Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
cloudsql_instance_public_access
Cloud SQL authorized networks are checked for the open CIDR 0.0.0.0/0 on instances using a public IP.
The finding flags configurations where a catch-all entry exists instead of specific client ranges.
cloudsql_instance_public_ip
Cloud SQL instances are evaluated for exposure via public IP addresses instead of private IP connectivity within a VPC.
Instances with an externally routable database endpoint are surfaced.
cloudsql_instance_sqlserver_contained_database_authentication_flag
Cloud SQL for SQL Server instances are evaluated for the contained database authentication setting. The check inspects the contained database authentication flag and expects its value to be off.
cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag
Cloud SQL SQL Server instances are evaluated for the cross db ownership chaining server flag. The finding identifies SQL Server instances where this flag isn't set to off, meaning cross-database ownership chaining is permitted.
cloudsql_instance_sqlserver_external_scripts_enabled_flag
Cloud SQL for SQL Server instances have the external scripts enabled database flag set to off
cloudsql_instance_sqlserver_remote_access_flag
Cloud SQL for SQL Server instances where the remote access database flag is on, allowing remote procedure calls between servers
cloudsql_instance_sqlserver_trace_flag
Cloud SQL for SQL Server instances have the 3625 (trace flag) database flag set to on
cloudsql_instance_sqlserver_user_connections_flag
Cloud SQL for SQL Server instances are evaluated to ensure the user connections database flag is set to 0 (unlimited), avoiding any artificial cap on concurrent user sessions
cloudsql_instance_sqlserver_user_options_flag
Cloud SQL for SQL Server instances are evaluated for the user options database flag configured with any value.
This flag sets global defaults for session SET behaviors; the check identifies instances where this global override is present.
cloudsql_instance_ssl_connections
Cloud SQL instances enforce SSL/TLS-only connections, rejecting plaintext traffic. The connection policy requires encryption for all clients (e.g., ENCRYPTED_ONLY or TRUSTED_CLIENT_CERTIFICATE_REQUIRED) instead of allowing both encrypted and unencrypted connections.
cloudstorage_audit_logs_enabled
Data Access audit logs (DATA_READ and DATA_WRITE) are enabled for Cloud Storage at the project level. Unlike Admin Activity logs (enabled by default), Data Access logs must be explicitly configured to track read and write operations on Cloud Storage objects.
cloudstorage_bucket_lifecycle_management_enabled
Cloud Storage buckets use Object Lifecycle Management with at least one valid rule (supported action and non-empty condition) to automatically transition storage class or delete objects.
cloudstorage_bucket_logging_enabled
Google Cloud Storage buckets are evaluated to ensure that Usage and Storage Logs are enabled. Enabling these logs provides detailed visibility into access requests, usage patterns, and storage activity within each bucket.
cloudstorage_bucket_log_retention_policy_lock
Cloud Storage log sink buckets have a configured retention period with Bucket Lock applied, ensuring the retention policy cannot be shortened or removed.
cloudstorage_bucket_public_access
Cloud Storage buckets are assessed for anonymous or public access by detecting permissions granted to broad principals like allUsers or allAuthenticatedUsers that make bucket data reachable without authentication.
cloudstorage_bucket_soft_delete_enabled
Google Cloud Storage buckets are assessed for Soft Delete being enabled with a non-zero retention window, meaning deleted objects are temporarily preserved and can be restored until the window expires.
cloudstorage_bucket_sufficient_retention_period
Cloud Storage bucket has a bucket-level Retention Policy with a retentionPeriod that meets or exceeds the organization-defined minimum, preventing deletion or modification of objects before the required time.
cloudstorage_bucket_uniform_bucket_level_access
Cloud Storage buckets have uniform bucket-level access (UBLA) enabled so object permissions are controlled solely by bucket-level IAM, with object ACLs disabled.
cloudstorage_bucket_versioning_enabled
Cloud Storage buckets with Object Versioning keep prior object generations. The finding indicates whether the bucket's versioning setting is enabled.
cloudstorage_uses_vpc_service_controls
GCP Projects are evaluated to ensure they have VPC Service Controls enabled for Cloud Storage. VPC Service Controls establish security boundaries by restricting access to Cloud Storage resources to specific networks and trusted clients, preventing unauthorized data access and exfiltration.
compute_firewall_rdp_access_from_the_internet_allowed
VPC firewall rules permitting inbound RDP (TCP 3389) from 0.0.0.0/0 are flagged, including ingress rules that allow all TCP ports or all protocols
compute_firewall_ssh_access_from_the_internet_allowed
VPC firewall rules allowing Internet-sourced ingress (0.0.0.0/0) to TCP port 22 (SSH) are identified, including rules using protocol all or tcp whose ports or ranges include 22.
compute_image_not_publicly_shared
Custom disk images should not be shared publicly with allAuthenticatedUsers. Per Google Cloud API restrictions, allUsers cannot be assigned to Compute Engine images. The concern is allAuthenticatedUsers, which grants access to anyone with a Google account, potentially exposing application snapshots and sensitive data.
compute_instance_automatic_restart_enabled
Google Compute Engine virtual machine instances are evaluated to ensure that Automatic Restart is enabled. This feature allows the Google Cloud Compute Engine service to automatically restart VM instances when they are terminated due to non-user-initiated reasons such as maintenance events, hardware failures, or software failures.