Checks

Google Cloud projects with containerscanning.googleapis.com enabled perform automatic vulnerability scanning for images in Container Registry and Artifact Registry.

The finding indicates whether that service is active to generate and refresh vulnerability metadata for your container images.

The Gemini API (a.k.a. Generative Language API, generativelanguage.googleapis.com) should not be used. It does not adhere to GCP's general security & compliance standards.

GitHub repository should be set to be private.

You can do this by either setting <code>private</code> attribute to 'true' or <code>visibility</code> attribute to 'internal' or 'private'.

For the purposes of security, the contents of the plaintext_value field have been marked as sensitive to Terraform, but this does not hide it from state files. State should be treated as sensitive always.

GitHub repository should be set to use vulnerability alerts.

You can do this by setting the <code>vulnerability_alerts</code> attribute to 'true'.

GitHub branch protection should be set to require signed commits.

You can do this by setting the <code>require_signed_commits</code> attribute to 'true'.

Scan GitHub Actions workflow files for security issues such as template injection, excessive permissions, unpinned actions, and other misconfigurations using the zizmor static analysis tool.

GKE clusters are evaluated for use of the Compute Engine default service account (default) as the node identity. The expectation is that clusters and node pools run with dedicated, minimally privileged IAM service accounts instead of the project-wide default.

Glacier vault access policy is evaluated for exposure to public principals. The finding highlights Allow statements that grant access to Principal: '*' (including wildcard forms), and notes when a vault lacks a policy.

AWS Glue Data Catalog connections are inspected for ConnectionProperties values that resemble secrets (keys, tokens, passwords).

Such values indicate sensitive data is stored directly in connection configuration instead of being sourced securely from AWS Secrets Manager or Systems Manager Parameter Store.

AWS Glue connections require TLS/SSL for JDBC when the JDBC_ENFORCE_SSL property is set to true.

This evaluates connection definitions to confirm SSL is enforced for traffic to external data stores.

AWS Glue Data Catalog settings for connection password encryption are evaluated to confirm an AWS KMS key is configured to encrypt passwords stored in connection properties.

AWS Glue Data Catalog metadata is encrypted at rest when catalog settings use SSE-KMS with a KMS key.

Catalogs that do not configure SSE-KMS for metadata are considered unencrypted.

AWS Glue Data Catalog resource policies are assessed for configurations that expose the catalog to anyone, such as Principal: *, broad resource scopes, or permissive conditions.

The finding highlights catalogs made public through overly permissive resource-based access.

AWS Glue development endpoints are assessed for an associated security configuration that enables CloudWatch Logs encryption. It confirms the endpoint references a configuration and that log encryption is not DISABLED.

AWS Glue development endpoints are assessed for an attached security configuration where job bookmark encryption is enabled. Endpoints lacking a security configuration are also identified.

AWS Glue development endpoints are evaluated for an attached security configuration with S3 encryption. Endpoints lacking a security configuration, or with s3_encryption set to DISABLED, are flagged by this check.

AWS Glue ETL jobs are validated to use Amazon S3 at-rest encryption (SSE-S3 or SSE-KMS) when writing outputs, either through an attached security configuration or via job arguments. Jobs missing a security configuration or with S3 encryption disabled are identified.

AWS Glue ETL jobs are evaluated for a security configuration with CloudWatch Logs encryption (SSE-KMS) enabled. Jobs without a security configuration, or with CloudWatch Logs encryption set to DISABLED, are highlighted.

AWS Glue ETL jobs should link a security configuration with job bookmark encryption enabled. Bookmark encryption must not be DISABLED (e.g., use CSE-KMS). Jobs lacking a security configuration are treated as not protecting bookmark metadata.

AWS Glue jobs are assessed for continuous CloudWatch logging, confirming that runtime events and outputs are sent to CloudWatch Logs via the --enable-continuous-cloudwatch-log configuration.

AWS Glue ETL jobs are inspected for default arguments (DefaultArguments) that resemble secrets (keys, tokens, passwords).

Such values indicate sensitive data is stored directly in job arguments instead of being sourced securely from AWS Secrets Manager or Systems Manager Parameter Store.

AWS Glue ML transforms are evaluated for encryption at rest of transform user data using KMS keys. The finding highlights transforms where encryption is not configured.

Verifies that Gmail is configured to take a protective action (such as moving to spam, quarantining, or showing a warning) when emails contain anomalous attachment types. Unusual file types that are uncommon for the sender or organization may indicate an attempt to deliver malware through less-scrutinized formats.