Kingdom: Environment

This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms.

GCP Terraform Misconfiguration: GKE Node Auto-Upgrade Disabled

Abstract

A Terraform configuration disables automatic upgrades of Kubernetes nodes.

Explanation

By default, GKE automatically upgrades Kubernetes nodes to newer stable versions. Automatic upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

Example 1: The following example Terraform configuration disables automatic upgrades of Kubernetes nodes by setting auto_upgrade to false in the management block.


resource "google_container_node_pool" "node_pool_demo" {
...
  management {
    auto_upgrade = false
    ...
  }
...
}

References

[1] HashiCorp google_container_node_pool

[2] Google Cloud Auto-upgrading nodes

[3] Standards Mapping - CIS Google Kubernetes Engine Benchmark Recommendation 5.5.3

[4] Standards Mapping - FIPS200 CM

[5] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-2 Flaw Remediation (P1)

[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-2 Flaw Remediation

[8] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[9] Standards Mapping - OWASP Top 10 2017 A9 Using Components with Known Vulnerabilities

[10] Standards Mapping - OWASP Top 10 2021 A06 Vulnerable and Outdated Components

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.2

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.3.3

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.3.3

[14] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 10.2 - Threat and Vulnerability Management

[15] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 10.2 - Threat and Vulnerability Management

[16] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 10.2 - Threat and Vulnerability Management, Control Objective C.1.6 - Web Software Components & Services

desc.structural.hcl.gcp_terraform_misconfiguration_gke_node_auto_upgrade_disabled