GCP Kubernetes cluster shielded GKE node with integrity monitoring disabled misconfiguration detecte

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_72
Category - Subcategory	Kubernetes - Native Security Controls
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	39cdd589-3814-4f97-9101-a2204f8721e0

Impact

Enable Integrity Monitoring for Shielded GKE Nodes to be notified of inconsistencies during the node boot sequence. Integrity Monitoring provides active alerting for Shielded GKE nodes which allows administrators to respond to integrity failures and prevent compromised nodes from being deployed into the cluster.

How to Fix

Resource: google_container_cluster / google_container_node_pool

• Arguments: node_config.shielded_instance_config.enable_integrity_monitoring [source,go]

---

resource "google_container_cluster" "fail" { name = var.name location = var.location initial_node_count = 1 project = data.google_project.project.name

node_config {

shielded_instance_config {

• enable_integrity_monitoring = false } }

---