Detections
Analytics

5.2.1 Use a custom least privilege node service account for GKE Autopilot

Information

Use a custom least privilege IAM service account for GKE Autopilot nodes instead of the Compute Engine default service account. The node service account should have only the IAM permissions required for GKE system tasks, logging, monitoring, and approved image pulls. GKE recommends using a custom node service account because the Compute Engine default service account might have broader permissions than GKE requires.

GKE uses IAM service accounts attached to nodes to perform system tasks such as logging and monitoring. At minimum, the node service account must have the Kubernetes Engine Default Node Service Account role, roles/container.defaultNodeServiceAccount, on the project. If the Compute Engine default service account is reused for other functions, it might accumulate broad IAM permissions that increase the risk of excessive access from the node identity.

For GKE Autopilot, the node service account is configured at the cluster level instead of through user managed node pools. A custom node service account can be specified when the Autopilot cluster is created, but it cannot be changed on an existing Autopilot cluster after creation.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

For new GKE Autopilot clusters, create a custom IAM service account for nodes and grant only the permissions required for GKE node operation. At minimum, grant roles/container.defaultNodeServiceAccount on the project.

gcloud iam service-accounts create $NODE_SERVICE_ACCOUNT_NAME \\
 --project $PROJECT_ID

gcloud projects add-iam-policy-binding $PROJECT_ID \\
 --member=serviceAccount:$NODE_SERVICE_ACCOUNT \\
 --role=roles/container.defaultNodeServiceAccount

Create the Autopilot cluster with the custom node service account.

gcloud container clusters create-auto $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --service-account=$NODE_SERVICE_ACCOUNT

If the existing Autopilot cluster was created with the Compute Engine default service account or an overly privileged node service account, create a replacement Autopilot cluster with the correct custom service account and migrate workloads. The node service account for an existing Autopilot cluster cannot be changed after cluster creation.

Impact:

Using a custom least privilege node service account reduces the risk of excessive IAM access from GKE nodes, but missing required permissions can affect node registration, logging, monitoring, or image pulls. Existing Autopilot clusters that use the wrong node service account cannot be updated in place, so remediation may require creating a replacement cluster with the correct custom service account and migrating workloads.

See Also

https://workbench.cisecurity.org/benchmarks/24958

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, CSCv7|4.3

Plugin: GCP

Control ID: 29dc9142aa294b51dd418c99372c479f6aa7e220a76ceedeb327e8dab82e2d43