Google CloudOverview
Basic authentication allows a user to authenticate to the cluster with a username and password and it is stored in plain text without any encryption. Disabling Basic authentication will prevent attacks like brute force. Its recommended to use either client certificate or IAM for authentication.
Rationale
When disabled, you will still be able to authenticate to the cluster with client certificate or IAM. A client certificate is a base64-encoded public certificate used by clients to authenticate to the cluster endpoint. Disable client certificate generation to create a cluster without a client certificate.
Remediation guidance
Using Console
- Go to Kubernetes GCP Console by visiting https://console.cloud.google.com/kubernetes/list?
- Select Kubernetes clusters for which Basic authentication is not used
- Click on EDIT button and Set Basic authentication to Disabled under Cluster section
Default Value
By default, Basic authentication is enabled when you create a new cluster.
References
- https://cloud.google.com/kubernetes-engine/docs/how-to/iam-integration
Multiple Remediation Paths
Google Cloud
SERVICE-WIDE (RECOMMENDED when many resources are affected): Enforce Organization Policies at org/folder level so new resources inherit secure defaults.
gcloud org-policies set-policy policy.yaml
ASSET-LEVEL: Use the product-specific remediation steps above for only the impacted project/resources.
PREVENTIVE: Use org policy constraints/custom constraints and enforce checks in deployment pipelines.
References for Service-Wide Patterns
- GCP Organization Policy overview: https://cloud.google.com/resource-manager/docs/organization-policy/overview
- GCP Organization policy constraints catalog: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
- gcloud org-policies: https://cloud.google.com/sdk/gcloud/reference/org-policies
Operational Rollout Workflow
Use this sequence to reduce risk and avoid repeated drift.
1. Contain at Service-Wide Scope First (Recommended)
- Google Cloud: apply organization policy constraints at org/folder scope.
gcloud org-policies set-policy policy.yaml
2. Remediate Existing Affected Assets
- Execute the control-specific Console/CLI steps documented above for each flagged resource.
- Prioritize internet-exposed and production assets first.
3. Validate and Prevent Recurrence
- Re-scan after each remediation batch.
- Track exceptions with owner and expiry date.
- Add preventive checks in IaC/CI pipelines.
Query logic
These are the stored checks tied to this control.
Basic Authentication is disabled on Kubernetes Engine Clusters
Connectors
Covered asset types
Expected check: eq []
{gkeClusters(where:{OR:[{masterAuthUsername_NOT:"" masterAuthPassword_NOT:""}]}){...AssetFragment}}
