Identity and Access Management (IAM) | Vulnerability Database

5.2 Identity and Access Management (IAM)

5.2.1 Ensure GKE clusters are not running using the Compute Engine default service account (Manual)

Recommended Action

Using Command Line: Firstly, create a minimally privileged service account:

gcloud iam service-accounts create [SA_NAME] \
  --display-name "GKE Node Service Account"
export NODE_SA_EMAIL=`gcloud iam service-accounts list \
  --format='value(email)' \
  --filter='displayName:GKE Node Service Account'`

Grant the following roles to the service account:

export PROJECT_ID=`gcloud config get-value project`
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member serviceAccount:$NODE_SA_EMAIL \
  --role roles/monitoring.metricWriter
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member serviceAccount:$NODE_SA_EMAIL \
  --role roles/monitoring.viewer
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member serviceAccount:$NODE_SA_EMAIL \
  --role roles/logging.logWriter

To create a new Node pool using the Service account, run the following command:

gcloud container node-pools create [NODE_POOL] \
  --service-account=[SA_NAME]@[PROJECT_ID].iam.gserviceaccount.com \
  --cluster=[CLUSTER_NAME] --zone [COMPUTE_ZONE]

You will need to migrate your workloads to the new Node pool, and delete Node pools that use the default service account to complete the remediation.

5.2.2 Prefer using dedicated GCP Service Accounts and Workload Identity (Manual)

Recommended Action

Using Command Line:

gcloud beta container clusters update [CLUSTER_NAME] --zone [CLUSTER_ZONE] \
  --identity-namespace=[PROJECT_ID].svc.id.goog

Note that existing Node pools are unaffected. New Node pools default to –workload- metadata-from-node=GKE_METADATA_SERVER .

Then, modify existing Node pools to enable GKE_METADATA_SERVER:

gcloud beta container node-pools update [NODEPOOL_NAME] \
  --cluster=[CLUSTER_NAME] --zone [CLUSTER_ZONE] \
  --workload-metadata-from-node=GKE_METADATA_SERVER

You may also need to modify workloads in order for them to use Workload Identity as described within https://cloud.google.com/kubernetes-engine/docs/how-to/workload- identity. Also consider the effects on the availability of your hosted workloads as Node pools are updated, it may be more appropriate to create new Node Pools.