Rule explorer
Browse every hardening rule in the catalog. Filter by platform, severity, profile level and whether the check can be automated.
54 rules foundof 11,219Page 2 of 3
| ID | Title | Platform | Severity | Level | Check |
|---|---|---|---|---|---|
| TMA-GKE-4.6.1 | Use namespaces to separate workload administration and resource governancegke · Level 1 | gke | Medium | 1 | Manual review |
| TMA-GKE-5.1.1 | Enable Artifact Analysis scanning for Artifact Registry container imagesgke · Level 2 | gke | Medium | 2 | Automated |
| TMA-GKE-5.1.2 | Grant least privilege IAM access to Artifact Registry repositoriesgke · Level 2 | gke | Medium | 2 | Manual review |
| TMA-GKE-5.1.3 | Enforce Binary Authorization for trusted GKE container image deploymentsgke · Level 2 | gke | Medium | 2 | Automated |
| TMA-GKE-5.2.2 | Use dedicated Kubernetes service accounts with Workload Identity Federation for GKEgke · Level 2 | gke | Medium | 2 | Manual review |
| TMA-GKE-5.4.1 | Enable GKE metadata server on Standard node poolsgke · Level 2 | gke | Medium | 2 | Automated |
| TMA-GKE-5.5.7 | Ensure Secure Boot is enabled for Shielded GKE node poolsgke · Level 2 | gke | Medium | 2 | Automated |
| TMA-GKE-5.6.1 | Enable VPC Flow Logs and Intranode Visibilitygke · Level 2 | gke | Medium | 2 | Automated |
| TMA-GKE-5.6.2 | Use VPC native GKE clusters with alias IP address rangesgke · Level 1 | gke | Medium | 1 | Automated |
| TMA-GKE-5.6.3 | Restrict GKE control plane access with authorized networksgke · Level 2 | gke | Medium | 2 | Automated |
| TMA-GKE-5.6.4 | Use DNS based access or private GKE control plane endpointsgke · Level 2 | gke | Medium | 2 | Automated |
| TMA-GKE-5.6.6 | Apply least privilege firewall rules to GKE worker nodesgke · Level 2 | gke | Medium | 2 | Manual review |
| TMA-GKE-5.6.7 | Use Google managed SSL certificates for GKE Ingress TLSgke · Level 2 | gke | Medium | 2 | Manual review |
| TMA-GKE-5.7.1 | Enable Cloud Logging and Cloud Monitoring for GKE clustersgke · Level 1 | gke | Medium | 1 | Automated |
| TMA-GKE-5.7.2 | Enable Linux auditd logging for Container Optimized OS GKE nodesgke · Level 2 | gke | Medium | 2 | Manual review |
| TMA-GKE-5.8.2 | Use Google Groups to centrally manage Kubernetes RBAC access for GKE clustersgke · Level 2 | gke | Medium | 2 | Manual review |
| TMA-GKE-5.9.1 | Use CMEK protected StorageClasses for GKE Persistent Disk volumesgke · Level 2 | gke | Medium | 2 | Manual review |
| TMA-GKE-5.9.2 | Use CMEK protected boot disks for GKE node poolsgke · Level 2 | gke | Medium | 2 | Automated |
| TMA-GKE-4.5.1 | Enforce image provenance using Binary Authorization for GKEgke · Level 2 | gke | Low | 2 | Manual review |
| TMA-GKE-4.6.2 | Require RuntimeDefault seccomp or approved custom profiles for workload podsgke · Level 2 | gke | Low | 2 | Manual review |
| TMA-GKE-4.6.3 | Require hardened security contexts for all workload Pods and containersgke · Level 2 | gke | Low | 2 | Manual review |
| TMA-GKE-4.6.4 | Avoid deploying workloads in the default namespacegke · Level 2 | gke | Low | 2 | Manual review |
| TMA-GKE-5.5.1 | Use COS_CONTAINERD node images for GKE node poolsgke · Level 1 | gke | Low | 1 | Automated |
| TMA-GKE-5.5.2 | Verify node auto-repair is enabled for GKE node poolsgke · Level 2 | gke | Low | 2 | Automated |
| TMA-GKE-5.5.3 | Verify node auto-upgrade is enabled for GKE node poolsgke · Level 2 | gke | Low | 2 | Automated |