Enabling Legacy Authorization, Attribute-Based Access Control (ABAC), on Google Kubernetes Engine resources can reduce an organization’s ability to
protect itself against access controls being compromised.
For Kubernetes, Attribute-Based Access Control has been superseded by Role-Based Access Control. ABAC is not under active development anymore and
thus should be avoided.
Ask Yourself Whether
- This resource is essential for the information system infrastructure.
- This resource is essential for mission-critical functions.
- Compliance policies require access to this resource to be enforced through the use of Role-Based Access Control.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
Unless you are relying on ABAC, leave it disabled.
Sensitive Code Example
For Google Kubernetes Engine:
resource "google_container_cluster" "example" {
enable_legacy_abac = true # Sensitive
}
Compliant Solution
For Google Kubernetes Engine:
resource "google_container_cluster" "example" {
enable_legacy_abac = false
}
See
