Checks

VPC flow logs record information about all traffic, which is a vital tool in reviewing anomalous traffic.

Use of project-wide SSH keys means that a compromise of any one of these key pairs can result in all instances being compromised. It is recommended to use instance-level keys.

Instances should not be publicly exposed to the internet

When serial port access is enabled, the access is not governed by network security rules meaning the port can be exposed publicly.

Using unmanaged keys makes rotation and general management difficult.

Using unmanaged keys makes rotation and general management difficult.

Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

OS Login automatically revokes the relevant SSH keys when an IAM user has their access revoked.

Sensitive values such as raw encryption keys should not be included in your Terraform code, and should be stored securely by a secrets manager.

TLS versions prior to 1.2 are outdated and insecure. You should use 1.2 as aminimum version.

The virtual TPM provides numerous security measures to your VM.

OS Login automatically revokes the relevant SSH keys when an IAM user has their access revoked.

Disabling IP forwarding ensures the instance can only receive packets addressed to the instance and can only send packets with a source address of the instance.

The default service account has full project access. Instances should instead be assigned the minimal access they need.

Integrity monitoring helps you understand and make decisions about the state of your VM instances.

Using 'allAuthenticatedUsers' provides any GCP user - even those outside of your organisation - access to your BigQuery dataset.

The Compute Engine instance metadata server exposes legacy v0.1 and v1beta1 endpoints, which do not enforce metadata query headers.

This is a feature in the v1 APIs that makes it more difficult for a potential attacker to retrieve instance metadata.

Unless specifically required, we recommend you disable these legacy APIs.

When setting the <code>metadata</code> block, the default value for <code>disable-legacy-endpoints</code> is set to true, they should not be explicitly enabled.

IP aliasing allows the reuse of public IPs internally, removing the need for a NAT gateway.

You should create and use a minimally privileged service account to run your GKE cluster instead of using the Compute Engine default service account.

Labels make it easier to manage assets and differentiate between clusters and environments, allowing the mapping of computational resources to the wider organisational structure.

StackDriver monitoring aggregates logs, events, and metrics from your Kubernetes environment on GKE to help you understand your application's behavior in production.

The GKE control plane is exposed to the public internet by default.

GKE supports several OS image types but COS is the recommended OS image to use on cluster nodes for enhanced security

CIS GKE Benchmark Recommendation: 6.5.5. Ensure Shielded GKE Nodes are Enabled

Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of GKE nodes and should be enabled on all GKE clusters.