K8s authentication client certificates disabled remediation

Using Console

To remediate the misconfiguration “Ensure Authentication Using Client Certificates Is Disabled” in GCP using GCP console, you can follow the below steps:

Open the GCP Console and navigate to the Security Command Center.
From the Security Command Center dashboard, select the project that you want to remediate.
Click on the “Policy” tab and search for the policy “Ensure Authentication Using Client Certificates Is Disabled”.
Click on the policy to view the list of non-compliant resources.
Click on the non-compliant resource that you want to remediate.
In the “Resource Details” page, click on the “Remediate” button.
In the “Remediation” dialog box, select the option “Disable client certificate authentication”.
Click on the “Remediate” button to apply the remediation.
Once the remediation is applied, the policy status will change to “Compliant”.
Verify that the policy is now compliant by checking the policy status and the resource details page.

By following these steps, you can remediate the misconfiguration “Ensure Authentication Using Client Certificates Is Disabled” in GCP using GCP console.

Using CLI

To remediate the misconfiguration “Ensure Authentication Using Client Certificates Is Disabled” for GCP using GCP CLI, follow the below steps:

Open the Cloud Shell in the GCP console.
Run the following command to list all the backend services in the current project:
gcloud compute backend-services list
Identify the backend service that needs to be remediated and note down its name.
Run the following command to describe the backend service:
gcloud compute backend-services describe [BACKEND_SERVICE_NAME]
Replace [BACKEND_SERVICE_NAME] with the name of the backend service identified in step 3.
In the output, locate the securityPolicy field. If this field is set to a security policy that enforces client certificate authentication, then client certificate authentication is enabled. To disable it, you need to set the securityPolicy field to null.
Run the following command to update the backend service and disable client certificate authentication:
gcloud compute backend-services update [BACKEND_SERVICE_NAME] --no-security-policy
Replace [BACKEND_SERVICE_NAME] with the name of the backend service identified in step 3.
Verify that the misconfiguration has been remediated by running the command in step 4 again and checking that the securityPolicy field is now set to null.

By following these steps, you can remediate the misconfiguration “Ensure Authentication Using Client Certificates Is Disabled” for GCP using GCP CLI.

Using Python

To remediate the misconfiguration “Ensure Authentication Using Client Certificates is Disabled” for GCP using Python, you can follow these steps:

First, you need to authenticate with GCP using a service account key file. You can create a service account and download the key file from the GCP console. Then, set the environment variable GOOGLE_APPLICATION_CREDENTIALS to the path of the key file.

import os
from google.oauth2 import service_account

# Replace [PATH_TO_KEY_FILE] with the path to your service account key file
key_path = '[PATH_TO_KEY_FILE]'
credentials = service_account.Credentials.from_service_account_file(key_path)
os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = key_path

Next, you can use the google-cloud-resource-manager library to retrieve a list of all projects in your GCP organization.

from google.cloud import resource_manager

client = resource_manager.Client(credentials=credentials)
projects = list(client.list_projects())

For each project, you can use the google-cloud-compute library to retrieve a list of all instances in the project.

from google.cloud import compute_v1

compute_client = compute_v1.InstancesClient(credentials=credentials)
for project in projects:
    instances = list(compute_client.list(project=project.project_id))

For each instance, you can check if client certificate authentication is enabled by checking the clientCertEnabled field in the instance’s metadata.

for instance in instances:
    metadata = compute_client.get_iam_policy(instance=instance.self_link)
    if metadata.items.get('clientCertEnabled', {}).get('value', '') == 'true':
        # Client certificate authentication is enabled

To disable client certificate authentication, you can update the instance’s metadata using the google-cloud-compute library.

from google.cloud.compute_v1.types import Instance

metadata = compute_client.get_iam_policy(instance=instance.self_link)
metadata.items['clientCertEnabled'] = Instance.Metadata.Items.Value(value='false')
compute_client.set_metadata(instance=instance.self_link, metadata=metadata)

Finally, you can confirm that client certificate authentication is disabled by checking the clientCertEnabled field in the instance’s updated metadata.

metadata = compute_client.get_iam_policy(instance=instance.self_link)
if metadata.items.get('clientCertEnabled', {}).get('value', '') == 'false':
    # Client certificate authentication is disabled

By following these steps, you can remediate the misconfiguration “Ensure Authentication Using Client Certificates is Disabled” for GCP using Python.

Using Terraform

resource "google_container_cluster" "PRIMARY_CLUSTER" {
  name     = "PRIMARY_CLUSTER_NAME"          # replace with your cluster name
  location = "PRIMARY_CLUSTER_LOCATION"      # replace with your region or zone (e.g. us-central1, us-central1-a)

  # ... your existing cluster configuration ...

  master_auth {
    # Keep or remove username/password blocks according to your existing config and security requirements.
    # Do NOT enable client certificate issuance.
    client_certificate_config {
      issue_client_certificate = false
    }
  }
}

This change is an in-place update for an existing GKE cluster (it should not force replacement under current Google provider behavior).After updating your Terraform, terraform plan should show an update (~) to google_container_cluster.PRIMARY_CLUSTER with master_auth.0.client_certificate_config.0.issue_client_certificate changing from true (or unset) to false.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

K8s authentication client certificates disabled remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation