Detections
Analytics

5.8.3 Ensure Legacy Authorization (ABAC) is Disabled

Information

Keep legacy ABAC authorization disabled for GKE clusters. ABAC is a legacy Kubernetes authorization method that has been superseded by Kubernetes RBAC, which provides fine grained authorization through Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources.

ABAC uses broad, static authorization policies that are less flexible and harder to manage than Kubernetes RBAC. RBAC supports more precise permissions at the namespace and cluster level, allowing administrators to grant only the actions required for users, groups, service accounts, workloads, and automation.

Leaving ABAC disabled reduces the risk of overly broad legacy permissions bypassing the intended RBAC model. GKE hardening guidance recommends using IAM and RBAC for access control and not enabling ABAC which is disabled by default in all GKE clusters.

Solution

Disable legacy ABAC authorization for any GKE cluster where the audit result returns true. Before disabling ABAC, confirm that required users, groups, service accounts, workloads, and automation have the necessary Kubernetes RBAC permissions through Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources.

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --no-enable-legacy-authorization

Rerun the audit command and confirm that .legacyAbac.enabled returns false or null . Validate representative access with kubectl auth can-i to confirm legitimate users and automation still have the required RBAC access.

Impact:

Clusters that previously depended on ABAC rules must be migrated to Kubernetes RBAC before ABAC is disabled. Administrators should review existing access requirements, create the required Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources, and validate access with representative users, groups, service accounts, and automation before enforcement.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4), CSCv7|4, CSCv7|16

Plugin: GCP

Control ID: 7463501bd5e821a9babfefc767e8202b7fc187955c8719c804fc75b545fce138