Grant least privilege IAM access to Artifact Registry repositories

OrtaDüzey 2Manuel incelemegke

Açıklama

Restrict access to Artifact Registry repositories that store GKE Standard workload images. Grant users, groups, CI/CD identities, and GKE node service accounts only the IAM roles needed to pull, push, administer, or manage container images. The benchmark marks this recommendation Manual.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Review IAM access for Artifact Registry Docker repositories that store images deployed to GKE Standard clusters. Verify that repository permissions are limited to approved users, groups, service accounts, CI/CD identities, and GKE node service accounts based on their required function. Artifact Registry access can be granted at the project level or repository level, but repository level IAM should be used when access needs to differ by application, team, environment, or repository.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Apply least privilege IAM access to Artifact Registry Docker repositories that store images deployed to GKE Standard clusters. Repository access should be limited to approved users, groups, service accounts, CI/CD identities, and GKE node service accounts based on their required function. Use repository level IAM where access should differ by application, team, environment, or repository, and avoid broad project level grants unless the same access is intentionally required across all repositories. • Grant GKE node service accounts read only access to the specific Artifact Registry repositories they need to pull workload images from by assigning roles/artifactregistry.reader at the repository level. • Grant CI/CD publishing identities access only to repositories where they need to publish images by assigning roles/artifactregistry.writer at the repository level.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: gkemanaged-servicesrbacregistry
Referans: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.1.2 Grant least privilege IAM access to Artifact Registry repositories