> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Legacy Authorization (ABAC) Is Disabled

### More Info:

Disable legacy ABAC authorization so access is governed by RBAC, which offers finer-grained and safer permission control. ABAC grants broad access and is deprecated.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. From any machine with `gcloud` access, confirm the current ABAC setting for the cluster:
           ```bash theme={null}
           gcloud container clusters describe CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --format json | jq '.legacyAbac'
           ```
           Review:
           * If the field is `null` or `"enabled": false`, legacy ABAC is not in use.
           * If `"enabled": true`, ABAC is enabled and should be reviewed/disabled.

        2. If ABAC is enabled, identify teams or systems that might depend on it by reviewing existing RBAC configuration from any machine with `kubectl` access:
           ```bash theme={null}
           kubectl get clusterrole,clusterrolebinding,role,rolebinding -A -o wide
           ```
           Assess whether all needed access appears to be represented in RBAC (roles and bindings) rather than undocumented ABAC policies.

        3. Still from a machine with `gcloud` access, capture and review the full cluster configuration for context (e.g., for change review / change ticket):
           ```bash theme={null}
           gcloud container clusters describe CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --format yaml > cluster-config-before-abac-disable.yaml
           ```
           Store this output as evidence and for rollback analysis.

        4. If you determine there is no required dependency on ABAC (or you have confirmed equivalent RBAC rules exist), plan a change window because this is a control-plane configuration change. Then, from a machine with `gcloud` access, disable legacy authorization:
           ```bash theme={null}
           gcloud container clusters update CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --no-enable-legacy-authorization
           ```

        5. After the update completes, verify that ABAC is disabled from a machine with `gcloud` access:
           ```bash theme={null}
           gcloud container clusters describe CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --format json | jq '.legacyAbac'
           ```
           Confirm the output is `null` or shows `"enabled": false`.

        6. From any machine with `kubectl` access, perform a quick access-validation check for a few representative service accounts / users (to ensure RBAC covers necessary permissions), for example:
           ```bash theme={null}
           kubectl auth can-i list pods --as system:serviceaccount:DEFAULT_NAMESPACE:SERVICE_ACCOUNT
           ```
           Adjust RBAC roles and bindings as needed if any required access is now denied.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot enable or disable Legacy Authorization (ABAC) because this setting is controlled at the managed control-plane / cloud provider configuration level for the GKE cluster. To remediate this finding, follow the guidance in the Manual Steps section using `gcloud`, the cloud console, or your IaC tooling.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Check Legacy Authorization (ABAC) status for all GKE clusters in one or more projects.
        #
        # Requirements:
        #   - gcloud
        #   - jq
        #
        # Usage examples:
        #   ./check-gke-abac.sh
        #   ./check-gke-abac.sh my-project-1 my-project-2

        set -euo pipefail

        if ! command -v gcloud >/dev/null 2>&1; then
          echo "ERROR: gcloud not found in PATH" >&2
          exit 1
        fi

        if ! command -v jq >/dev/null 2>&1; then
          echo "ERROR: jq not found in PATH" >&2
          exit 1
        fi

        PROJECTS=("$@")
        if [ "${#PROJECTS[@]}" -eq 0 ]; then
          # Default to all active projects in the current account
          mapfile -t PROJECTS < <(gcloud projects list --format="value(projectId)")
        fi

        echo "PROJECT,LOCATION,CLUSTER_NAME,ABAC_ENABLED"

        for PROJECT in "${PROJECTS[@]}"; do
          # List all clusters in the project across all locations
          mapfile -t CLUSTERS < <(
            gcloud container clusters list \
              --project "${PROJECT}" \
              --format="value(name,location)" 2>/dev/null || true
          )

          if [ "${#CLUSTERS[@]}" -eq 0 ]; then
            continue
          fi

          for ENTRY in "${CLUSTERS[@]}"; do
            CLUSTER_NAME=$(awk '{print $1}' <<<"${ENTRY}")
            LOCATION=$(awk '{print $2}' <<<"${ENTRY}")

            # Describe cluster and extract legacyAbac.enabled
            DESC_JSON=$(gcloud container clusters describe "${CLUSTER_NAME}" \
              --location "${LOCATION}" \
              --project "${PROJECT}" \
              --format=json 2>/dev/null || echo '{}')

            # Some clusters may not have legacyAbac field at all; treat that as disabled
            ENABLED=$(jq -r '.legacyAbac.enabled // "false"' <<<"${DESC_JSON}")

            echo "${PROJECT},${LOCATION},${CLUSTER_NAME},${ENABLED}"
          done
        done
        ```

        How to use and interpret:

        1. Run from any machine with `gcloud` configured and access to the target projects:
           ```bash theme={null}
           chmod +x check-gke-abac.sh
           ./check-gke-abac.sh            # all projects in your account
           ./check-gke-abac.sh proj-a     # specific project(s)
           ```

        2. Output is CSV:
           * `ABAC_ENABLED` is either `true` or `false`.

        3. **Problematic state (requires review/remediation):**
           * Any line where `ABAC_ENABLED` is `true` indicates that Legacy Authorization (ABAC) is enabled on that cluster and should be reviewed and typically disabled:
             ```text theme={null}
             my-project,us-central1,prod-cluster,true   <-- needs attention
             ```

        4. **Compliant state:**
           * Lines with `ABAC_ENABLED` equal to `false` (or where the field is absent and treated as `false`) are aligned with the benchmark expectation:
             ```text theme={null}
             my-project,us-central1,prod-cluster,false  <-- OK
             ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>