Homepage

Legacy ABAC is enabled Affecting Kubernetes (Container) Engine service in Google

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Containers/ APIs

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-Controls
  • Snyk IDSNYK-CC-00418
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

The legacy ABAC authorization is enabled on the cluster. The ABAC may conflict with RBAC authorization and lead to unintended access violations.

How to fix?

Set enable_legacy_abac attribute to false, or remove the attribute.

resource "google_container_cluster" "default_allowed" {
  name                     = "gke-cluster418"
  location                 = "us-east1-b"
  remove_default_node_pool = true
  initial_node_count       = 1
}

resource "google_container_cluster" "allowed" {
  name                     = "gke-cluster418-a"
  location                 = "us-east1-b"
  remove_default_node_pool = true
  initial_node_count       = 1
  enable_legacy_abac       = false
}