Skip to main content

GCP Enable Security Posture - Security Rule

More Info:​

Enable the GKE Security Posture dashboard so the cluster is continuously assessed for misconfigurations and known workload vulnerabilities. It provides ongoing security visibility and recommendations.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. On any machine with gcloud configured for the project, identify the cluster(s) to review:

    gcloud container clusters list --project PROJECT_ID

  2. For each relevant cluster, retrieve the current Security Posture configuration:

    gcloud container clusters describe CLUSTER_NAME \
      --location LOCATION \
      --project PROJECT_ID \
      --format json | jq '.securityPostureConfig'

  3. Review the output and confirm whether Security Posture is enabled at the desired level:

    • {"mode":"STANDARD"} (or similar) → Security Posture is enabled.
    • null or "mode":"DISABLED" (or missing mode) → Security Posture is not enabled.
      Document which clusters do not have "mode": "STANDARD" (or stricter, if available in your environment).

  4. For each cluster where Security Posture is not enabled and you decide it should be, enable it:

    gcloud container clusters update CLUSTER_NAME \
      --location=LOCATION \
      --project=PROJECT_ID \
      --security-posture=standard

  5. Re-verify that the setting is applied for each updated cluster:

    gcloud container clusters describe CLUSTER_NAME \
      --location LOCATION \
      --project PROJECT_ID \
      --format json | jq '.securityPostureConfig'

    Confirm the mode now reflects "STANDARD".

  6. Optionally, validate visibility in the Google Cloud console:

    • Navigate to “Kubernetes Engine” → select the cluster.
    • Open the “Security posture” or “Security” section and confirm that the Security Posture dashboard is present and showing assessment data.
Using kubectl

kubectl cannot enable or configure the GKE Security Posture feature because it is a managed control-plane setting controlled via Google Cloud (gcloud/console/IaC), not a Kubernetes API object. To remediate this finding, follow the guidance in the Manual Steps section using the Google Cloud console, gcloud CLI, or your IaC tooling.

Automation
#!/usr/bin/env bash
#
# Report GKE Security Posture status for all clusters in one or more projects.
# Requirements:
#   - gcloud
#   - jq
#
# Usage:
#   ./report_gke_security_posture.sh              # all active projects in current gcloud account
#   GCP_PROJECTS="proj-a proj-b" ./report_gke_security_posture.sh

set -euo pipefail

# Determine project list
if [[ -n "${GCP_PROJECTS:-}" ]]; then
  PROJECTS=${GCP_PROJECTS}
else
  PROJECTS=$(gcloud projects list --format="value(projectId)")
fi

if [[ -z "${PROJECTS}" ]]; then
  echo "No projects found. Set GCP_PROJECTS or ensure your account has projects."
  exit 1
fi

echo "Project,Location,Cluster,SecurityPostureMode,WorkloadVulnScanning,SBOMGeneration"

for PROJECT in ${PROJECTS}; do
  # List all GKE clusters in the project (all locations)
  CLUSTERS_JSON=$(gcloud container clusters list \
    --project "${PROJECT}" \
    --format=json 2>/dev/null || echo "[]")

  echo "${CLUSTERS_JSON}" | jq -c '.[]' | while read -r CL; do
    NAME=$(echo "${CL}" | jq -r '.name')
    LOCATION=$(echo "${CL}" | jq -r '.location')

    # Describe cluster to get detailed security posture config
    DESC=$(gcloud container clusters describe "${NAME}" \
      --location "${LOCATION}" \
      --project "${PROJECT}" \
      --format=json 2>/dev/null || echo "{}")

    MODE=$(echo "${DESC}" | jq -r '.securityPostureConfig.mode // "UNSPECIFIED"')
    WORKLOAD_VULN=$(echo "${DESC}" | jq -r '.securityPostureConfig.vulnerabilityMode // "UNSPECIFIED"')
    SBOM_MODE=$(echo "${DESC}" | jq -r '.securityPostureConfig.workloadSbomMode // "UNSPECIFIED"')

    echo "${PROJECT},${LOCATION},${NAME},${MODE},${WORKLOAD_VULN},${SBOM_MODE}"
  done
done

Interpretation of the output (what indicates a problem):

  • For each cluster, review the SecurityPostureMode column:

    • STANDARD (or ENFORCED/similar if introduced later) indicates Security Posture is enabled as expected.

    • DISABLED, UNSPECIFIED, or an empty value indicates a problem for this control: the Security Posture dashboard is not enabled on that cluster and should be reviewed and (if appropriate) enabled using:

      gcloud container clusters update CLUSTER_NAME \
        --location=CONTROL_PLANE_LOCATION \
        --security-posture=standard

  • Optionally, review WorkloadVulnScanning and SBOMGeneration:

    • Values other than enabled/standard modes (e.g., DISABLED, UNSPECIFIED) indicate missing coverage for vulnerability scanning or SBOM generation and warrant a configuration review.