> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Security Posture

### More Info:

Enable the GKE Security Posture dashboard so the cluster is continuously assessed for misconfigurations and known workload vulnerabilities. It provides ongoing security visibility and recommendations.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On any machine with `gcloud` configured for the project, identify the cluster(s) to review:
           ```sh theme={null}
           gcloud container clusters list --project PROJECT_ID
           ```

        2. For each relevant cluster, retrieve the current Security Posture configuration:
           ```sh theme={null}
           gcloud container clusters describe CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --format json | jq '.securityPostureConfig'
           ```

        3. Review the output and confirm whether Security Posture is enabled at the desired level:
           * `{"mode":"STANDARD"}` (or similar) → Security Posture is enabled.
           * `null` or `"mode":"DISABLED"` (or missing `mode`) → Security Posture is not enabled.\
             Document which clusters do not have `"mode": "STANDARD"` (or stricter, if available in your environment).

        4. For each cluster where Security Posture is not enabled and you decide it should be, enable it:
           ```sh theme={null}
           gcloud container clusters update CLUSTER_NAME \
             --location=LOCATION \
             --project=PROJECT_ID \
             --security-posture=standard
           ```

        5. Re-verify that the setting is applied for each updated cluster:
           ```sh theme={null}
           gcloud container clusters describe CLUSTER_NAME \
             --location LOCATION \
             --project PROJECT_ID \
             --format json | jq '.securityPostureConfig'
           ```
           Confirm the `mode` now reflects `"STANDARD"`.

        6. Optionally, validate visibility in the Google Cloud console:
           * Navigate to “Kubernetes Engine” → select the cluster.
           * Open the “Security posture” or “Security” section and confirm that the Security Posture dashboard is present and showing assessment data.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot enable or configure the GKE Security Posture feature because it is a managed control-plane setting controlled via Google Cloud (gcloud/console/IaC), not a Kubernetes API object. To remediate this finding, follow the guidance in the Manual Steps section using the Google Cloud console, gcloud CLI, or your IaC tooling.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Report GKE Security Posture status for all clusters in one or more projects.
        # Requirements:
        #   - gcloud
        #   - jq
        #
        # Usage:
        #   ./report_gke_security_posture.sh              # all active projects in current gcloud account
        #   GCP_PROJECTS="proj-a proj-b" ./report_gke_security_posture.sh

        set -euo pipefail

        # Determine project list
        if [[ -n "${GCP_PROJECTS:-}" ]]; then
          PROJECTS=${GCP_PROJECTS}
        else
          PROJECTS=$(gcloud projects list --format="value(projectId)")
        fi

        if [[ -z "${PROJECTS}" ]]; then
          echo "No projects found. Set GCP_PROJECTS or ensure your account has projects."
          exit 1
        fi

        echo "Project,Location,Cluster,SecurityPostureMode,WorkloadVulnScanning,SBOMGeneration"

        for PROJECT in ${PROJECTS}; do
          # List all GKE clusters in the project (all locations)
          CLUSTERS_JSON=$(gcloud container clusters list \
            --project "${PROJECT}" \
            --format=json 2>/dev/null || echo "[]")

          echo "${CLUSTERS_JSON}" | jq -c '.[]' | while read -r CL; do
            NAME=$(echo "${CL}" | jq -r '.name')
            LOCATION=$(echo "${CL}" | jq -r '.location')

            # Describe cluster to get detailed security posture config
            DESC=$(gcloud container clusters describe "${NAME}" \
              --location "${LOCATION}" \
              --project "${PROJECT}" \
              --format=json 2>/dev/null || echo "{}")

            MODE=$(echo "${DESC}" | jq -r '.securityPostureConfig.mode // "UNSPECIFIED"')
            WORKLOAD_VULN=$(echo "${DESC}" | jq -r '.securityPostureConfig.vulnerabilityMode // "UNSPECIFIED"')
            SBOM_MODE=$(echo "${DESC}" | jq -r '.securityPostureConfig.workloadSbomMode // "UNSPECIFIED"')

            echo "${PROJECT},${LOCATION},${NAME},${MODE},${WORKLOAD_VULN},${SBOM_MODE}"
          done
        done
        ```

        Interpretation of the output (what indicates a problem):

        * For each cluster, review the `SecurityPostureMode` column:
          * `STANDARD` (or `ENFORCED`/similar if introduced later) indicates Security Posture is enabled as expected.
          * `DISABLED`, `UNSPECIFIED`, or an empty value indicates a problem for this control: the Security Posture dashboard is not enabled on that cluster and should be reviewed and (if appropriate) enabled using:

            ```bash theme={null}
            gcloud container clusters update CLUSTER_NAME \
              --location=CONTROL_PLANE_LOCATION \
              --security-posture=standard
            ```

        * Optionally, review `WorkloadVulnScanning` and `SBOMGeneration`:
          * Values other than enabled/standard modes (e.g., `DISABLED`, `UNSPECIFIED`) indicate missing coverage for vulnerability scanning or SBOM generation and warrant a configuration review.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>