Payment Card Industry Data Security Standard (PCI DSS) v4.0
The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard. It's administered by the PCI Security Standards Council, which was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc. PCI DSS applies to entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD). This includes, but isn't limited to, merchants, processors, acquirers, issuers, and service providers. The PCI DSS is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.
ProwlerRun this compliance with Prowler
Run in Prowler Cloudprowler gcp --compliance pci_4.0_gcpRequirements (1672)
1.2.5: Network security controls (NSCs) are configured and maintained.178
1.2.5.1Checks if HTTP to HTTPS redirection is configured on all HTTP(S) Load Balancers. The rule is NON_COMPLIANT if one or more HTTP(S) Load Balancers do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP(S) Load Balancers have forwarding to an HTTP backend instead of redirection.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Load Balancing
1.2.5.2Checks if Google Cloud CDN is using deprecated SSL protocols for HTTPS communication between CDN edge locations and custom origins. This rule is NON_COMPLIANT for a Google Cloud CDN configuration if any 'OriginSslProtocols' includes 'SSLv3'.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud CDN
1.2.5.3Checks if Google Cloud CDN configurations are using a minimum security policy and cipher suite of TLSv1.2 or greater for viewer connections. This rule is NON_COMPLIANT for a Cloud CDN configuration if the minimumTlsVersion is below TLSv1.2.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud CDN
1.2.5.4Checks if Google Cloud CDN is using a custom SSL certificate and is configured to use SNI for serving HTTPS requests. The rule is NON_COMPLIANT if a custom SSL certificate is associated but the SSL support method uses a dedicated IP address.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud CDN
1.2.5.5Checks if Google Cloud CDN configurations are encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'originProtocol' is 'HTTP_ONLY' or if 'originProtocol' is 'MATCH_VIEWER' and 'viewerProtocol' is 'ALLOW_ALL'.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud CDN
1.2.5.6Checks if your Google Cloud CDN configurations enforce HTTPS. The rule is NON_COMPLIANT if the value of `enableOnRedirect` is set to 'true' for the backend service, which indicates that HTTPS is allowed without any restrictions.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud CDN
1.2.5.7Check if Google Cloud's Managed Service for Elasticsearch nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the cluster.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Managed Service for Elasticsearch
1.2.5.8Checks whether your Google Cloud HTTP(S) Load Balancer SSL proxy is using a custom SSL policy. The rule is only applicable if there are SSL proxies for the Google Cloud HTTP(S) Load Balancer.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud HTTP(S) Load Balancer
1.2.5.9Checks if your Google Cloud Platform HTTPS Load Balancer SSL proxy uses a predefined policy. The rule is NON_COMPLIANT if the HTTPS SSL proxy listener's policy does not equal the value of the parameter 'predefinedPolicyName'.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Load Balancing
1.2.5.10Checks if your Google Cloud HTTP(S) Load Balancer is configured with SSL or HTTPS. The rule is NON_COMPLIANT if a listener is not configured with SSL or HTTPS.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud HTTP(S) Load Balancing
1.2.5.11Checks if Google Cloud Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or the security configuration does not satisfy the specified rule parameters.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Dataproc
1.2.5.12Checks whether connections to Google Cloud Elasticsearch (GCP equivalent of OpenSearch) are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Elasticsearch domain 'EnforceHttps' is not 'true' or is 'true' and 'TlsSecurityPolicy' is not in 'tlsPolicies'.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Elasticsearch
1.2.5.13Check if Google Cloud's Elasticsearch Service (part of Google Cloud operations suite) nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the cluster.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Elasticsearch Service
1.2.5.14Checks if Google BigQuery datasets require TLS/SSL encryption to connect to SQL clients. The rule is NON_COMPLIANT if any BigQuery dataset has the parameter require_ssl not set to true.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
BigQuery
1.2.5.15Checks if Cloud Storage buckets have IAM policies that require requests to use HTTPS. The rule is NON_COMPLIANT if any Cloud Storage bucket has policies allowing HTTP requests.2
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Storage
1.2.5.16Checks if a Cloud Storage bucket created with Google Cloud Storage uses the 'gs' protocol for endpoint connection. The rule is NON_COMPLIANT if the bucket protocol for endpoint connection supports 'gs'.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Storage
1.2.5.17Checks if Google Cloud firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.2
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Firewall
1.2.8: Network security controls (NSCs) are configured and maintained.4730
1.2.8.1Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter backendServiceType. The rule returns NON_COMPLIANT if the API does not match the backend type configured in the rule parameter.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Endpoints
1.2.8.2Checks if a Google Cloud Endpoints service uses an SSL certificate. The rule is NON_COMPLIANT if the Google Cloud Endpoints service does not have an associated SSL certificate.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Endpoints
1.2.8.3Checks if Google Cloud APIs (specifically Google Cloud Endpoints or API Gateway) are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud API if it is not associated with a security policy.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Armor
1.2.8.4Checks if Google Cloud CDN distributions are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN distribution is not associated with a Cloud Armor security policy.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud CDN
1.2.8.5Checks if the certificate associated with a Google Cloud CDN service is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN service uses the default SSL certificate.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud CDN
1.2.8.6Checks if the Cloud Source Repositories URL contains sign-in credentials. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Cloud Source Repositories
1.2.8.7Checks if Google Cloud Database Migration Service (Google Cloud DMS) replication instances are public. The rule is NON_COMPLIANT if the 'public' field is set to true.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Database Migration Service
1.2.8.8Checks if Google Cloud Firestore backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore backups are public.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Firestore
1.2.8.9Checks if the Google Cloud VPN authorization rules authorize connection access for all clients. The rule is NON_COMPLIANT if 'AccessAll' is present and set to true.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud VPN
1.2.8.10Checks if the status of Google Cloud's Config Connector compliance is COMPLIANT or NON_COMPLIANT after the resource configuration execution on the instance. The rule is compliant if the field status is COMPLIANT.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Config Connector
1.2.8.11Checks if Google Cloud Platform (GCP) VPC Network Peering has 'AutoAcceptSharedAttachments' enabled. The rule is NON_COMPLIANT for a VPC Network Peering if 'AutoAcceptSharedAttachments' is set to 'enable'.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud VPC Network Peering
1.2.8.12Checks if the Google Kubernetes Engine (GKE) endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Kubernetes Engine (GKE)
1.2.8.13Checks if Google Cloud Elasticsearch (part of Google Cloud's operations tools) clusters are configured within a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch cluster endpoint is accessible publicly.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Elasticsearch Service
1.2.8.14Checks if Google Cloud HTTP(S) Load Balancers have backend services configured with SSL certificates from Google-managed SSL certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service configured without a Google-managed SSL certificate or is configured with a certificate different from a Google-managed SSL certificate.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud HTTP(S) Load Balancer
1.2.8.15Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure that your Load Balancer is configured with an SSL or HTTPS proxy. This rule is applicable to External HTTPS Load Balancers only. This rule does not check Internal Load Balancers.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Load Balancing
1.2.8.16Checks if a Google Cloud Platform account has public access settings enabled for a Google Dataproc cluster. The rule is NON_COMPLIANT if PublicAccessPrevention is false, or if true, firewall rules allowing access on ports other than Port 22 are configured.2
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Dataproc
