Ensure Kubernetes RBAC users are managed with Google Groups for GKE

Error: Kubernetes RBAC users are not managed with Google Groups for GKE

Bridgecrew Policy ID: BC_GCP_KUBERNETES_20
Checkov Check ID: CKV_GCP_65
Severity: LOW

Kubernetes RBAC users are not managed with Google Groups for GKE

Description

Cluster Administrators should leverage G Suite Groups and Cloud IAM to assign Kubernetes user roles to a collection of users, instead of to individual emails using only Cloud IAM.

On- and off-boarding users is often difficult to automate and prone to error. Using a single source of truth for user permissions via G Suite Groups reduces the number of locations that an individual must be off-boarded from, and prevents users gaining unique permissions sets that increase the cost of audit.

Fix - Buildtime

Terraform

  • Resource: google_container_cluster
  • Argument: authenticator_groups_config.security_group
resource "google_container_cluster" "example" {
  name               = var.name
  location           = var.location
  project            = data.google_project.project.name
  
+ authenticator_groups_config{
+   security_group="[email protected]"
+ }