Use Google Groups to centrally manage Kubernetes RBAC access for GKE clusters

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Review the GKE cluster and verify that Google Groups for RBAC is enabled and configured with the required security group. Google Groups for RBAC lets Kubernetes RBAC permissions be assigned to Google Groups managed in Google Workspace or Cloud Identity, rather than binding access directly to individual user email addresses.

How it is fixed

Fix method: Guidance or infrastructure patch

Enable Google Groups for RBAC when the audit shows that authenticatorGroupsConfig.enabled is not true, or when securityGroupis missing or incorrect. The required security group must be named gke-security-groups@DOMAIN, and approved access groups should be nested under that security group before they are referenced in Kubernetes RBAC bindings. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --security-group=gke-security-groups@$DOMAIN After Google Groups for RBAC is enabled, update Kubernetes RoleBinding and ClusterRoleBinding objects to reference approved Google Groups as kind: Group subjects. Replace direct User bindings with group based bindings where practical, while preserving required ServiceAccount bindings for workloads, controllers, and automation.