Ensure that "Disable Workload Identity Cluster Creation" policy is enforced at the GCP organization level in order to require that any new Google Kubernetes Engine (GKE) clusters have the Workload Identity feature disabled at the time of their creation. This constraint policy is useful when you want to tightly control service account access in your organization by disabling Workload Identity in addition to service account creation and service account key creation.
The applications running on GKE clusters must authenticate to use Google Cloud APIs such as the Compute APIs, Storage and Database APIs, or Machine Learning APIs. With Workload Identity feature, you can configure a Kubernetes service account to act as a Google service account in order to access Google Cloud APIs. This enables you to assign fine-grained identity and authorization for applications in your GKE cluster. From a security perspective, Workload Identity allows Google Kubernetes Engine (GKE) service to assert Kubernetes service account identities that can be authorized to access Google Cloud resources. Administrators who have taken actions to isolate GKE workloads from other Google Cloud resources, like disabling service account creation or disabling service account key creation, might also want to disable Workload Identity for GKE clusters.
To determine if "Disable Workload Identity Cluster Creation" policy is enforced at the GCP organization level, perform the following actions:
Remediation / Resolution
To enforce the "Disable Workload Identity Cluster Creation" policy at the Google Cloud Platform (GCP) organization level, perform the following actions:
- Google Cloud Platform (GCP) Documentation
- Organization policy constraints
- Using constraints
- Restricting service account usage
- Using Workload Identity
- GCP Command Line Interface (CLI) Documentation
- gcloud organizations list
- gcloud alpha resource-manager org-policies describe
- gcloud alpha resource-manager org-policies enable-enforce
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Disable Workload Identity at Cluster Creation
Risk level: Medium