Checks

Cloud Functions are attached to a Serverless VPC Access connector so egress traffic is routed through a private VPC network instead of the public internet.

The evaluation reviews each function's network configuration to confirm that a connector is configured.

Cloud Functions deny invocation to allUsers and allAuthenticatedUsers, so only explicitly authorized identities or services can trigger them.

The evaluation reviews each function's IAM policy bindings to confirm no public principals are granted invoker access.

OCI Cloud Guard status in the tenancy's root compartment is evaluated, expecting ENABLED to indicate the service is active for organization-wide detection and response.

Cloud SQL instances are checked for automated backups being configured to run on a schedule and support point-in-time recovery.

Cloud SQL instances use customer-managed encryption keys (CMEK) via Cloud KMS for at-rest encryption. The evaluation identifies instances lacking a configured Cloud KMS key, indicating use of default Google-managed encryption instead.

Ensures that Cloud SQL instances have high availability configured by setting availabilityType to REGIONAL. A REGIONAL instance maintains a standby replica in a different zone within the same region and automatically fails over on zone-level outages.

Cloud SQL for MySQL instances are evaluated for the local_infile database flag being explicitly set to off, disabling use of LOAD DATA LOCAL.

Instances where local_infile is absent or not off are identified.

Cloud SQL MySQL instances configure the skip_show_database database flag to on, limiting use of SHOW DATABASES to accounts with the SHOW DATABASES privilege.

Cloud SQL for PostgreSQL instances are evaluated for the database flag cloudsql.enable_pgaudit being set to on

Cloud SQL for PostgreSQL instances have the log_connections flag set to on, causing the server to record every connection attempt and the result of client authentication.

Cloud SQL for PostgreSQL instances have the log_disconnections flag set to on, creating a record each time a client session ends, including its duration and status

Cloud SQL for PostgreSQL evaluates the log_error_verbosity database flag and expects the value default.

Configurations using terse or verbose are flagged as deviations.

Cloud SQL for PostgreSQL evaluates whether log_min_duration_statement is set to -1, disabling statement duration logging.

Cloud SQL for PostgreSQL uses the log_min_error_statement flag and expects it set to error, the severity threshold that controls when SQL text is logged with error messages.

Cloud SQL for PostgreSQL instances are evaluated for the log_min_messages flag being set to a sufficiently high severity. Instances with the flag missing or set below ERROR (e.g., DEBUG*, INFO, NOTICE) are identified.

Cloud SQL for PostgreSQL instances have log_statement set to ddl, recording only data definition statements in server logs

Cloud SQL instances are evaluated for IP assignment, highlighting instances that have any public IP instead of being restricted to private IP only.

Cloud SQL authorized networks are checked for the open CIDR 0.0.0.0/0 on instances using a public IP.

The finding flags configurations where a catch-all entry exists instead of specific client ranges.

Cloud SQL instances are evaluated for exposure via public IP addresses instead of private IP connectivity within a VPC.

Instances with an externally routable database endpoint are surfaced.

Cloud SQL for SQL Server instances are evaluated for the contained database authentication setting. The check inspects the contained database authentication flag and expects its value to be off.

Cloud SQL SQL Server instances are evaluated for the cross db ownership chaining server flag. The finding identifies SQL Server instances where this flag isn't set to off, meaning cross-database ownership chaining is permitted.

Cloud SQL for SQL Server instances have the external scripts enabled database flag set to off

Cloud SQL for SQL Server instances where the remote access database flag is on, allowing remote procedure calls between servers

Cloud SQL for SQL Server instances have the 3625 (trace flag) database flag set to on