Checks

The Gemini API (a.k.a. Generative Language API, generativelanguage.googleapis.com) uses API keys to authenticate requests for uploaded files and cached content. For projects with the Gemini API enabled, each API key should have API restrictions configured to limit access to specific services.

Google Cloud API keys have API restrictions limiting calls to specific services. The finding checks that keys are restricted to named Google APIs and do not include the broad cloudapis.googleapis.com, indicating keys are scoped only to intended use.

Google Cloud projects are evaluated for active API keys. The finding indicates whether any keys exist and are enabled in the project, regardless of restrictions or usage.

Google Cloud API keys are evaluated for rotation age using their creation_time. Keys created within the last 90 days are treated as recently rotated; keys older than 90 days are treated as overdue.

Evaluates whether Artifact Analysis (containeranalysis.googleapis.com) is enabled at the project level to support vulnerability scanning and metadata for container images in Artifact Registry or Container Registry.

BigQuery datasets use Customer-Managed Encryption Keys (CMEK) rather than Google-managed encryption. The evaluation identifies datasets configured to use a customer-managed key for data-at-rest protection.

BigQuery datasets are evaluated for exposure to public identities. The finding highlights datasets that grant any role to allUsers or allAuthenticatedUsers, which makes the dataset publicly accessible beyond intended principals.

BigQuery tables use customer-managed encryption keys (CMEK) for at-rest encryption. The evaluation identifies tables lacking a configured Cloud KMS key, indicating use of default Google-managed encryption instead.

Cloud Functions are attached to a Serverless VPC Access connector so egress traffic is routed through a private VPC network instead of the public internet.

The evaluation reviews each function's network configuration to confirm that a connector is configured.

Cloud Functions deny invocation to allUsers and allAuthenticatedUsers, so only explicitly authorized identities or services can trigger them.

The evaluation reviews each function's IAM policy bindings to confirm no public principals are granted invoker access.

Cloud SQL instances are checked for automated backups being configured to run on a schedule and support point-in-time recovery.

Cloud SQL instances use customer-managed encryption keys (CMEK) via Cloud KMS for at-rest encryption. The evaluation identifies instances lacking a configured Cloud KMS key, indicating use of default Google-managed encryption instead.

Ensures that Cloud SQL instances have high availability configured by setting availabilityType to REGIONAL. A REGIONAL instance maintains a standby replica in a different zone within the same region and automatically fails over on zone-level outages.

Cloud SQL for MySQL instances are evaluated for the local_infile database flag being explicitly set to off, disabling use of LOAD DATA LOCAL.

Instances where local_infile is absent or not off are identified.

Cloud SQL MySQL instances configure the skip_show_database database flag to on, limiting use of SHOW DATABASES to accounts with the SHOW DATABASES privilege.

Cloud SQL for PostgreSQL instances are evaluated for the database flag cloudsql.enable_pgaudit being set to on

Cloud SQL for PostgreSQL instances have the log_connections flag set to on, causing the server to record every connection attempt and the result of client authentication.

Cloud SQL for PostgreSQL instances have the log_disconnections flag set to on, creating a record each time a client session ends, including its duration and status

Cloud SQL for PostgreSQL evaluates the log_error_verbosity database flag and expects the value default.

Configurations using terse or verbose are flagged as deviations.

Cloud SQL for PostgreSQL evaluates whether log_min_duration_statement is set to -1, disabling statement duration logging.

Cloud SQL for PostgreSQL uses the log_min_error_statement flag and expects it set to error, the severity threshold that controls when SQL text is logged with error messages.

Cloud SQL for PostgreSQL instances are evaluated for the log_min_messages flag being set to a sufficiently high severity. Instances with the flag missing or set below ERROR (e.g., DEBUG*, INFO, NOTICE) are identified.

Cloud SQL for PostgreSQL instances have log_statement set to ddl, recording only data definition statements in server logs

Cloud SQL instances are evaluated for IP assignment, highlighting instances that have any public IP instead of being restricted to private IP only.