| name | cis-gke-v170-5.1.2 |
| description | Minimize user access to Container Image repositories (Manual) |
| category | cis-gke |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","gke","kubernetes","gcp","image-registry","image-scanning","artifact-registry","vulnerability-scanning","binary-authorization"] |
| cis_id | 5.1.2 |
| cis_benchmark | CIS Google Kubernetes Engine (GKE) Benchmark v1.7.0 |
| tech_stack | ["kubernetes","gcp","gke"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.1.2 Minimize user access to Container Image repositories (Manual)
Profile Applicability
Description
Note: GCR is now deprecated, see the references for more details.
Restrict user access to GCR or AR, limiting interaction with build images to only authorized personnel and service accounts.
Rationale
Weak access control to GCR or AR may allow malicious users to replace built images with vulnerable or back-doored containers.
Impact
Care should be taken not to remove access to GCR or AR for accounts that require this for their operation. Any account granted the Storage Object Viewer role at the project level can view all objects stored in GCS for the project.
Audit
For Images Hosted in AR:
- Go to Artifacts Browser by visiting https://console.cloud.google.com/artifacts
- From the list of artifacts select each repository with format
Docker
- Under the Permissions tab, review the roles for each member and ensure only authorized users have the Artifact Registry Administrator, Artifact Registry Reader, Artifact Registry Repository Administrator and Artifact Registry Writer roles.
Users may have permissions to use Service Accounts and thus Users could inherit privileges on the AR repositories. To check the accounts that could do this:
- Go to IAM by visiting https://console.cloud.google.com/iam-admin/iam
- Apply the filter
Role: Service Account User.
Using Command Line:
gcloud artifacts repositories get-iam-policy <repository-name> --location <repository-location>
The output of the command will return roles associated with the AR repository and which members have those roles.
For Images Hosted in GCR:
Using Google Cloud Console:
GCR bucket permissions
- Go to Storage Browser by visiting https://console.cloud.google.com/storage/browser
- From the list of storage buckets, select
artifacts.<project_id>.appspot.com for the GCR bucket
- Under the Permissions tab, review the roles for each member and ensure only authorized users have the Storage Admin, Storage Object Admin, Storage Object Creator, Storage Legacy Bucket Owner, Storage Legacy Bucket Writer and Storage Legacy Object Owner roles.
Users may have permissions to use Service Accounts and thus Users could inherit privileges on the GCR Bucket. To check the accounts that could do this:
