Google Cloud Compliance ControlsGoogle Kubernetes Engine
GKE clusters should have 'Legacy Authorization' set to 'Disabled'
This control validates that Kubernetes Engine Clusters have `Legacy Authorization` set to disabled. GKE clusters should use Role-Based Access Control (`RBAC`) rather than Attribute-Based Access Control (`ABAC`) for authorization.
What this control checks
google_container_cluster must not set enable_legacy_abac to true (Legacy Authorization Disabled)
Framework mappings
The clauses this control is mapped to in each framework.
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
disable_gke_legacy_abac - Checkov Check:
CKV_GCP_7 - Powerpipe Control:
gcp_compliance.control.disable_gke_legacy_abac - KICS Query:
5baa92d2-d8ee-4c75-88a4-52d9d8bb8067 - Trivy Check:
GCP-0062
Last reviewed: 2026-10-09