Enabling Legacy Authorization, Attribute-Based Access Control (ABAC), on Google Kubernetes Engine resources can reduce an
organization's ability to protect itself against access controls being compromised.

For Kubernetes, Attribute-Based Access Control has been superseded by Role-Based Access Control.
ABAC is not under active development anymore and thus should be avoided.

== Ask Yourself Whether

* This resource is essential for the information system infrastructure.
* This resource is essential for mission-critical functions.
* Compliance policies require access to this resource to be enforced through the use of Role-Based Access Control.

There is a risk if you answered yes to any of those questions.

== Recommended Secure Coding Practices

Unless you are relying on ABAC, leave it disabled.

== Sensitive Code Example

For https://cloud.google.com/kubernetes-engine[Google Kubernetes Engine]:
[source,terraform]
----
resource "google_container_cluster" "example" {
  enable_legacy_abac = true # Sensitive
}
----

== Compliant Solution

For https://cloud.google.com/kubernetes-engine[Google Kubernetes Engine]:
[source,terraform]
----
resource "google_container_cluster" "example" {
  enable_legacy_abac = false
}
----

== See

* CWE - https://cwe.mitre.org/data/definitions/668[CWE-668 - Exposure of Resource to Wrong Sphere]
* https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#leave_abac_disabled[Google Cloud Documentation] - Hardening your cluster's security

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

* Make sure that enabling attribute-based access control is safe here.

=== Highlighting

* If an assignment is non-compliant, highlight the entire assignment


endif::env-github,rspecator-view[]