GKE clusters should have Binary Authorization enabled
This control ensures that binary authorization is enabled on GKE clusters. The related Checkov check, CKV_GCP_66, is titled "Ensure use of Binary Authorization" and looks at the `google_container_cluster` resource type for GKE clusters.
What this control checks
GKE clusters must have binary authorization enabled
Common pitfalls
Provider <= v4.28.0 checks enable_binary_authorization
For Google provider version <= v4.28.0, the check uses enable_binary_authorization. It passes when enable_binary_authorization is true.
Provider >= v4.31.0 checks evaluation_mode instead
For Google provider version >= v4.31.0, the check passes when evaluation_mode is PROJECT_SINGLETON_POLICY_ENFORCE.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_binary_authorization_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_66.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to ID.RA-09 (The authenticity and integrity of hardware and software are assessed prior to acquisition and use.), PR.PS-01 (Configuration management practices are established and applied.), PR.PS-05 (Installation and execution of unauthorized software are prevented.) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- ID.RA-09
- PR.PS-01
- PR.PS-05
- PR.PS-06
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_binary_authorization_enabled - Checkov Check:
CKV_GCP_66 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_binary_authorization_enabled
Last reviewed: 2026-10-09