Kubernetes RBAC users are not managed with Google Groups for GKE misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_65
Category - Subcategory	Kubernetes - Access Control
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

Cluster Administrators should leverage G Suite Groups and Cloud IAM to assign Kubernetes user roles to a collection of users, instead of to individual emails using only Cloud IAM. On- and off-boarding users is often difficult to automate and prone to error. Using a single source of truth for user permissions via G Suite Groups reduces the number of locations that an individual must be off-boarded from, and prevents users gaining unique permissions sets that increase the cost of audit.

How to Fix

Resource: google_container_cluster

• Arguments: authenticator_groups_config.security_group [source,go]

---

resource "google_container_cluster" "example" { name = var.name location = var.location project = data.google_project.project.name

• authenticator_groups_config{
• security_group="[e-mail]"
• }

---