Minimize Cluster Access To Read-Only For Gcr

#!/usr/bin/env bash
#
# Audit script for CIS GKE 5.1.3:
# "Minimize cluster access to read-only for Container Image repositories"
#
# REQUIREMENTS:
# - Run on any machine with:
#     - gcloud, gsutil, jq, and kubectl installed
#     - Access to the target GCP project and GKE clusters
# - You must set or pass the GCP project ID.
#
# USAGE:
#   ./audit_cis_gke_5_1_3.sh <GCP_PROJECT_ID>
#
# OUTPUT:
# - Lists GCP IAM bindings where principals have write/admin-level Storage roles
#   that could allow pushing/overwriting images in GCR/AR.
# - You must manually assess which of these principals are used by the GKE
#   cluster nodes or workloads and whether they should be reduced to read-only.

set -euo pipefail

PROJECT_ID="${1:-}"

if [[ -z "${PROJECT_ID}" ]]; then
  echo "Usage: $0 <GCP_PROJECT_ID>" >&2
  exit 1
fi

echo "=== CIS GKE 5.1.3 audit for project: ${PROJECT_ID} ==="
echo

###############################################################################
# 1. Identify Kubernetes-related service accounts in this project
###############################################################################
echo ">> Discovering Kubernetes-related Google service accounts (GSA)..."
echo

# Common patterns:
# - GKE default node service accounts (if manually created) often include "gke"
# - Workload Identity GSA names vary; we just list all in the project.
gcloud iam service-accounts list \
  --project="${PROJECT_ID}" \
  --format="table(email,displayName)" \
  | sed 's/^/    /'
echo

###############################################################################
# 2. Project-level IAM: find principals with Storage write/admin privileges
###############################################################################
echo ">> Project-level IAM: principals with Storage write/admin-type roles"
echo "   (These may inherit access to GCR buckets or AR repositories)"
echo

gcloud projects get-iam-policy "${PROJECT_ID}" \
  --flatten="bindings[].members" \
  --format='table(bindings.members,bindings.role)' \
  --filter="bindings.role:roles/storage.admin OR bindings.role:roles/storage.objectAdmin OR bindings.role:roles/storage.objectCreator OR bindings.role:roles/storage.legacyBucketOwner OR bindings.role:roles/storage.legacyBucketWriter OR bindings.role:roles/storage.legacyObjectOwner" \
  | sed 's/^/    /'

echo
cat <<'EOF'
Interpretation:
  - Any member here that is a service account used by:
      * GKE node pools (node service accounts), or
      * Workload Identity for pods
    has more than read-only access to GCR/AR via project-level roles.
  - PROBLEM: If a Kubernetes-related service account appears with any of these
    roles, it violates the intent of CIS GKE 5.1.3. It should typically be
    restricted to objectViewer / artifactregistry.reader only.

EOF

###############################################################################
# 3. GCR: bucket-level IAM for artifacts.<project_id>.appspot.com
###############################################################################
GCR_BUCKET="gs://artifacts.${PROJECT_ID}.appspot.com"

echo ">> GCR bucket-level IAM for ${GCR_BUCKET}"
echo

if gsutil ls "${GCR_BUCKET}" >/dev/null 2>&1; then
  gsutil iam get "${GCR_BUCKET}" | jq '.bindings[] | {role: .role, members: .members}' \
    | sed 's/^/    /'
else
  echo "    Bucket ${GCR_BUCKET} does not exist or is not accessible."
fi

cat <<'EOF'

Interpretation:
  - Look for roles that allow write/admin capabilities such as:
      roles/storage.admin
      roles/storage.objectAdmin
      roles/storage.objectCreator
      roles/storage.legacyBucketOwner
      roles/storage.legacyBucketWriter
      roles/storage.legacyObjectOwner
  - PROBLEM: Any Kubernetes-related service account (e.g. GKE node SA or
    Workload Identity GSA) appearing with any of the above roles at this
    bucket is overly privileged and can push/overwrite images.