1.2.8.17Google Cloud Platform (GCP) does not have a direct equivalent of this rule, but a similar approach can be achieved by configuring firewall rules to restrict incoming SSH (port 22) access, thus effectively disabling incoming SSH connections similarly to the INCOMING_SSH_DISABLED rule in other systems. The service involved is Google Cloud Firewall.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Firewall
1.2.8.18Checks if Cloud NAT gateways are attached to an authorized Google Cloud Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if Cloud NAT gateways are attached to an unauthorized VPC.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud VPC
1.2.8.19Checks if the Cloud Function IAM policy attached to the Cloud Function resource prohibits public access. If the IAM policy allows public access, it is NON_COMPLIANT.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Cloud Functions
1.2.8.20Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Cloud Functions
1.2.8.21Checks if firewall rules for SSH (port 22) and RDP (port 3389) ingress traffic in Google Cloud Platform are unrestricted. The rule is NON_COMPLIANT if a firewall rule allows any source IP for these ports.2
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Firewall
1.2.8.22Checks if a GCP Firewall Rule is configured with a user-defined action for fragmented packets. The rule is NON_COMPLIANT if the specified action for fragmented packets does not match the user-defined action.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Firewall
1.2.8.23Check if GCP's VPC Service Controls security policies are associated with stateful or stateless rules. This rule is NON_COMPLIANT if no stateful or stateless rules are associated with the VPC Service Controls policy; else COMPLIANT if any one of the rule types exists.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
VPC Service Controls
1.2.8.24Checks if a Google Cloud Platform (GCP) Firewall Rule contains rules. The rule is NON_COMPLIANT if there are no rules in a Firewall Rule.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Firewall
1.2.8.25Checks if there are public routes in the Google Cloud Platform (GCP) VPC subnet route table that point to a Cloud Router or NAT Gateway. The rule is NON_COMPLIANT if a route to an Internet Gateway (IGW) has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud VPC
1.2.8.26Checks if Google Cloud Search instances are in a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Cloud Search instance endpoint is public.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Search
1.2.8.27Checks if there are any Google Cloud SQL instance firewall rules that are not the default firewall rules. The rule is NON_COMPLIANT if there are any firewall rules that are not the default firewall rules.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud SQL
1.2.8.28Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'IPConfiguration.requireSSL' field is false and 'IPConfiguration.ipv4Enabled' is true in the instance configuration.4
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud SQL
1.2.8.29Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset access configuration allows public access.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
BigQuery
1.2.8.30Checks if Google Cloud Storage access points have block public access settings enabled. The rule is NON_COMPLIANT if block public access settings are not enabled for Cloud Storage access points.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Storage
1.2.8.31Checks if the required public access prevention settings are configured at the project level. The rule is only NON_COMPLIANT when the fields set below do not match the corresponding fields in the project settings.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Storage
1.2.8.32Checks if the required public access prevention settings are configured at the project level in Google Cloud Platform. The rule is NON_COMPLIANT if the configuration does not match the specified settings or defaults.3
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Storage
1.2.8.33Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and the bucket-level settings allow public access.3
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Storage
1.2.8.34Checks if your Google Cloud Storage buckets do not allow public read access. The rule examines the bucket IAM policies, uniform bucket-level access settings, and object-level permissions.3
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Storage
1.2.8.35Checks if your Google Cloud Storage buckets do not allow public write access by evaluating the Bucket IAM policies, Uniform bucket-level access, and the bucket ACL settings.2
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Storage
1.2.8.36Checks if a Google Cloud AI Notebook instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud AI Platform Notebooks
1.2.8.37Checks if direct internet access is disabled for a Google AI Platform (formerly AI Platform Notebooks) instance. The rule is NON_COMPLIANT if an AI Platform notebook instance is internet-enabled.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google AI Platform
1.2.8.38Checks if a Private Google Access Point is created for each Google Virtual Private Cloud (Google VPC). The rule is NON_COMPLIANT if a Google VPC doesn't have a Private Google Access Point created for the service.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud VPC
1.2.8.39Checks if there are unused VPC Firewalls (equivalent to network ACLs). The rule is COMPLIANT if each VPC Firewall rule is associated with a subnet. The rule is NON_COMPLIANT if a VPC Firewall rule is not associated with a subnet.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud VPC
1.2.8.40Checks if Private Google Access is enabled for the VPC in GCP. The rule is NON_COMPLIANT if Private Google Access is not enabled for the VPC, as it is necessary for Google services to communicate with private IPs.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud VPC
1.2.8.41Checks if Google Cloud firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.2
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Compute Engine
1.2.8.42Checks if a Google Cloud Armor security policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within the security policy.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Armor
1.2.8.43Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the security policy.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Armor
1.2.8.44Checks whether a Google Cloud Armor Security Policy contains any rules. This rule is NON_COMPLIANT if a Security Policy does not contain any rules.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Armor
1.2.8.45Checks if Google Cloud Armor security policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Google Cloud Armor security policy.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Armor
1.2.8.46Checks whether Google Cloud Armor security policy contains rules with conditions. This rule is COMPLIANT if at least one rule within the security policy contains conditions and NON_COMPLIANT otherwise.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Armor
1.2.8.47Checks if a Google Cloud Armor Security Policy contains any security rules. The rule is NON_COMPLIANT if there are no security rules present within a Security Policy.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Google Cloud Armor
1.3.1: Network access to and from the cardholder data environment is restricted.5228
1.3.1.1Checks if a Google Cloud API Gateway API configuration is using Google Cloud Armor for security. The rule is NON_COMPLIANT if Google Cloud Armor is not used or if the utilized security policies do not match the specified rule parameters.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud API Gateway / Google Cloud Armor
1.3.1.2Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Endpoints
1.3.1.3Checks if an API Gateway configuration has an SSL certificate associated with it. The rule is NON_COMPLIANT if the API Gateway does not have an associated SSL certificate.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
API Gateway
1.3.1.4Checks if Google Cloud Endpoints APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud Endpoints API if it is not associated with a security policy.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Endpoints
1.3.1.5Checks if Google Cloud CDN (Content Delivery Network) is associated with either Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN is not associated with a Google Cloud Armor security policy.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud CDN
1.3.1.6Checks if the SSL certificate associated with a Google Cloud CDN service is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN service uses the default SSL certificate.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud CDN
1.3.1.7Checks if the Google Cloud Source Repositories URL contains sign-in credentials or not. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Source Repositories
1.3.1.8Checks if Google Cloud Database Migration Service (GCP DMS) connection profiles are public. The rule is NON_COMPLIANT if the 'public' field is set to true.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Database Migration Service
1.3.1.9Checks if Google Cloud Firestore (Firestore) exports are public. The rule is NON_COMPLIANT if any Firestore exports are public.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Firestore
1.3.1.10Checks if the Google Cloud VPN authorization policy allows connection access for all clients. The rule is NON_COMPLIANT if 'AccessAll' is present and set to true.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPN
