or ENABLED-like states: SCC is generally enabled.
      - ONBOARDING_STATE_UNSPECIFIED, NOT_ONBOARDED, or similar: SCC not fully enabled.
  - service_enablement_state:
      - ENABLED / ENABLED_FOR_ORG: SCC service is active.
      - DISABLED / NOT_ENABLED: SCC not providing findings.

Any state indicating NOT_ONBOARDED / DISABLED means SCC is effectively not enabled
for the org and therefore not providing centralized security visibility for GKE.
EOF
fi

# ------------- Helper: list GKE clusters and check Security Posture -------------

echo
echo "=== Enumerating GKE clusters and checking Security Posture / SCC integration ==="
echo

# List all GKE clusters in the project (all regions/zones)
CLUSTERS_JSON="$(gcloud container clusters list \
  --project="${PROJECT_ID}" \
  --format='json(name,location,releaseChannel.channel,securityPosture,resourceLabels)' || true)"

if [[ -z "${CLUSTERS_JSON}" || "${CLUSTERS_JSON}" = "[]" ]]; then
  echo "No GKE clusters found in project ${PROJECT_ID}."
  exit 0
fi

echo "${CLUSTERS_JSON}" | jq -r '
  [
    .[] |
    {
      name: .name,
      location: .location,
      releaseChannel: (.releaseChannel.channel // "UNSPECIFIED"),
      postureStatus: (.securityPosture.state // "UNSPECIFIED"),
      postureMode: (.securityPosture.config.mode // "UNSPECIFIED"),
      labels: (.resourceLabels // {})
    }
  ] |
  (["CLUSTER","LOCATION","RELEASE_CHANNEL","POSTURE_STATE","POSTURE_MODE","LABELS"] | @tsv),
  (.[] | [ .name, .location, .releaseChannel, .postureStatus, .postureMode, ( .labels | tojson ) ] | @tsv)
' | column -t

cat <<'EOF'

Interpretation per cluster:
  - POSTURE_STATE:
      - ACTIVE / ENABLED-like: GKE Security Posture is running and can feed SCC.
      - DISABLED / DEPRECATED / UNSPECIFIED: posture findings may not be available in SCC.
  - POSTURE_MODE:
      - ENABLED / STRICT / STANDARD (depending on your config): posture checks are applied.
      - DISABLED / UNSPECIFIED: posture checks not enforced or not configured.

Clusters with POSTURE_STATE of DISABLED / UNSPECIFIED or POSTURE_MODE of DISABLED / UNSPECIFIED
are effectively not contributing full security posture data to SCC.

These outputs indicate a POTENTIAL PROBLEM for this benchmark when:
  - SCC onboarding_state or service_enablement_state is NOT_ONBOARDED / DISABLED.
  - Any production GKE cluster has Security Posture in a DISABLED / UNSPECIFIED state or mode.

Because this control is MANUAL, you must review:
  - Whether SCC should be enabled organization-wide.
  - Whether each GKE cluster that requires centralized security visibility should have
    Security Posture enabled and integrated with SCC.

Remediation cannot be fully automated from this script; enablement must be
done via the Cloud Console, gcloud, or IaC per organizational policy.
EOF