Detections
Analytics

5.1.2 Grant least privilege IAM access to Artifact Registry repositories

Information

Restrict access to Artifact Registry repositories that store GKE Autopilot workload images. Grant users, groups, CI/CD identities, and GKE node service accounts only the IAM roles needed to pull, push, administer, or manage container images.

Weak IAM access to Artifact Registry can allow unauthorized users to pull sensitive images, push unapproved images, overwrite trusted image tags, or delete repository content. Artifact Registry supports repository level IAM, so access should be limited to the minimum required role, such as Artifact Registry Reader for image pulls, Artifact Registry Writer for image publishing, and repository administrator roles only for approved platform owners. GKE nodes require pull access to repositories that host workload images, especially when images are stored in a different project or when using user provided node service accounts.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Apply least privilege IAM access to Artifact Registry Docker repositories that store images deployed to GKE Autopilot clusters. Repository access should be limited to approved users, groups, service accounts, CI/CD identities, and GKE node service accounts based on their required function. Use repository level IAM where access should differ by application, team, environment, or repository, and avoid broad project level grants unless the same access is intentionally required across all repositories.

 -

Grant GKE node service accounts read only access to the specific Artifact Registry repositories they need to pull workload images from by assigning roles/artifactregistry.reader at the repository level.

 -

Grant CI/CD publishing identities access only to repositories where they need to publish images by assigning roles/artifactregistry.writer at the repository level.

 -

Remove excessive repository level access from unauthorized users, groups, service accounts, or public principals, including unnecessary roles/artifactregistry.admin, roles/artifactregistry.repoAdmin, roles/artifactregistry.writer, or public roles/artifactregistry.reader grants.

 -

Remove unnecessary project level Artifact Registry roles or broad basic roles such as Owner, Editor, and Viewer when repository level access is sufficient for the user, group, service account, or automation identity.

Confirm that GKE node service accounts can still pull approved images and that CI/CD identities can only publish to the repositories they are authorized to manage.

Impact:

Tightening Artifact Registry IAM may break GKE image pulls, CI/CD publishing, cross project deployments, or automation that depends on broader repository permissions. Validate required service accounts before removing access, especially GKE node service accounts, build service accounts, and deployment pipeline identities.

See Also

https://workbench.cisecurity.org/benchmarks/24958

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: GCP

Control ID: 8c19ae8afb850376d060d580f422558f9ff4137ca5f339db29c2cddc39e1c346