GCP Knowledge Bases
121 articles
- 1.1 Ensure Corporate Login Credentials Are Used (Manual)
- 1.2 Ensure Multi-Factor Authentication is Enabled for All Non-Service Accounts (Manual)
- 1.3 Ensure Security Key Enforcement is Enabled for All Admin Accounts (Manual)
- 1.4 Ensure Only GCP-Managed Service Account Keys Are Used for Each Service Account (Automated)
- 1.5 Ensure Service Accounts Do Not Have Admin Privileges (Automated)
- 1.6 Ensure IAM Users Are Not Assigned Service Account User or Service Account Token Creator Roles at the Project Level (Automated)
- 1.7 Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer (Automated)
- 1.8 Ensure Separation of Duties Is Enforced When Assigning Service Account Roles to Users (Automated)
- 1.9 Ensure Cloud KMS Cryptokeys Are Not Accessible to Anonymous or Public Users (Automated)
- 1.11 Ensure Separation of Duties Is Enforced When Assigning KMS Roles to Users (Automated)
- 1.12 Ensure API Keys Exist Only for Active Services (Automated)
- 1.13 Ensure API Keys Are Restricted to Specific Hosts and Applications (Manual)
- 1.14 Ensure API Keys Are Restricted to Only APIs Required by the Application (Automated)
- 1.15 Ensure API Keys Are Rotated Every 90 Days (Automated)
- 1.16 Ensure Essential Contacts Are Configured for the Organization (Automated)
- 2.1 Ensure Cloud Audit Logging Is Configured Properly (Automated)
- 2.2 Ensure That Sinks Are Configured for All Log Entries (Automated)
- 2.3 Ensure Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock (Automated)
- Ensure Log Metric Filters and Alerts Are Configured for Project Ownership Assignments/Changes (Automated)
- 2.5 Ensure Log Metric Filters and Alerts Exist for Audit Configuration Changes (Automated)
- 2.6 Ensure Log Metric Filter and Alerts Exist for Custom Role Changes (Automated)
- 2.7 Ensure Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes (Automated)
- 2.8 Ensure Log Metric Filter and Alerts Exist for VPC Network Route Changes (Automated)
- 2.9 Ensure Log Metric Filter and Alerts Exist for VPC Network Changes (Automated)
- 2.10 Ensure Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes (Automated)
- 2.11 Ensure Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes (Automated)
- 2.12 Ensure Cloud DNS Logging Is Enabled for All VPC Networks (Automated)
- 2.13 Ensure Cloud Asset Inventory Is Enabled (Automated)
- 2.14 Ensure 'Access Transparency' is 'Enabled' (Manual)
- 2.15 Ensure 'Access Approval' is 'Enabled' (Automated)
- 2.16 Ensure Logging is Enabled for HTTP(S) Load Balancer (Automated)
- 3.1 Ensure That the Default Network Does Not Exist in a Project (Automated)
- 3.2 Ensure Legacy Networks Do Not Exist for Older Projects (Automated)
- 3.3 Ensure That DNSSEC Is Enabled for Cloud DNS (Automated)
- 3.4 Ensure That RSASHA1 Is Not Used for the Key-Signing Key in Cloud DNS DNSSEC (Automated)
- 3.5 Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC (Automated)
- 3.6 Ensure SSH Access Is Restricted From the Internet (Automated)
- 3.7 Ensure That RDP Access Is Restricted From the Internet (Automated)
- 3.8 Ensure VPC Flow Logs Are Enabled for Every Subnet in a VPC Network (Automated)
- 3.9 Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites (Manual)
- 3.10 Use Identity-Aware Proxy (IAP) to Restrict Access to Google IP Addresses Only (Manual)
- 4.1 Ensure Instances Are Not Configured To Use the Default Service Account (Automated)
- 4.2 Ensure Instances Are Not Configured to Use the Default Service Account With Full Access to All Cloud APIs (Automated)
- 4.3 Ensure “Block Project-Wide SSH Keys” Is Enabled for VM Instances (Automated)
- 4.4 Ensure OS Login Is Enabled for a Project (Automated)
- 4.5 Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instances (Automated)
- 4.6 Ensure That IP Forwarding Is Not Enabled on Instances (Automated)
- 4.7 Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK) (Automated)
- 4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled (Automated)
- 4.9 Ensure Compute Instances Do Not Have Public IP Addresses (Automated)
- 4.10 Ensure That App Engine Applications Enforce HTTPS Connections (Manual)
- 4.11 Ensure That Compute Instances Have Confidential Computing Enabled (Automated)
- 4.12 Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects (Manual)
- 5.1 Ensure Cloud Storage Buckets Are Not Anonymously or Publicly Accessible (Automated)
- 5.2 Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled (Automated)
- 6.1.1 Ensure That a MySQL Database Instance Does Not Allow Anyone To Connect With Administrative Privileges (Manual)
- 6.1.2 Ensure ‘Skip_show_database’ Database Flag for Cloud SQL MySQL Instance Is Set to ‘On’ (Automated)
- 6.1.3 Ensure That the ‘Local_infile’ Database Flag for a Cloud SQL MySQL Instance Is Set to ‘Off’ (Automated)
- 6.2.1 Ensure the ‘Log_error_verbosity’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘DEFAULT’ or Stricter (Automated)
- 6.2.2 Ensure That the ‘Log_connections’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘On’ (Automated)
