cis-gke-autopilot-v120-5-1-2

name	cis-gke-autopilot-v120-5.1.2
description	Minimize user access to Container Image repositories (Manual)
category	cis-gke-autopilot
version	1.2.0
author	cyberstrike-official
tags	["cis","gke-autopilot","kubernetes","gcp","image-registry","image-scanning","artifact-registry","vulnerability-scanning"]
cis_id	5.1.2
cis_benchmark	CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v1.2.0
tech_stack	["kubernetes","gcp","gke"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.1.2 Minimize user access to Container Image repositories (Manual)

Profile Applicability

• Level 2

Description

Note: GCR is now deprecated, see the references for more details.

Restrict user access to GCR or AR, limiting interaction with build images to only authorized personnel and service accounts.

Rationale

Weak access control to GCR or AR may allow malicious users to replace built images with vulnerable or back-doored containers.

Impact

Care should be taken not to remove access to GCR or AR for accounts that require this for their operation. Any account granted the Storage Object Viewer role at the project level can view all objects stored in GCS for the project.

Audit

For Images Hosted in AR:

1. Go to Artifacts Browser by visiting https://console.cloud.google.com/artifacts
2. From the list of artifacts select each repository with format Docker
3. Under the Permissions tab, review the roles for each member and ensure only authorized users have the Artifact Registry Administrator, Artifact Registry Reader, Artifact Registry Repository Administrator and Artifact Registry Writer roles.

Users may have permissions to use Service Accounts and thus Users could inherit privileges on the AR repositories. To check the accounts that could do this:

1. Go to IAM by visiting https://console.cloud.google.com/iam-admin/iam
2. Apply the filter Role: Service Account User.

Note that other privileged project level roles will have the ability to write and modify AR repositories. Consult the GCP CIS benchmark and IAM documentation for further reference.

Using Command Line:

gcloud artifacts repositories get-iam-policy <repository-name> --location <repository-location>

The output of the command will return roles associated with the AR repository and which members have those roles.

For Images Hosted in GCR:

Using Google Cloud Console: GCR bucket permissions

1. Go to Storage Browser by visiting https://console.cloud.google.com/storage/browser
2. From the list of storage buckets, select artifacts.<project_id>.appspot.com for the GCR bucket
3. Under the Permissions tab, review the roles for each member and ensure only authorized users have the Storage Admin, Storage Object Admin, Storage Object Creator, Storage Legacy Bucket Owner, Storage Legacy Bucket Writer and Storage Legacy Object Owner roles.