| name | cis-gke-v180-5.9.2 |
| description | Enable Customer-Managed Encryption Keys (CMEK) for Boot Disks (Automated) |
| category | cis-gke |
| version | 1.8.0 |
| author | cyberstrike-official |
| tags | ["cis","gke","kubernetes","gcp","storage","cmek","persistent-disks","boot-disks","encryption","cloud-kms"] |
| cis_id | 5.9.2 |
| cis_benchmark | CIS Google Kubernetes Engine (GKE) Benchmark v1.8.0 |
| tech_stack | ["kubernetes","gcp","gke"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.9.2 Enable Customer-Managed Encryption Keys (CMEK) for Boot Disks (Automated)
Profile Applicability
Description
Use Customer-Managed Encryption Keys (CMEK) to encrypt node boot disks using keys managed within Cloud Key Management Service (Cloud KMS).
Rationale
GCE persistent disks are encrypted at rest by default using envelope encryption with keys managed by Google. For additional protection, users can manage the Key Encryption Keys using Cloud KMS.
Impact
Encryption of dynamically-provisioned attached disks requires the use of the self-provisioned Compute Engine Persistent Disk CSI Driver v0.5.1 or higher.
If CMEK is being configured with a regional cluster, the cluster must run GKE 1.14 or higher.
Audit
Using Google Cloud Console:
- Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
- Click on each cluster, and click on any Node pools.
- On the Node pool Details page, under the
Security heading, check that Boot disk encryption type is set to Customer managed with the desired key.
Using Command Line:
To check for Customer-Managed Encryption Keys (CMEK) first define 3 variables for Node Pool, Cluster Name and Zone and then run this command:
gcloud container node-pools describe $NODE_POOL --cluster $CLUSTER_NAME --zone $COMPUTE_ZONE
Verify that the output of the above command includes a diskType of either pd-standard, pd-balanced or pd-ssd, and the bootDiskKmsKey is specified as the desired key.
Remediation
This cannot be remediated by updating an existing cluster. The node pool must either be recreated or a new cluster created.
Using Google Cloud Console:
To create a new node pool:
- Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
- Select Kubernetes clusters for which node boot disk CMEK is disabled.
- Click
ADD NODE POOL.
- In the Nodes section, under machine configuration, ensure Boot disk type is
Standard persistent disk or SSD persistent disk.
- Select
Enable customer-managed encryption for Boot Disk and select the Cloud KMS encryption key to be used.