- 6.2.3 Ensure That the ‘Log_disconnections’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘On’ (Automated)
- 6.2.4 Ensure ‘Log_statement’ Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately (Automated)
- 6.2.5 Ensure the ‘Log_min_messages’ Flag for a Cloud SQL PostgreSQL Instance Is Set to 'Warning' or Higher (Automated)
- 6.2.6 Ensure ‘Log_min_error_statement’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to ‘Error’ or Stricter (Automated)
- 6.2.7 Ensure the ‘Log_min_duration_statement’ Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1' (Disabled) (Automated)
- 6.2.8 Ensure the 'cloudsql.enable_pgaudit' Database Flag for Each Cloud SQL PostgreSQL Instance Is Set to 'on' for Centralized Logging (Automated)
- 6.3.1 Ensure the 'external scripts enabled' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off' (Automated)
- 6.3.2 Ensure the 'cross db ownership chaining' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off' (Automated)
- 6.3.3 Ensure 'user connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value (Automated)
- 6.3.4 Ensure 'user options' Database Flag for Cloud SQL SQL Server Instance Is Not Configured (Automated)
- 6.3.5 Ensure 'remote access' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off' (Automated)
- 6.3.6 Ensure '3625 (Trace Flag)' Database Flag for All Cloud SQL Server Instances Is Set to 'On' (Automated)
- 6.3.7 Ensure 'Contained Database Authentication' Database Flag for Cloud SQL SQL Server Instances Is Not Set to 'On' (Automated)
- 6.4 Ensure All Incoming Connections to Cloud SQL Database Instances Require SSL (Automated)
- 6.5 Ensure Cloud SQL Database Instances Do Not Whitelist All Public IP Addresses (Automated)
- 6.6 Ensure That Cloud SQL Database Instances Do Not Have Public IPs (Automated)
- 6.7 Ensure That Cloud SQL Database Instances Are Configured With Automated Backups (Automated)
- 7.1 Ensure BigQuery Datasets Are Not Anonymously or Publicly Accessible (Automated)
- 7.2 Ensure All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK) (Automated)
- 7.3 Ensure a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Datasets (Automated)
- 7.4 Ensure All Data in BigQuery Is Classified (Manual)
- 8.1 Ensure Dataproc Clusters Are Encrypted Using Customer-Managed Encryption Keys (CMEK) (Automated)
- 1.17 Ensure Secrets Are Not Stored in Cloud Functions Environment Variables by Using Secret Manager (Manual)
- 1.10 Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days (Automated)
- Ensure GKE Clusters Are Not Running Using the Compute Engine Default Service Account
- Ensure Image Vulnerability Scanning Using GCR Container Scanning or a Third-Party Provider
- Ensure Image Vulnerability Analysis Using AR Container Analysis or a Third-Party Provider
- Ensure Any Public Addresses Are Listed in Shodan (Using Shodan API)
- Ensure Instance IP Assignment Is Set to Private
- Ensure Cloud Function is Connected to a VPC Network
- Ensure Cloud Function is Not Publicly Invocable
- Ensure Cloud SQL Instance is Encrypted with a Customer-Managed Key (CMEK)
- Ensure Cloud SQL Instance Has High Availability (REGIONAL) Configured
- Ensure Data Access Audit Logs are Enabled for Cloud Storage
- Ensure Cloud Storage Bucket Has Lifecycle Management Enabled with at Least One Valid Rule
- Ensure Cloud Storage Buckets Have Usage and Storage Logs Enabled
- Ensure Cloud Storage Bucket Has Soft Delete Enabled
- Ensure Cloud Storage Bucket Has a Sufficient Retention Policy Period
- Ensure Cloud Storage Bucket Has Object Versioning Enabled
- Ensure Cloud Storage Services are Protected by VPC Service Controls
- Ensure Compute Engine Disk Image is Not Publicly Shared
- Ensure Compute Engine VM Instances Have Automatic Restart Enabled
- Ensure VM Instance Has Deletion Protection Enabled
- Ensure VM Instance Attached Disks Have Auto-Delete Disabled
- Ensure Managed Instance Group Has Autohealing Enabled with a Valid Health Check
- Ensure Managed Instance Group is Attached to a Load Balancer
- Ensure Managed Instance Groups Span Multiple Zones for High Availability
- Ensure Compute Engine VM Instance Has On Host Maintenance Set to MIGRATE
- Ensure VM Instance is Not Configured as Preemptible or Spot VM
- Ensure VM Instance Has a Single Network Interface
- Ensure Suspended VM Instance Does Not Have Persistent Disks Attached
- Ensure GCP Project Has OS Login with 2FA Enabled
- Ensure Compute Engine Disk Snapshot is Not Outdated
- Ensure Gemini (Generative Language) API is Disabled
- Ensure User-Managed Service Account Key Was Used Within the Allowed Inactivity Period
- Ensure Service Account Was Used Within the Configured Maximum Unused Period
- Ensure Workload Identity Federation Providers Trusting a Multi-Tenant Issuer Enforce an Attribute Condition
- Ensure Compute Engine Configuration Changes are Monitored with Log Metric Filters and Alerts
- Ensure Secret Manager Secret is Not Publicly Accessible
- Ensure Secret Manager Secret is Rotated Every 90 Days or Less
- Ensure API Key is Restricted to Specific Google APIs When the Gemini (Generative Language) API is Enabled