1.3.1.11Checks if the status of the Google Cloud Configuration Management compliance is COMPLIANT or NON_COMPLIANT after the configuration execution on the VM instance. The rule is compliant if the field status is COMPLIANT. For more information about configurations, see What is a configuration?0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Configuration Management
1.3.1.12Checks if Google Cloud Platform (GCP) VPC Network Peering has 'AutoAcceptSharedAttachments' enabled. The rule is NON_COMPLIANT for a VPC Network Peering if 'AutoAcceptSharedAttachments' is set to 'enable'.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Compute Engine
1.3.1.13Checks if the Google Kubernetes Engine (GKE) endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Kubernetes Engine (GKE)
1.3.1.14Checks if Google Cloud Memorystore for Redis instances are configured with a custom VPC network. The rule is NON_COMPLIANT for a Memorystore instance if it is using the default VPC network.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Memorystore
1.3.1.15Checks if Google Cloud Elasticsearch Service (part of Google Cloud's managed services) instances are within a Virtual Private Cloud (VPC) network. The rule is NON_COMPLIANT if an Elasticsearch Service instance endpoint is public.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Elasticsearch Service
1.3.1.16Checks if Google Cloud HTTP(S) Load Balancers are configured to use certificates from Google Cloud Managed Certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 listener that is configured without a Google-managed certificate or is configured with a certificate different from Google-managed certificates.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Load Balancing
1.3.1.17Checks if the Classic Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, a frontend configuration with SSL should be set on your Classic Load Balancer. This rule is only applicable to Classic Load Balancers in GCP and does not apply to HTTP(S) Load Balancers.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Load Balancing
1.3.1.18Checks if a Google Cloud account with Dataproc has block public access settings enabled. The rule is NON_COMPLIANT if BlockPublicHttps is false, or if true, there are firewall rules that allow traffic on ports other than Port 22 from the internet.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Dataproc
1.3.1.19The rule identifier 'INCOMING_SSH_DISABLED' indicates that incoming SSH connections are disabled, whereas the rule name 'restricted-ssh' implies a policy to restrict SSH access. In GCP, this can be achieved by using a firewall rule that denies incoming traffic on port 22 (the default SSH port).1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Firewall
1.3.1.20In Google Cloud Platform, the equivalent of EC2 instances in a VPC is Compute Engine instances within a Virtual Private Cloud (VPC). The rule identifier for VPC configuration in GCP can vary, but the service utilized is primarily Google Compute Engine.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Compute Engine
1.3.1.21Checks if Cloud NAT is configured for an authorized Google Cloud Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if Cloud NAT is configured for an unauthorized VPC.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC
1.3.1.22Checks if the Google Cloud Function IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access, it is NON_COMPLIANT.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Functions
1.3.1.23Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Cloud Functions
1.3.1.24Checks if firewall rules for SSH (port 22) and RDP (port 3389) ingress traffic in Google Cloud Platform (GCP) allow unrestricted access. The rule is NON_COMPLIANT if a firewall rule allows ingress traffic from any source IP (0.0.0.0/0) for ports 22 or 3389.2
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Firewall
1.3.1.25Checks if a Google Cloud VPC firewall rule is configured with a user-defined action for fragmented packets. The rule is NON_COMPLIANT if the action for fragmented packets does not match the user-defined default action.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC Firewall
1.3.1.26Check Google Cloud Armor security policy is associated with backend services, as this rule is NON_COMPLIANT if no backend services are associated with the Google Cloud Armor policy, otherwise COMPLIANT if any backend service exists.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.1.27In GCP, checks if a Google Cloud Armor Security Policy contains any rules. The policy is CONFORMANT if there are rules defined within the Google Cloud Armor Security Policy.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.1.28Checks if there are public routes in the route table to a Cloud Router or Forwarding Rule. The rule is NON_COMPLIANT if a route to an Internet Gateway has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC
1.3.1.29Checks if Google Cloud Search domains are in a Google Cloud Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Cloud Search domain endpoint is public.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Search
1.3.1.30Checks if there are any Google Cloud SQL database instances that are using non-default network tags. The rule is NON_COMPLIANT if there are any Cloud SQL instances with network tags that are not the default ones.4
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud SQL
1.3.1.31Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration.requireSsl' field is false and the 'ipConfiguration.enabled' field is true in the instance configuration.4
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud SQL
1.3.1.32Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the 'access' field in the dataset configuration item includes any entities with 'role' set to 'READER' or 'WRITER' for 'allAuthenticatedUsers' or 'allUsers'.2
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google BigQuery
1.3.1.33Checks if Google BigQuery has VPC Service Controls enabled. The rule is NON_COMPLIANT if VPC Service Controls are not enabled or if the configuration.vpcServiceControls field is 'false'.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google BigQuery
1.3.1.34Checks if Google Cloud Storage (GCS) bucket access control settings have public access prevention enabled. The rule is NON_COMPLIANT if public access prevention settings are not enabled for GCS buckets.2
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.1.35Verifies if the necessary public access prevention settings are configured at the organization level in Google Cloud Platform. Compliance is marked as NON_COMPLIANT when the specified settings do not align with the organization's configuration items.4
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.1.36Checks if the required identity and access management (IAM) policies are configured at the organization level. The rule is NON_COMPLIANT if the IAM policies do not match one or more settings from parameters (or default).0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud IAM
1.3.1.37Checks if Google Cloud Storage (GCS) buckets are publicly accessible. The rule is NON_COMPLIANT if a GCS bucket is not listed in the excludedPublicBuckets parameter and the bucket's IAM settings allow public access.3
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.1.38Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Uniform Bucket-Level Access settings, the bucket policy, and the bucket access control list (ACL).2
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.1.39Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform bucket-level access settings, bucket IAM policies, and object-level access control lists (ACL).2
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.1.40Checks if a Google Cloud AI Platform Notebook instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud AI Platform
1.3.1.41Checks if direct internet access is disabled for a Google AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google AI Platform
1.3.1.42Checks if a Private Service Connection for the service provided in the rule parameter is created for each Google Cloud Virtual Private Cloud (GCP VPC). The rule is NON_COMPLIANT if a GCP VPC doesn't have a Private Service Connection created for the service.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Private Service Access
1.3.1.43Checks if there are unused firewall rules. The rule is COMPLIANT if each firewall rule is associated with a network. The rule is NON_COMPLIANT if a firewall rule is not associated with a network.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC Firewall
1.3.1.44Checks if DNS resolution from the accepting/requesting VPC to private IP is enabled. The result is NON_COMPLIANT if DNS resolution from the accepting/requesting VPC to private IP is not enabled. This is equivalent to checking VPC Private DNS settings in GCP.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC
1.3.1.45Checks if firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC Firewall
1.3.1.46Checks if both Cloud VPN tunnels in Google Cloud Platform are in operational status (UP). The rule is NON_COMPLIANT if one or both tunnels are not operational (DOWN).0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Cloud VPN
