Legacy Authorization Should Be Disabled
More Info:
Ensure legacy authorization is set to disabled on Kubernetes clusters. The legacy authorizer in Kubernetes grants broad, statically defined permissions.Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Legacy Authorization Should Be Disabled” misconfiguration in GCP using GCP console, follow these steps:
- Open the GCP console and navigate to the IAM & Admin page.
- Click on the “Settings” tab.
- Scroll down to the “Authorization” section.
- Under “Legacy authorization”, click on the “Edit” button.
- Select the checkbox for “Disable project-wide legacy authorization”.
- Click on the “Save” button to apply the changes.
Using CLI
Using CLI
To remediate the “Legacy Authorization Should Be Disabled” misconfiguration for GCP using GCP CLI, you can follow the below steps:
- Open the Google Cloud Console and go to the Cloud Shell.
-
In the Cloud Shell, run the following command to check if legacy authorization is enabled:
Replace
<project-id>with your GCP project ID. -
If the output shows that legacy authorization is enabled, run the following command to disable it:
Replace
<service-account-email>with the email address of the service account that you want to disable legacy authorization for. -
After running the above command, you can verify that legacy authorization has been disabled by running the following command:
The output should show that legacy authorization is now disabled.
Using Python
Using Python
To remediate the “Legacy Authorization Should Be Disabled” misconfiguration in GCP using Python, you can follow these steps:This will remediate the “Legacy Authorization Should Be Disabled” misconfiguration in GCP by removing the “allUsers” and “allAuthenticatedUsers” members from any IAM policy bindings that contain them.
- Install the Google Cloud IAM API client library for Python using pip:
- Create a Python script and import the necessary libraries:
- Set up authentication by creating a service account and downloading the JSON key file. Then, create a credentials object using the JSON key file:
- Create an instance of the IAM client:
- Get the current IAM policy for the project:
- Check if the “allUsers” or “allAuthenticatedUsers” member exists in any of the IAM policy’s bindings:
- Update the IAM policy with the modified bindings:
- Print a message indicating that the remediation is complete:
- Save the script and run it using the command: