gcp-binary-authz

name	gcp-binary-authz
description	Implement GCP Binary Authorization to enforce deploy-time security controls that ensure only trusted, attested container images are deployed to Google Kubernetes Engine and Cloud Run.
domain	cybersecurity
subdomain	cloud-security
tags	["gcp","binary-authorization","container-security","supply-chain","gke","cloud-run","attestation","software-integrity"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Implementing GCP Binary Authorization

Overview

Binary Authorization is a Google Cloud deploy-time security control that ensures only trusted container images are deployed on GKE or Cloud Run. It works through a policy-based model where images must have cryptographic attestations confirming they passed predefined requirements such as vulnerability scans, code reviews, or build pipeline verification. Continuous validation (CV) monitors running pods against policies and logs violations.

When to Use

• When deploying or configuring implementing gcp binary authorization capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• GCP project with Binary Authorization API enabled
• GKE cluster or Cloud Run service
• Container Analysis API enabled
• KMS keys for attestation signing
• Cloud Build or external CI/CD pipeline

Enable Binary Authorization

# Enable required APIs
gcloud services enable binaryauthorization.googleapis.com
gcloud services enable containeranalysis.googleapis.com
gcloud services enable container.googleapis.com

# Enable Binary Authorization on GKE cluster
gcloud container clusters update CLUSTER_NAME \
  --enable-binauthz \
  --zone us-central1-a

Create Attestor

Create a KMS key for signing

# Create keyring
gcloud kms keyrings create binauthz-keyring \
  --location global

# Create signing key
gcloud kms keys create attestor-key \
  --keyring binauthz-keyring \
  --location global \
  --algorithm ec-sign-p256-sha256 \
  --purpose asymmetric-signing

Create Container Analysis note

cat > /tmp/note.json << 'EOF'
{
  "attestation": {
    "hint": {
      "humanReadableName": "Production Build Attestor"
    }
  }
}
EOF

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer " \
   \
  -d @/tmp/note.json