1.3.1.47Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if there are no rules present within the security policy.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.1.48Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Cloud Armor security policy.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.1.49Checks whether a Google Cloud Armor Security Policy contains any rules. This rule is NON_COMPLIANT if a Security Policy does not contain any rules.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.1.50Checks if Google Cloud Armor security policies contain any security rules. The rule is NON_COMPLIANT if there are no rules present within a Google Cloud Armor security policy.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.1.51Verifies if a Google Cloud Platform WAF (Web Application Firewall) regional rule contains conditions. The rule is considered COMPLIANT if it includes at least one condition and NON_COMPLIANT if it does not.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.1.52Checks if a Google Cloud Armor Security Policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within a Security Policy.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.2: Network access to and from the cardholder data environment is restricted.5234
1.3.2.1Checks if a Google Cloud API is using Google Cloud Armor security policy. The rule is NON_COMPLIANT if a Google Cloud Armor security policy is not used or if the used security policy does not match what is listed in the rule parameter.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.2.2Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Endpoints
1.3.2.3Checks if an API Gateway in GCP uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway does not have an associated SSL certificate.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
API Gateway
1.3.2.4Checks if Google Cloud Platform (GCP) App Engine services are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a GCP App Engine service if it is not associated with a Cloud Armor security policy.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
App Engine
1.3.2.5Checks if Google Cloud CDN instances are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN instance is not associated with a Cloud Armor security policy.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud CDN
1.3.2.6Checks if the certificate associated with a Google Cloud CDN is the default Google-managed SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud CDN
1.3.2.7Checks if the Cloud Source Repositories URL contains sign-in credentials or not. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Cloud Source Repositories
1.3.2.8Checks if Google Cloud Database Migration Service replication instances are public. The rule is NON_COMPLIANT if the PubliclyAccessible field is set to true.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Database Migration Service
1.3.2.9Checks if Google Cloud Firestore manual backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore manual backups are public.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Firestore
1.3.2.10Checks if the Google Cloud VPN authorization rules allow connection access for all clients. The rule is NON_COMPLIANT if 'AccessAll' is present and set to true.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPN
1.3.2.11Checks if the status of the Google Cloud Deployment Manager deployment is DEPLOYED or NOT_DEPLOYED after execution on the instance. The rule is compliant if the field status is DEPLOYED. For more information about deployments, see What is a deployment?0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Deployment Manager
1.3.2.12Checks if Google Cloud Platform (GCP) Cloud Interconnect or Cloud VPN setups have 'AutoAcceptSharedAttachments' enabled. The rule is NON_COMPLIANT for a Cloud Interconnect or VPN if 'AutoAcceptSharedAttachments' is set to 'enable'.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Cloud Interconnect / Cloud VPN
1.3.2.13Checks if the Google Kubernetes Engine (GKE) endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Kubernetes Engine (GKE)
1.3.2.14Checks if Google Cloud Memorystore for Redis instances are configured with a custom VPC network. The rule is NON_COMPLIANT for a Redis instance if it is using the default VPC network.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Memorystore
1.3.2.15Checks if Google Cloud's Google Cloud Search is configured within a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Google Cloud Search service endpoint is publicly accessible.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Search
1.3.2.16Checks if Google Cloud HTTP(S) Load Balancers have backend services configured with valid SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a valid SSL certificate or is configured with a certificate that is not from Google Cloud Certificate Manager.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Load Balancing
1.3.2.17Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS listener with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers and does not check other services.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Load Balancing
1.3.2.18Checks if a Google Cloud project has firewall rules that block public access settings enabled. The rule is NON_COMPLIANT if allowTcp is true for any rule with a port other than 22 or if there are any ingress rules that allow access from all IP addresses (0.0.0.0/0).1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Firewall
1.3.2.19In Google Cloud Platform (GCP), the equivalent of the rule identifier 'INCOMING_SSH_DISABLED' and rule name 'restricted-ssh' could be represented through firewall rules that deny incoming SSH traffic. This can be accomplished by setting up an ingress rule that specifically denies traffic on port 22 for SSH access, effectively restricting SSH access to instances.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Compute Engine
1.3.2.20This rule identifies Google Cloud Platform (GCP) virtual machine instances that are located within a Virtual Private Cloud (VPC) network. The equivalent rule identifier for this purpose is 'INSTANCES_IN_VPC', matching the functionality of the 'ec2-instances-in-vpc' rule from AWS.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Compute Engine
1.3.2.21Checks if Cloud NAT gateways are associated with an authorized Google Cloud VPC. The rule is NON_COMPLIANT if Cloud NAT gateways are associated with an unauthorized VPC.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC
1.3.2.22Checks if the Google Cloud Functions IAM policy attached to the Cloud Function prohibits public access. If the Cloud Function IAM policy allows public access, it is NON_COMPLIANT.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Functions
1.3.2.23Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Cloud Functions
1.3.2.24Checks if Google Cloud Firewall rules for SSH (port 22) and RDP (port 3389) ingress traffic are unrestricted. The rule is NON_COMPLIANT if a firewall rule allows ingress traffic from all IP addresses (0.0.0.0/0) for these ports.2
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Firewall
1.3.2.25Checks if a Google Cloud VPC firewall policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match with the user-defined default action.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC Firewall
1.3.2.26Check if GCP Firewall Rules are associated with stateful or stateless rules. The rule is NON_COMPLIANT if no associated stateful or stateless rules exist with the Firewall Rules, otherwise COMPLIANT if any rule exists.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Firewall
1.3.2.27Verifies if a Google Cloud Platform (GCP) Firewall Rule contains firewall rules. The rule is NON_COMPLIANT if there are no rules in a GCP Firewall Rule.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Firewall
1.3.2.28Checks if there are public routes in the route table to a Cloud VPN or Cloud Router. The rule is NON_COMPLIANT if a route has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Compute Engine
1.3.2.29Checks if Google Cloud Search service instances are within a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Search service endpoint is public.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Search
1.3.2.30Checks if there are any Google Cloud SQL database users that are not the default users. The rule is NON_COMPLIANT if there are any database users that are not the default users.2
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud SQL
1.3.2.31Checks if the Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'authorizedNetworks' field allows public IP addresses in the instance configuration.4
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud SQL
1.3.2.32Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset access configuration includes any entries that allow public access.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google BigQuery
1.3.2.33Checks if Google BigQuery dataset has 'authorizedNetworks' enabled. The rule is NON_COMPLIANT if 'authorizedNetworks' is not enabled or if the configuration.authorizedNetworks field is 'false'.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
BigQuery
1.3.2.34Checks if Google Cloud Storage (GCS) buckets have uniform bucket-level access (similar to S3 block public access) enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.3
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.2.35Verifies if the required public access prevention settings are configured at the project level in Google Cloud Platform. The rule is considered NON_COMPLIANT when the public access settings do not match the specified criteria.3
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage (GCS)
1.3.2.36Verifies if the required public access prevention settings are configured at the project or organization level in Google Cloud Platform. The rule is NON_COMPLIANT if the configuration does not align with the specified settings or defaults.4
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.2.37Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a storage bucket is not listed in the excludedPublicBuckets parameter and the bucket-level permissions allow public access.2
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.2.38Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Uniform Bucket-Level Access settings, the bucket policy, and the bucket access control list (ACL).2
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.2.39Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform Bucket-Level Access settings, bucket policies, and access control lists (ACLs).2
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Storage
1.3.2.40Checks if a Google AI Platform Notebook instance is launched within a VPC network or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet is not included in the list of approved subnets.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google AI Platform
1.3.2.41Checks if direct internet access is disabled for a Google AI Platform (formerly known as AI Platform Notebooks) instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google AI Platform
1.3.2.42Checks if a Private Service Connection for the service provided in the rule parameter is created for each Google Virtual Private Cloud (GCP VPC). The rule is NON_COMPLIANT if a GCP VPC doesn't have a Private Service Connection created for the service.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC
1.3.2.43Checks if there are unused Firewall Rules. The rule is COMPLIANT if each Firewall Rule is associated with a VPC network. The rule is NON_COMPLIANT if a Firewall Rule is not associated with a VPC network.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud VPC
1.3.2.44Checks if DNS resolution from accepter/requester VPC to private IP is enabled. The rule is NON_COMPLIANT if DNS resolution from accepter/requester VPC to private IP is not enabled in Google Cloud Platform (GCP).1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
VPC Networking
1.3.2.45Checks if firewall rules in GCP allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.2
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Firewalls
1.3.2.46Checks if both Cloud VPN tunnels in Google Cloud are in ESTABLISHED state. The rule is NON_COMPLIANT if one or both tunnels are in DOWN state.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Cloud VPN
1.3.2.47Checks if a Google Cloud Armor security policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within the security policy.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.2.48Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Google Cloud Armor security policy.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.2.49Checks whether a Google Cloud Armor security policy contains any security rules. This rule is NON_COMPLIANT if a security policy does not contain any security rules.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.2.50Checks if Cloud Armor Security Policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor Security Policy.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Cloud Armor
1.3.2.51Checks whether Google Cloud Armor security policy rules contain conditions. This rule is COMPLIANT if the security policy rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.3.2.52Verifies if a Google Cloud Armor security policy contains any security rules. The policy is considered NON_COMPLIANT if there are no security rules present within it.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Google Cloud Armor
1.4.1: Network connections between trusted and untrusted networks are controlled.101
1.4.1.1Checks if a Google Cloud API Gateway API deployment is using Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Google Cloud Armor policy is not used or if the used policy does not match what is specified in the rule parameter.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud API Gateway
1.4.1.2Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter endpoint_configuration_type. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Endpoints
1.4.1.3Checks if Google Cloud Memorystore instances are configured with a custom subnet. The rule is NON_COMPLIANT for a Memorystore instance if it is using the default subnet.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Memorystore
1.4.1.4The rule identifier (INSTANCES_IN_VPC) for Google Cloud Platform corresponds to the equivalent resource of Google Compute Engine instances within a Virtual Private Cloud (VPC), similar to EC2 instances in Amazon Web Services VPC. In GCP, this would involve the configuration of firewall rules and network settings within a VPC for Google Compute Engine instances.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Google Compute Engine
1.4.1.5Checks if Cloud NAT is configured for a Google Cloud VPC network. The rule is NON_COMPLIANT if Cloud NAT is not configured for an authorized VPC network.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC
1.4.1.6Checks if there are public routes in the route table to a Cloud Router or VPN Gateway (equivalent to an Internet Gateway in AWS). The rule is NON_COMPLIANT if there is a route to a Cloud Router or VPN Gateway with a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC Networking
1.4.1.7Checks if BigQuery has 'VPC Service Controls' enabled. The rule is NON_COMPLIANT if 'VPC Service Controls' are not enabled or if the configuration.vpcServiceControls field is 'false'.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
BigQuery
1.4.1.8Checks if a Google AI Platform Notebooks instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Google AI Platform Notebooks
1.4.1.9Checks if DNS resolution from requester VPC to private IP is enabled in Google Cloud Platform. The rule is NON_COMPLIANT if DNS resolution is not enabled.1
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC
1.4.1.10Checks if both Cloud VPN tunnels in Google Cloud Platform are in 'ACTIVE' status. The rule is NON_COMPLIANT if one or both tunnels are in 'DOWN' or 'DISABLED' status.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud VPN
1.4.2: Network connections between trusted and untrusted networks are controlled.5034
1.4.2.1Checks if a Google Cloud Endpoints API is using Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Google Cloud Armor security policy is not used or if the used Google Cloud Armor policy does not match what is specified in the rule parameter.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Armor
1.4.2.2Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Endpoints
1.4.2.3Verifies if a Google Cloud Endpoints service has an associated SSL certificate. The rule is NON_COMPLIANT if the Google Cloud Endpoints service does not have a valid SSL certificate configured for its API.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Endpoints
1.4.2.4Checks if Google Cloud Endpoints APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud Endpoints API if it is not associated with a Cloud Armor security policy.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Endpoints
1.4.2.5Checks if Google Cloud CDN (Content Delivery Network) is associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Google Cloud CDN is not associated with a Google Cloud Armor security policy.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Armor
1.4.2.6Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud CDN
1.4.2.7Checks if the Cloud Source Repositories URL contains sign-in credentials or not. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud Source Repositories
1.4.2.8Checks if Google Cloud SQL instances are publicly accessible. The rule is NON_COMPLIANT if the 'Authorized networks' field is set to allow public IP addresses.3
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud SQL
1.4.2.9Checks if Google Cloud Firestore manual backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore manual backups are public.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Firestore
1.4.2.10Checks if the GCP VPN authorization rules authorize connection access for all clients. The rule is NON_COMPLIANT if 'AccessAll' is present and set to true.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPN
1.4.2.11Checks if the status of the GCP Compute Engine instance's maintenance and compliance with the desired state (as configured with Instance Template and Managed Instance Groups) is 'HEALTHY' or 'UNHEALTHY' after the operation execution on the instance. The rule is compliant if the health status is 'HEALTHY'. For more information about instance groups, see Instance Groups and Autoscaling in GCP.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Compute Engine
1.4.2.12Checks if Google Cloud Platform (GCP) Cloud Interconnect connections have 'AutoAcceptSharedAttachments' enabled. The rule is NON_COMPLIANT for a Cloud Interconnect connection if 'AutoAcceptSharedAttachments' is set to 'enable'.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud Interconnect
1.4.2.13Checks if the Google Kubernetes Engine (GKE) cluster endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Kubernetes Engine (GKE)
1.4.2.14Checks if Google Cloud's Elasticsearch (via Google Cloud Marketplace or third-party offering) is deployed within a Virtual Private Cloud (VPC) network. The rule is NON_COMPLIANT if the Elasticsearch domain endpoint is public.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Virtual Private Cloud (VPC)
1.4.2.15Checks if Google Cloud HTTP(S) Load Balancers have backends configured to use SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend that is configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud Certificate Manager certificate.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Load Balancing
1.4.2.16Checks if the External HTTPS Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure an HTTPS or SSL proxy listener is configured with your External Load Balancer. This rule is specifically applicable to External HTTPS Load Balancers and does not check Internal Load Balancers or TCP/UDP Load Balancers.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Load Balancing
1.4.2.17Checks if a Google Cloud account has block public access settings enabled for Google Dataproc. The rule is NON_COMPLIANT if BlockPublicAccess is false, or if true, firewall rules allow traffic on ports other than Port 22.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Dataproc
1.4.2.18The rule identifier INCOMING_SSH_DISABLED indicates a policy to disable incoming SSH access, while the rule name restricted-ssh refers to the specific rule implemented within a firewall to restrict SSH connections. In Google Cloud Platform (GCP), this is achieved using 'Firewall Rules' to manage network access, specifically by configuring a firewall rule to deny incoming traffic on port 22, which is the default port for SSH.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
GCP Firewall Rules
1.4.2.19Checks if internet access configurations are associated with an authorized Virtual Private Cloud (VPC) in Google Cloud Platform (GCP). The rule is NON_COMPLIANT if internet access configurations are linked to an unauthorized VPC.4
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google VPC
1.4.2.20Checks if the Google Cloud Functions IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Functions
1.4.2.21Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud Functions
1.4.2.22Checks if the default ports for SSH (22) and RDP (3389) ingress traffic in Google Cloud Platform (GCP) firewall rules are unrestricted. The rule is NON_COMPLIANT if a firewall rule allows ingress from any source IP address on these ports.2
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Firewall
1.4.2.23Checks if a Google Cloud VPC Firewall rule is configured with a user-defined default action for fragmented packets. The rule is NON_COMPLIANT if the default action for fragmented packets does not match the user-defined default action.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC Firewall
1.4.2.24Check if Google Cloud Platform (GCP) Firewall Policy has associated rules. This rule is NON_COMPLIANT if no ingress or egress rules are associated with the Firewall Policy; otherwise, it is COMPLIANT if any rule exists.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
GCP Firewall Policy
1.4.2.25Verifies whether a Serverless VPC Access connector has associated Serverless services. The connector is NON_COMPLIANT if there are no services linked to it.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Serverless VPC Access
1.4.2.26Checks if there are public routes in the VPC route table to an Internet Gateway. The rule is NON_COMPLIANT if a route to an IGW has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC
1.4.2.27Checks if Google Cloud's Elasticsearch Service (or a similar managed service) domains are in a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch Service domain endpoint is public.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Elasticsearch Service
1.4.2.28Checks if there are any Google Cloud SQL instances that are not using the default network and firewall settings. The rule is NON_COMPLIANT if there are any Cloud SQL instances not configured with the default settings.4
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud SQL
1.4.2.29Checks if Cloud SQL instances in Google Cloud Platform (GCP) are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration' field has 'requireSsl' set to false or 'authorizedNetworks' is empty, indicating the instance is accessible from public IPs.4
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud SQL
1.4.2.30Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset's access controls allow public access.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google BigQuery
1.4.2.31Checks if Google BigQuery reservation has 'enableCapacityCommitment' enabled. The rule is NON_COMPLIANT if 'enableCapacityCommitment' is not enabled or if the configuration.enableCapacityCommitment field is 'false'.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google BigQuery
1.4.2.32Checks if Google Cloud Storage (GCS) buckets have uniform access controls enabled. The rule is NON_COMPLIANT if uniform access controls are not enabled for GCS buckets.2
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Storage
1.4.2.33Checks if the required IAM policies for public access are configured properly at the project level. The rule is only NON_COMPLIANT when the IAM roles and permissions do not match the required configurations as specified.2
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Storage
1.4.2.34Verifies that the necessary public access prevention configurations are established at the organization level. The rule is NON_COMPLIANT if the settings do not align with the specified parameters or default configurations.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Storage
1.4.2.35Checks if Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.2
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud Storage
1.4.2.36Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the 'Uniform Bucket-Level Access' settings, the bucket IAM policies, and the bucket access control lists (ACL).2
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Storage
1.4.2.37Checks if your Google Cloud Storage buckets do not allow public write access. The rule verifies the Uniform Bucket-Level Access settings, bucket IAM policies, and ACLs.2
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Storage
1.4.2.38Checks if a Google AI Platform Notebook instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google AI Platform
1.4.2.39Checks if direct internet access is disabled for a Google Cloud AI Platform Notebooks instance. The rule is NON_COMPLIANT if an AI Platform Notebooks instance is internet-enabled.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud AI Platform Notebooks
1.4.2.40Checks if a Private Service Connection for the service provided in the rule parameter is created for each Google Cloud Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Google Cloud VPC doesn't have a Private Service Connection created for the service.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC
1.4.2.41Checks if there are unused Firewall Rules. The rule is COMPLIANT if each Firewall Rule is associated with a target resource. The rule is NON_COMPLIANT if a Firewall Rule is not associated with any target resource.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC Firewall
1.4.2.42Checks if DNS resolution from accepted/requester VPC to private IP is enabled in Google Cloud Platform. The rule is NON_COMPLIANT if DNS resolution from accepter/requester VPC to private IP is not enabled.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC
1.4.2.43Checks if firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Firewall Rules
1.4.2.44Checks if both Cloud VPN tunnels provided by Google Cloud Platform (GCP) are in 'RUNNING' state. The rule is NON_COMPLIANT if one or both tunnels are in 'FAILED' state.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud VPN
1.4.2.45Checks if a Google Cloud Armor security policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within the security policy.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Armor
1.4.2.46Checks if a Google Cloud Armor security policy has any rules configured. The policy is NON_COMPLIANT if no rules are present within the Google Cloud Armor security policy.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Armor
1.4.2.47Checks whether a Cloud Armor security policy contains any security rules. This rule is NON_COMPLIANT if a security policy does not contain any security rule.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud Armor
1.4.2.48Checks if Cloud Armor security policy rule groups contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor security policy rule group.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud Armor
1.4.2.49Checks whether Google Cloud Armor security policy contains rules with conditions. This policy is COMPLIANT if the security policy contains at least one rule with conditions and NON_COMPLIANT otherwise.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Armor
1.4.2.50Checks if a Google Cloud Armor security policy contains any rules or rule groups. The policy is considered NON_COMPLIANT if there are no rules or rule groups present within the security policy.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Armor
1.4.3: Network connections between trusted and untrusted networks are controlled.30
1.4.3.1Checks if a Google Cloud VPC firewall policy is configured with a user-defined ruleset for fragmented packets. The rule is NON_COMPLIANT if the default action for fragmented packets does not match the user-defined default action.0
Attributes
- Section
1.4.3: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC Firewall
1.4.3.2Checks if a Google Cloud Platform (GCP) firewall policy is configured with a user-defined default action for traffic. This rule is NON_COMPLIANT if the default action for traffic does not match the user-defined action.0
Attributes
- Section
1.4.3: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Firewall
1.4.3.3Check if GCP Firewall Rule is associated with at least one target (such as instance tags or IP ranges). This rule is NON_COMPLIANT if no targets are associated with the Firewall Rule, else COMPLIANT if at least one target exists.0
Attributes
- Section
1.4.3: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Firewall
1.4.4: Network connections between trusted and untrusted networks are controlled.101
1.4.4.1Checks if a Google Cloud API Gateway API is using Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud Armor security policy is not used or if the used security policy does not match what is listed in the rule parameter.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud API Gateway
1.4.4.2Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter endpointConfigurationType. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Endpoints
1.4.4.3Checks if Google Cloud Memorystore instances are configured with a custom VPC subnet. The rule is NON_COMPLIANT for a Memorystore instance if it is using the default VPC subnet.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Memorystore
1.4.4.4The rule identifier for instances in VPC in GCP is different from its rule name, similar to AWS's INSTANCES_IN_VPC and ec2-instances-in-vpc.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud Compute
1.4.4.5Checks if Cloud Routers with internet access are associated with an authorized Virtual Private Cloud (VPC) Network. The rule is NON_COMPLIANT if Cloud Routers with internet access are associated with an unauthorized VPC Network.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC
1.4.4.6Checks if there are public routes in the route table to a Cloud Internet Engine (CIE). The rule is NON_COMPLIANT if a route to a CIE has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC
1.4.4.7Checks if Google BigQuery has 'VPC Service Controls' enabled. The rule is NON_COMPLIANT if 'VPC Service Controls' are not enabled for the BigQuery instance or if the configuration.vpcServiceControls field is 'false'.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Google BigQuery
1.4.4.8Checks if a Google AI Platform Notebook instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Google AI Platform
1.4.4.9Checks if DNS resolution from accepter/requester VPC to private IP is enabled. The rule is NON_COMPLIANT if DNS resolution from accepter/requester VPC to private IP is not enabled in Google Cloud Platform (GCP).1
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud VPC
1.4.4.10Checks if both Cloud VPN tunnels in Google Cloud Platform (GCP) are in 'ACTIVE' status. The rule is NON_COMPLIANT if one or both tunnels are in 'DOWN' status.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Cloud VPN
1.4.5: Network connections between trusted and untrusted networks are controlled.23
1.4.5.1Checks if Google Cloud Compute Instance Templates are set to assign public IP addresses to Network Interfaces. The rule is NON_COMPLIANT if the default version of a Compute Instance Template has at least 1 Network Interface with 'accessConfig' set to 'true' for assigning a public IP.3
Attributes
- Section
1.4.5: Network connections between trusted and untrusted networks are controlled.
- Service
Google Cloud Compute
1.4.5.2Checks if Google Kubernetes Engine (GKE) Pods are configured to share a host's process namespace with their containers. The rule is NON_COMPLIANT if the HostPID parameter is set to 'true'.0
Attributes
- Section
1.4.5: Network connections between trusted and untrusted networks are controlled.
- Service
Google Kubernetes Engine (GKE)
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.4633
1.5.1.1Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter endpointConfigurationType. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Endpoints
1.5.1.2Checks if an API Gateway stage uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway stage does not have an associated SSL certificate.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
API Gateway
1.5.1.3Checks if Google Cloud APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud API if it is not associated with a Cloud Armor security policy.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Armor
1.5.1.4Verifies if Google Cloud CDN is associated with Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN is not associated with a Cloud Armor policy.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud CDN
1.5.1.5Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud CDN
1.5.1.6Checks if the Cloud Source Repositories URL contains sign-in credentials. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Cloud Source Repositories
1.5.1.7Checks if Google Cloud Database Migration Service (Cloud DMS) private services are exposed to the public. The rule is NON_COMPLIANT if the equivalent public access setting is enabled.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Database Migration Service
1.5.1.8Checks if Google Cloud Firestore or Google Cloud Spanner backups are public. The rule is NON_COMPLIANT if any Firestore or Spanner backups are public.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Firestore / Google Cloud Spanner
1.5.1.9Checks if the Google Cloud Platform (GCP) Identity-Aware Proxy (IAP) settings allow access for all users. The rule is NON_COMPLIANT if 'accessLevel' is set to 'allUsers'.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Identity-Aware Proxy (IAP)
1.5.1.10Checks if the status of the Google Cloud Config Sync association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance. The rule is compliant if the field status is COMPLIANT. For more information about associations in GCP, see Config Sync documentation.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Config Sync
1.5.1.11Checks if Google Cloud Platform (GCP) Cloud VPN has 'AutoTunnel' enabled. The rule is NON_COMPLIANT for a Cloud VPN if 'AutoTunnel' is set to 'enable'.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud VPN
1.5.1.12Checks if the Google Kubernetes Engine (GKE) cluster endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Kubernetes Engine (GKE)
1.5.1.13Checks if Google Cloud Elasticsearch clusters (via Google Cloud Marketplace or a self-managed deployment) are within a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch cluster endpoint is public.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Elasticsearch
1.5.1.14Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured with SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without an SSL certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud certificate.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Load Balancing
1.5.1.15Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, an HTTPS load balancer should be configured. This rule is specifically applicable to Google Cloud Load Balancers and not to any other load balancing options.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Load Balancing
1.5.1.16Checks if an account with Google Cloud Dataproc has block public access settings enabled. The rule is NON_COMPLIANT if the blockPublicAccess configuration is false or if true, ports other than Port 22 are listed in the allowedFirewallRules.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Dataproc
1.5.1.17In Google Cloud Platform (GCP), the equivalence for the incoming SSH policy that disables incoming SSH traffic can be achieved using Firewall Rules. Specifically, you would create a firewall rule that denies TCP traffic on port 22 (the default SSH port) to restrict SSH access for instances.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Compute Engine Firewall Rules
1.5.1.18Checks if Cloud Routers are attached to an authorized Google Cloud VPC network. The rule is NON_COMPLIANT if Cloud Routers are attached to an unauthorized VPC network.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud VPC
1.5.1.19Checks if the Cloud Functions IAM policy attached to the Cloud Function prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Functions
1.5.1.20Checks if a Google Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Functions
1.5.1.21Checks if default ports for SSH (22) and RDP (3389) ingress traffic for Google Cloud Platform firewall rules is unrestricted. The rule is NON_COMPLIANT if a firewall rule allows ingress traffic from any source IP address on ports 22 or 3389.2
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Firewall
1.5.1.22Checks if a GCP Firewall Rule is configured with a user-defined default action for fragmented packets. The rule is NON_COMPLIANT if the default action for fragmented packets does not match the user-defined action.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Compute Engine
1.5.1.23Check if Google Cloud Firewall policy is associated with stateful or stateless rules. This rule is NON_COMPLIANT if no stateful or stateless rules are associated with the Firewall policy, else COMPLIANT if any one of the rule types exists.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Firewall
1.5.1.24Checks if a GCP Firewall Rule contains rules. The rule is NON_COMPLIANT if there are no rules in a Firewall Rule.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud VPC
1.5.1.25Checks if there are public routes in the route table to a Cloud Router (GCP equivalent). The rule is NON_COMPLIANT if a route to a Cloud Router has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Compute Engine
1.5.1.26Checks if Google Cloud's Elasticsearch (managed) instances are in a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch instance endpoint is public.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Elasticsearch
1.5.1.27Checks if there are any Google Cloud SQL database instances that do not use the default Cloud SQL settings. The rule is NON_COMPLIANT if there are any database instances not configured with the default settings.4
