Grant least privilege IAM access to Artifact Registry repositories

SedangLevel 2Tinjauan manualgke

Deskripsi

Restrict access to Artifact Registry repositories that store GKE Standard workload images. Grant users, groups, CI/CD identities, and GKE node service accounts only the IAM roles needed to pull, push, administer, or manage container images. The benchmark marks this recommendation Manual.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Review IAM access for Artifact Registry Docker repositories that store images deployed to GKE Standard clusters. Verify that repository permissions are limited to approved users, groups, service accounts, CI/CD identities, and GKE node service accounts based on their required function. Artifact Registry access can be granted at the project level or repository level, but repository level IAM should be used when access needs to differ by application, team, environment, or repository.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Apply least privilege IAM access to Artifact Registry Docker repositories that store images deployed to GKE Standard clusters. Repository access should be limited to approved users, groups, service accounts, CI/CD identities, and GKE node service accounts based on their required function. Use repository level IAM where access should differ by application, team, environment, or repository, and avoid broad project level grants unless the same access is intentionally required across all repositories. • Grant GKE node service accounts read only access to the specific Artifact Registry repositories they need to pull workload images from by assigning roles/artifactregistry.reader at the repository level. • Grant CI/CD publishing identities access only to repositories where they need to publish images by assigning roles/artifactregistry.writer at the repository level.

Properti

Sistem operasi: Apa saja
Tag: gkemanaged-servicesrbacregistry
Referensi: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.1.2 Grant least privilege IAM access to Artifact Registry repositories