GKE clusters should have 'Master authorized networks' set to 'Enabled'
Checks that GKE clusters have `master authorized networks` enabled. When authorized networks are enabled, access to the cluster control plane (master) can be restricted to a fixed set of CIDR ranges instead of being open broadly.
Enabling authorized networks means you can restrict master access to a fixed set of CIDR ranges.
What this control checks
Checks the GKE cluster Master authorized networks setting
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.enable_gke_master_authorized_networks.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_20; Trivy check GCP-0061.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- 1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
enable_gke_master_authorized_networks - Checkov Check:
CKV_GCP_20 - Powerpipe Control:
gcp_compliance.control.enable_gke_master_authorized_networks - Trivy Check:
GCP-0061
Last reviewed: 2026-10-09