EOF

###############################################################################
# 4. Artifact Registry: per-repository IAM
###############################################################################
echo ">> Artifact Registry repositories and IAM bindings with elevated roles"
echo

# List all AR repositories
REPOS_JSON="$(gcloud artifacts repositories list \
  --project="${PROJECT_ID}" \
  --location=- \
  --format=json || echo '[]')"

if [[ "${REPOS_JSON}" == "[]" ]]; then
  echo "    No Artifact Registry repositories found in project ${PROJECT_ID}."
else
  echo "${REPOS_JSON}" | jq -r '.[] | "\(.name) \(.format) \(.location)"' | while read -r REPO_NAME REPO_FORMAT REPO_LOCATION; do
    echo "  Repository: ${REPO_NAME} (format=${REPO_FORMAT}, location=${REPO_LOCATION})"
    # Extract repository ID from the full resource name projects/PROJECT/locations/LOC/repositories/REPO
    REPO_ID="$(basename "${REPO_NAME}")"

    # Get IAM policy for the specific repository
    gcloud artifacts repositories get-iam-policy "${REPO_ID}" \
      --project="${PROJECT_ID}" \
      --location="${REPO_LOCATION}" \
      --format=json \
      | jq '.bindings[] | select(.role | test("artifactregistry.admin|artifactregistry.writer|storage.admin|storage.objectAdmin|storage.objectCreator|storage.legacyBucketOwner|storage.legacyBucketWriter|storage.legacyObjectOwner"))' \
      | sed 's/^/    /' || true

    echo
  done
fi

cat <<'EOF'
Interpretation:
  - Focus on roles that exceed read-only, such as:
      roles/artifactregistry.admin
      roles/artifactregistry.writer
      roles/storage.admin
      roles/storage.objectAdmin
      roles/storage.objectCreator
      roles/storage.legacyBucketOwner
      roles/storage.legacyBucketWriter
      roles/storage.legacyObjectOwner
  - PROBLEM: If any Kubernetes-related service account (node SA or workload
    GSA) has one of these roles on an Artifact Registry repository, it can
    push/overwrite images, violating the control's intent.

EOF

###############################################################################
# 5. Map Kubernetes identities to GCP service accounts (for review)
###############################################################################
echo ">> (Optional) Mapping K8s → GCP identities for Workload Identity (for review)"
echo "   Run from a machine with kubectl configured for this cluster."
echo

# This section does NOT change anything; it only helps correlate principals.
if kubectl get ns >/dev/null 2>&1; then
  echo "  Kubernetes service accounts annotated with GSA (Workload Identity):"
  kubectl get serviceaccounts --all-namespaces -o json \
    | jq -r '
        .items[]
        | {
            namespace: .metadata.namespace,
            name: .metadata.name,
            gsa: (.metadata.annotations["iam.gke.io/gcp-service-account"] // "")
          }
        | select(.gsa != "")
        | "\(.namespace)/\(.name) -> \(.gsa)"
      ' \
    | sed 's/^/    /'
else
  echo "    kubectl not configured or cluster not reachable; skipping K8s mapping."
fi

cat <<'EOF'

Interpretation:
  - For each "namespace/serviceaccount -> GSA" mapping above:
      * Check if that GSA appears in the project-level, GCR bucket-level,
        or Artifact Registry IAM outputs with any write/admin-style role.
  - PROBLEM: A mapped GSA that also appears with elevated Storage or
    Artifact Registry roles is a candidate for restriction to read-only
    roles (e.g., objectViewer, artifactregistry.reader).

FINAL REVIEW:
  - A finding is considered problematic when:
      * A node service account or any GSA used by your workloads
        has more than read-only permissions on:
          - GCR bucket: artifacts.<project_id>.appspot.com, or
          - Any Artifact Registry repository.
  - Use this script's output to build a list of:
      K8s SA  →  GSA  →  Roles on GCR/AR
    and then decide which roles should be reduced to:
      - roles/storage.objectViewer (for GCR)
      - roles/artifactregistry.reader (for AR)
EOF