GCP Kubernetes Engine Clusters have Legacy Authorization enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_7
Category - Subcategory	Kubernetes - Access Control
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	9c835b12-e60a-4590-9e5e-5dd959774d71

Impact

Kubernetes RBAC (Role-Based Access Control) can be used to grant permissions to resources at the cluster and namespace level. It allows defining roles with rules containing a set of permissions. RBAC has significant security advantages and is now stable in Kubernetes, superseding the benefits of legacy authorization with ABAC (Attribute-Based Access Control). We recommend you disable ABAC authorization and use RBAC in GKE instead.

How to Fix

[source,go]

resource "google_container_cluster" "primary" { name = "my-gke-cluster" location = "us-central1" remove_default_node_pool = true initial_node_count = 1 logging_service = "logging.googleapis.com/kubernetes" enable_legacy_abac = false }