Use custom least privilege service accounts for GKE node pools

점검 방법

감사 방식: 셸 명령

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.serviceAccount)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2!="" && $2!="default" && $2 !~ /-compute@developer\.gserviceaccount\.com$/) {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Create a dedicated custom IAM service account for GKE Standard node pools that are using the Compute Engine default service account or a service account with excessive permissions. The custom node service account should be used for node level system tasks and should be granted only the permissions required for GKE node operation. gcloud iam service-accounts create $NODE_SA_ACCOUNT \ --project=$PROJECT_ID \ --display-name="GKE Node Service Account" Grant the custom node service account the current baseline GKE node role, roles/container.defaultNodeServiceAccount. This role is intended to provide the required permissions for GKE node operation, replacing the older approach of separately assigning logging and monitoring roles.

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target gke