Grant least privilege IAM access to Artifact Registry repositories

MediaNivel 2Revisión manualgke-autopilot

Descripción

Restrict access to Artifact Registry repositories that store GKE Autopilot workload images. Grant users, groups, CI/CD identities, and GKE node service accounts only the IAM roles needed to pull, push, administer, or manage container images. The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Review IAM access for Artifact Registry Docker repositories that store images deployed to GKE Autopilot clusters. Verify that repository permissions are limited to approved users, groups, service accounts, CI/CD identities, and GKE node service accounts based on their required function. Artifact Registry access can be granted at the project level or repository level, but repository level IAM should be used when access needs to differ by application, team, environment, or repository.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Apply least privilege IAM access to Artifact Registry Docker repositories that store images deployed to GKE Autopilot clusters. Repository access should be limited to approved users, groups, service accounts, CI/CD identities, and GKE node service accounts based on their required function. Use repository level IAM where access should differ by application, team, environment, or repository, and avoid broad project level grants unless the same access is intentionally required across all repositories. • Grant GKE node service accounts read only access to the specific Artifact Registry repositories they need to pull workload images from by assigning roles/artifactregistry.reader at the repository level. • Grant CI/CD publishing identities access only to repositories where they need to publish images by assigning roles/artifactregistry.writer at the repository level.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: gke-autopilotmanaged-servicesrbacregistry
Referencia: CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v2.0.0 - 5.1.2 Grant least privilege IAM access to Artifact Registry repositories