Checks

OS Login automatically revokes the relevant SSH keys when an IAM user has their access revoked.

Sensitive values such as raw encryption keys should not be included in your Terraform code, and should be stored securely by a secrets manager.

TLS versions prior to 1.2 are outdated and insecure. You should use 1.2 as aminimum version.

The virtual TPM provides numerous security measures to your VM.

OS Login automatically revokes the relevant SSH keys when an IAM user has their access revoked.

Disabling IP forwarding ensures the instance can only receive packets addressed to the instance and can only send packets with a source address of the instance.

The default service account has full project access. Instances should instead be assigned the minimal access they need.

Integrity monitoring helps you understand and make decisions about the state of your VM instances.

Using 'allAuthenticatedUsers' provides any GCP user - even those outside of your organisation - access to your BigQuery dataset.

The Compute Engine instance metadata server exposes legacy v0.1 and v1beta1 endpoints, which do not enforce metadata query headers.

This is a feature in the v1 APIs that makes it more difficult for a potential attacker to retrieve instance metadata.

Unless specifically required, we recommend you disable these legacy APIs.

When setting the <code>metadata</code> block, the default value for <code>disable-legacy-endpoints</code> is set to true, they should not be explicitly enabled.

IP aliasing allows the reuse of public IPs internally, removing the need for a NAT gateway.

You should create and use a minimally privileged service account to run your GKE cluster instead of using the Compute Engine default service account.

Labels make it easier to manage assets and differentiate between clusters and environments, allowing the mapping of computational resources to the wider organisational structure.

StackDriver monitoring aggregates logs, events, and metrics from your Kubernetes environment on GKE to help you understand your application's behavior in production.

The GKE control plane is exposed to the public internet by default.

GKE supports several OS image types but COS is the recommended OS image to use on cluster nodes for enhanced security

CIS GKE Benchmark Recommendation: 6.5.5. Ensure Shielded GKE Nodes are Enabled

Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of GKE nodes and should be enabled on all GKE clusters.

Enabling a network policy allows the segregation of network traffic by namespace

In provider versions prior to 4: The attribute <code>workload_metadata_config.node_metadata</code> configures how node metadata is exposed to workloads. It should be set to <code>SECURE</code> to limit metadata exposure, or <code>GKE_METADATA_SERVER</code> if Workload Identity is enabled.

Starting with provider version 4: The attribute <code>node_metadata</code> has been removed. Instead, <code>workload_metadata_configuration.mode</code> controls node metadata exposure. When Workload Identity is enabled, it should be set to <code>GKE_METADATA</code> to prevent unnecessary exposure of the metadata API to workloads.

Automatic updates keep nodes updated with the latest cluster master version.

Enabling private nodes on a cluster ensures the nodes are only available internally as they will only be assigned internal addresses.

StackDriver logging provides a useful interface to all of stdout/stderr for each container and should be enabled for moitoring, debugging, etc.

Enabling authorized networks means you can restrict master access to a fixed set of CIDR ranges

You should disable Attribute-Based Access Control (ABAC), and instead use Role-Based Access Control (RBAC) in GKE.

RBAC has significant security advantages and is now stable in Kubernetes, so it’s time to disable ABAC.