Ensure Minimal Audit Policy Is Created

#!/usr/bin/env bash
#
# Automation: Report API server audit policy configuration (GKE CIS 2.2.1)
#
# Prereqs:
#   - Run on any machine with:
#       * gcloud CLI configured (for GKE)
#       * kubectl configured for the target clusters/projects
#   - jq installed

set -euo pipefail

# ---- CONFIGURATION ----
# If you want to scope this, set these before running:
#   PROJECTS="proj-1 proj-2"
#   CLUSTERS="cluster-1 cluster-2"
#   REGIONS="us-central1 us-east1"
PROJECTS="${PROJECTS:-$(gcloud projects list --format='value(projectId)')}"
CLUSTERS="${CLUSTERS:-ALL}"
REGIONS="${REGIONS:-ALL}"

echo "=== GKE CIS 2.2.1 – Audit Policy Review ==="
echo "Projects: ${PROJECTS}"
echo "Clusters filter: ${CLUSTERS}"
echo "Regions filter: ${REGIONS}"
echo

for PROJECT in $PROJECTS; do
  echo "---- Project: ${PROJECT} ----"

  # List all GKE clusters in the project
  if [[ "$REGIONS" == "ALL" ]]; then
    CLUSTER_LIST=$(gcloud container clusters list \
      --project "$PROJECT" \
      --format='value(name,location)')
  else
    CLUSTER_LIST=""
    for REGION in $REGIONS; do
      CLUSTER_LIST+=$'\n'"$(gcloud container clusters list \
        --project "$PROJECT" \
        --region "$REGION" \
        --format='value(name,location)' || true)"
    done
    CLUSTER_LIST="$(printf "%s\n" "$CLUSTER_LIST" | sed '/^$/d' | sort -u)"
  fi

  if [[ -z "$CLUSTER_LIST" ]]; then
    echo "  No clusters found."
    echo
    continue
  fi

  while read -r NAME LOCATION; do
    [[ -z "$NAME" ]] && continue

    # Optional cluster name filter
    if [[ "$CLUSTERS" != "ALL" ]]; then
      SKIP=true
      for C in $CLUSTERS; do
        if [[ "$NAME" == "$C" ]]; then
          SKIP=false
          break
        fi
      done
      $SKIP && continue
    fi

    echo "  Cluster: ${NAME} (${LOCATION})"

    # Describe the cluster and extract audit-related fields
    DESC_JSON=$(gcloud container clusters describe "$NAME" \
      --project "$PROJECT" \
      --location "$LOCATION" \
      --format=json)

    # For GKE, you cannot set --audit-policy-file directly, but we can check:
    # - masterAuthorizedNetworksConfig
    # - loggingService / monitoringService
    # - clusterLoggingConfig
    # The key point for this manual control: verify if API audit logs are enabled in Cloud Logging.

    LOGGING_MONITORING=$(echo "$DESC_JSON" | jq -r '
      {
        loggingService: (.loggingService // "unspecified"),
        monitoringService: (.monitoringService // "unspecified"),
        clusterLoggingConfig: (.loggingConfig.clusterConfig.enableComponents // []),
        dataplaneV2: (.dataplaneV2Config.mode // "none")
      }')

    echo "    Logging / Monitoring summary:"
    echo "$LOGGING_MONITORING" | sed 's/^/      /'

    echo "    Cloud Logging API-Server audit logs status:"
    # Check whether "APISERVER" or "ALL" logging components are enabled
    APISERVER_LOG_ENABLED=$(echo "$DESC_JSON" \
      | jq -r '
        if (.loggingConfig.clusterConfig.enableComponents // []) | index("APISERVER")
        then "enabled"
        elif (.loggingConfig.clusterConfig.enableComponents // []) | index("ALL")
        then "enabled-via-ALL"
        else "disabled-or-legacy"
        end')

    echo "      api-server audit logging (via enableComponents): ${APISERVER_LOG_ENABLED}"

    # Also check legacy loggingService
    LOGGING_SERVICE=$(echo "$DESC_JSON" | jq -r '.loggingService // "unspecified"')
    echo "      legacy loggingService: ${LOGGING_SERVICE}"

    echo
  done <<< "$CLUSTER_LIST"

  echo
done

cat <<'EOF'
INTERPRETING RESULTS (MANUAL REVIEW REQUIRED)
--------------------------------------------
This CIS control is MARKED MANUAL and cannot be remediated by changing kube-apiserver flags in GKE.

You must review per cluster:

1. Look at:
     - "api-server audit logging (via enableComponents)"
     - "legacy loggingService"
   for each cluster.

2. Potential issues that require attention:
   - api-server audit logging = "disabled-or-legacy"
     AND loggingService is not "logging.googleapis.com/kubernetes" or
     "logging.googleapis.com/kubernetes" is set but you have not configured
     Audit Logs / Kubernetes Audit Logs in Cloud Logging.
   - No organization/project-level log sinks exist that capture
     Kubernetes API Server or Admin Activity logs for this cluster.

3. For clusters showing "disabled-or-legacy":
   - Confirm in the GCP Console -> Logging -> Logs Router and Logs Explorer
     whether Kubernetes audit / Admin Activity logs for the cluster’s master
     endpoints are being collected and retained according to your policy.

4. For clusters with "enabled" or "enabled-via-ALL":
   - Verify that the collected logs contain the level of detail required for
     your security and compliance requirements, and that retention and
     sink targets (e.g. BigQuery, SIEM) are configured appropriately.

There is no single automated fix; use this report to prioritize which clusters
need deeper review and possible changes to GKE logging / Cloud Logging
configuration to meet the intent of CIS 2.2.1.
EOF