GKE clusters should have 'Legacy Authorization' set to 'Disabled'
This control validates that Kubernetes Engine Clusters have `Legacy Authorization` set to disabled. GKE clusters should use Role-Based Access Control (`RBAC`) rather than Attribute-Based Access Control (`ABAC`) for authorization.
RBAC has significant security advantages and is now stable in Kubernetes, so it's time to disable ABAC. You should disable Attribute-Based Access Control (ABAC), and instead use Role-Based Access Control (RBAC) in GKE.
What this control checks
google_container_cluster must not set enable_legacy_abac to true (Legacy Authorization Disabled)
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.disable_gke_legacy_abac.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_7; KICS query "GKE Legacy Authorization Enabled" (5baa92d2-d8ee-4c75-88a4-52d9d8bb8067); Trivy check GCP-0062.
Framework-specific interpretation
PCI DSS v3.2.1: Mapped to 4.1 (Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open...).
Framework mappings
The clauses this control is mapped to in each framework.
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
disable_gke_legacy_abac - Checkov Check:
CKV_GCP_7 - Powerpipe Control:
gcp_compliance.control.disable_gke_legacy_abac - KICS Query:
5baa92d2-d8ee-4c75-88a4-52d9d8bb8067 - Trivy Check:
GCP-0062
Last reviewed: 2026-10-09