Policy: GCP > CIS v1 > 7 Kubernetes Engine > 7.18 Ensure Kubernetes Clusters created with limited service account Access scopes for Project access (Scored) > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

Using Command line: To check Access scopes set for an existing cluster, run the following command: gcloud container node-pools describe [NODE_NAME] --cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] --format json | jq '.config.oauthScopes' The output of the above command will return array set access scopes. Make sure you have provided limited required scopes for each node clusters. If you are accessing private images in Google Container Registry, the minimally required scopes are only logging.write, monitoring, and devstorage.read_only.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in GCP > CIS v1 > Maximum Attestation Duration. Set to a blank value to clear the attestation.