> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Legacy Compute Engine Instance Metadata APIs Are Disabled

### More Info:

Disable the legacy GCE instance metadata APIs for GKE nodes. Under some circumstances, these can be used from within a pod to extract the nodes credentials

### Risk Level

High

### Address

Operational Excellence, Performance Efficiency, Reliability, Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure Legacy Compute Engine Instance Metadata APIs Are Disabled" for GCP using GCP console, follow the below steps:

        1. Open the Google Cloud Console and select your project.
        2. Navigate to the Compute Engine page from the left-hand menu.
        3. From the Compute Engine page, select the "Metadata" tab.
        4. Under the "Metadata" tab, click on the "Edit" button.
        5. Scroll down to the "Legacy Metadata Access" section.
        6. Select the "Disallow" option to disable the legacy metadata access.
        7. Click on the "Save" button to save the changes.

        Once you have completed these steps, the legacy Compute Engine instance metadata APIs will be disabled, and your GCP environment will be more secure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure Legacy Compute Engine Instance Metadata APIs Are Disabled" for GCP using GCP CLI, follow the below steps:

        1. Open the GCP Cloud Shell and run the following command to disable the legacy metadata APIs:

        ```
        gcloud compute instances add-metadata [INSTANCE_NAME] --metadata=metadata-yaml-disable-legacy-endpoints=true
        ```

        Here, replace \[INSTANCE\_NAME] with the name of the instance for which you want to disable the legacy metadata APIs.

        2. Verify the change by running the following command:

        ```
        gcloud compute instances describe [INSTANCE_NAME] --format="get(metadata.items['metadata-yaml-disable-legacy-endpoints'])"
        ```

        This should output "true" which indicates that the legacy metadata APIs are now disabled.

        3. Repeat the above steps for all the instances in your GCP project to ensure that the legacy metadata APIs are disabled for all instances.

        Note: It is recommended to use the latest metadata APIs instead of the legacy ones for better security and performance.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure Legacy Compute Engine Instance Metadata APIs Are Disabled" for GCP using Python, you can use the following steps:

        1. Import the necessary Python libraries:

        ```python theme={null}
        from googleapiclient import discovery
        from oauth2client.client import GoogleCredentials
        ```

        2. Authenticate and authorize your credentials:

        ```python theme={null}
        credentials = GoogleCredentials.get_application_default()
        service = discovery.build('compute', 'v1', credentials=credentials)
        ```

        3. Get the project ID:

        ```python theme={null}
        project = 'YOUR_PROJECT_ID'
        ```

        4. Get the instance name:

        ```python theme={null}
        instance = 'YOUR_INSTANCE_NAME'
        ```

        5. Get the instance metadata:

        ```python theme={null}
        request = service.instances().get(project=project, zone=zone, instance=instance)
        response = request.execute()
        metadata = response['metadata']
        ```

        6. Check if the legacy metadata APIs are enabled:

        ```python theme={null}
        if 'enable-guest-attributes' in metadata:
            if metadata['enable-guest-attributes'] == 'TRUE':
                metadata.pop('enable-guest-attributes')
                body = {'metadata': metadata}
                request = service.instances().setMetadata(project=project, zone=zone, instance=instance, body=body)
                response = request.execute()
                print('Legacy Compute Engine Instance Metadata APIs have been disabled.')
            else:
                print('Legacy Compute Engine Instance Metadata APIs are already disabled.')
        else:
            print('Legacy Compute Engine Instance Metadata APIs are already disabled.')
        ```

        7. If the legacy metadata APIs are enabled, remove the 'enable-guest-attributes' key from the metadata and update the instance metadata with the new metadata:

        ```python theme={null}
        metadata.pop('enable-guest-attributes')
        body = {'metadata': metadata}
        request = service.instances().setMetadata(project=project, zone=zone, instance=instance, body=body)
        response = request.execute()
        print('Legacy Compute Engine Instance Metadata APIs have been disabled.')
        ```

        8. If the legacy metadata APIs are already disabled, print a message indicating that they are already disabled:

        ```python theme={null}
        print('Legacy Compute Engine Instance Metadata APIs are already disabled.')
        ```

        Note: Replace YOUR\_PROJECT\_ID and YOUR\_INSTANCE\_NAME with your actual project ID and instance name respectively. Also, replace the zone variable with the appropriate zone for your instance.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_container_cluster" "GKE_CLUSTER" {
          name     = "GKE_CLUSTER_NAME"        # substitute your cluster name
          location = "GKE_CLUSTER_LOCATION"    # e.g. "us-central1" or "us-central1-a"

          # ...other cluster arguments...

          node_config {
            # ...other node config...

            metadata = {
              disable-legacy-endpoints = "true"
            }
          }
        }
        ```

        If you manage node pools separately instead of using the default pool on `google_container_cluster`, put the setting on each `google_container_node_pool` instead:

        ```hcl theme={null}
        resource "google_container_node_pool" "GKE_NODE_POOL" {
          name       = "GKE_NODE_POOL_NAME"    # substitute your node pool name
          location   = "GKE_CLUSTER_LOCATION"  # must match the cluster
          cluster    = google_container_cluster.GKE_CLUSTER.name

          # ...other node pool arguments...

          node_config {
            # ...other node config...

            metadata = {
              disable-legacy-endpoints = "true"
            }
          }
        }
        ```

        Changing `node_config.metadata` in this way causes the nodes in the affected node pool(s) to be recreated (a rolling node replacement; pods will be rescheduled but the cluster itself is not destroyed).

        Verification: `terraform plan` should show an update to the relevant `google_container_cluster` and/or `google_container_node_pool` resources adding `metadata.disable-legacy-endpoints = "true"` and no other unexpected changes.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#disable-legacy-apis](https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#disable-legacy-apis)