Google Kubernetes Engine (GKE)
TMA-GKE-5.1.2
Grant least privilege IAM access to Artifact Registry repositories
설명
Restrict access to Artifact Registry repositories that store GKE Standard workload images. Grant users, groups, CI/CD identities, and GKE node service accounts only the IAM roles needed to pull, push, administer, or manage container images. The benchmark marks this recommendation Manual.
점검 방법
감사 방식: 수동 검토
Review IAM access for Artifact Registry Docker repositories that store images deployed to GKE Standard clusters. Verify that repository permissions are limited to approved users, groups, service accounts, CI/CD identities, and GKE node service accounts based on their required function. Artifact Registry access can be granted at the project level or repository level, but repository level IAM should be used when access needs to differ by application, team, environment, or repository.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Apply least privilege IAM access to Artifact Registry Docker repositories that store images deployed to GKE Standard clusters. Repository access should be limited to approved users, groups, service accounts, CI/CD identities, and GKE node service accounts based on their required function. Use repository level IAM where access should differ by application, team, environment, or repository, and avoid broad project level grants unless the same access is intentionally required across all repositories. • Grant GKE node service accounts read only access to the specific Artifact Registry repositories they need to pull workload images from by assigning roles/artifactregistry.reader at the repository level. • Grant CI/CD publishing identities access only to repositories where they need to publish images by assigning roles/artifactregistry.writer at the repository level.
속성
- 운영 체제
- 모두
- 태그
- gkemanaged-servicesrbacregistry
- 참고 자료
- CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.1.2 Grant least privilege IAM access to Artifact Registry repositories