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud SQL
1.5.1.28Checks if the Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration' field's 'authorizedNetworks' array is not empty, indicating that the instance has been configured to allow connections from public IP addresses.3
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud SQL
1.5.1.29Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the `access` field contains an entry with `specialGroup` set to 'allUsers'.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google BigQuery
1.5.1.30Checks if Google Cloud Storage (GCS) buckets have uniform bucket-level access enabled to block public access settings. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.3
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Storage
1.5.1.31Verifies if the necessary IAM permissions are properly configured at the project level in GCP. The rule is marked as NON_COMPLIANT when the assigned roles do not align with the expected IAM policy configurations.4
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud IAM
1.5.1.32Checks if the required public access settings are configured at the project level. The rule is NON_COMPLIANT if the IAM policy does not restrict public access appropriately based on the specified parameters or defaults.2
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Storage
1.5.1.33Checks if Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.2
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Storage
1.5.1.34Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Bucket Policy Only settings, uniform bucket-level access, and the bucket access control list (ACL).2
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Storage
1.5.1.35Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform bucket-level access settings, the bucket IAM policies, and the bucket access control list (ACL).2
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Storage
1.5.1.36Checks if a Google Cloud AI Platform Notebooks instance is launched within a Virtual Private Cloud (VPC) network or within a list of approved subnets. The rule is NON_COMPLIANT if an AI Platform Notebooks instance is not launched within a VPC or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud AI Platform Notebooks
1.5.1.37Checks if direct internet access is disabled for a Google Cloud Vertex AI Workbench instance. The rule is NON_COMPLIANT if the Vertex AI Workbench instance is internet-enabled.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Vertex AI Workbench
1.5.1.38Checks if a Private Service Access connection is created for each Google Cloud Virtual Private Cloud (GCP VPC). The rule is NON_COMPLIANT if a GCP VPC doesn't have a Private Service Access connection created for the service.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud VPC
1.5.1.39Checks if there are unused firewall rules in Google Cloud Platform (GCP). The rule is COMPLIANT if each firewall rule is associated with a VPC network. The rule is NON_COMPLIANT if a firewall rule is not associated with a VPC network.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud VPC
1.5.1.40Checks if Google Cloud firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.2
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Firewall
1.5.1.41Checks if a Google Cloud Armor security policy contains any rules. The policy is considered NON_COMPLIANT if there are no rules present within the security policy.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Armor
1.5.1.42Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Cloud Armor security policy.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Armor
1.5.1.43Checks whether a GCP Web Application Firewall (WAF) contains any firewall rules. This rule is NON_COMPLIANT if a WAF does not contain any firewall rule.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Armor
1.5.1.44Checks if Cloud Armor security policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor security policy.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Cloud Armor
1.5.1.45Checks whether the Google Cloud Armor security policy contains rules with match conditions. This rule is COMPLIANT if the security policy contains at least one match condition and NON_COMPLIANT otherwise.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Google Cloud Armor
1.5.1.46Checks if a GCP Cloud Armor security policy contains any security rules. The policy is NON_COMPLIANT if there are no security rules present within a Cloud Armor security policy.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
GCP Cloud Armor
2.2.5: System components are configured and managed securely.176
2.2.5.1Checks if HTTP to HTTPS redirection is configured on all HTTP load balancers. The rule is NON_COMPLIANT if one or more HTTP load balancers do not have HTTP to HTTPS redirection configured, or if one or more HTTP load balancers have forwarding to an HTTP backend instead of redirection.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Load Balancing
2.2.5.2Checks if Google Cloud CDN is using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for a Google Cloud CDN configuration if any 'OriginSslProtocols' includes 'SSLv3'.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud CDN
2.2.5.3Checks if Google Cloud CDN backends are using a minimum security policy and cipher suite of TLSv1.2 or greater for viewer connections. This rule is NON_COMPLIANT for a Cloud CDN backend if the minimumProtocolVersion is below TLSv1.2.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud CDN
2.2.5.4Checks if Google Cloud CDN services are using a custom SSL certificate and are configured to use SNI to serve HTTPS requests. The rule is NON_COMPLIANT if a custom SSL certificate is associated but the SSL support method is a dedicated IP address.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud CDN
2.2.5.5Checks if Google Cloud CDN is encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'OriginProtocolPolicy' is set to 'HTTP_ONLY' or if 'OriginProtocolPolicy' is set to 'match-viewer' and 'ViewerProtocolPolicy' is 'ALLOW_ALL'.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud CDN
2.2.5.6Checks if your Google Cloud CDN configurations use HTTPS for serving content. The rule is NON_COMPLIANT if the value of 'enableBackendService' is set to 'true' without enforcing HTTPS for backend services.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud CDN
2.2.5.7Check if Google Cloud Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled on the service.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Search
2.2.5.8Checks whether your Google Cloud Load Balancer SSL proxies are using a custom SSL policy. The rule is only applicable if there are SSL proxies for the Load Balancer.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Load Balancing
2.2.5.9Checks if your Google Cloud Load Balancer SSL certificates use a predefined policy. The rule is NON_COMPLIANT if the Google Cloud Load Balancer's HTTPS/SSL certificate policy does not equal the value of the parameter 'predefinedPolicyName'.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Load Balancing
2.2.5.10Checks if your Cloud Load Balancer is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured with SSL or HTTPS.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Load Balancing
2.2.5.11Checks if Google Cloud Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if no security configuration is attached to the cluster or the security configuration does not meet the specified rule parameters.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Dataproc
2.2.5.12Checks whether connections to Google Cloud Elasticsearch clusters are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Elasticsearch cluster 'enableHttps' is not true or is true, and 'minimumTlsVersion' is not in 'tlsVersions'.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Elasticsearch
2.2.5.13Check if Google Cloud's Elasticsearch Service nodes are encrypted end-to-end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the Elasticsearch instance.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Elasticsearch Service
2.2.5.14Checks if Google BigQuery datasets require TLS/SSL encryption to connect to SQL clients. The rule is NON_COMPLIANT if any Google BigQuery dataset does not have encryption enabled for data in transit.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google BigQuery
2.2.5.15Checks if Cloud Storage buckets have policies that require requests to use HTTPS. The rule is NON_COMPLIANT if any Cloud Storage bucket has policies allowing HTTP requests.2
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Cloud Storage
2.2.5.16Checks if a server created with Google Cloud Storage uses FTP for data transfer. The rule is NON_COMPLIANT if the server protocol for data transfer is FTP-enabled.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Storage
2.2.5.17Checks if Google Cloud Firewall rules allow unrestricted incoming traffic ('0.0.0.0/0' or '::/0') and verify if only authorized TCP or UDP connections on specified ports are permitted. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.2
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Google Cloud Firewall
2.2.7: System components are configured and managed securely.197
2.2.7.1Checks if HTTP to HTTPS redirection is configured on all HTTP load balancers. The rule is NON_COMPLIANT if one or more HTTP load balancers do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP load balancers have forwarding to an HTTP load balancer instead of redirection.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Load Balancing
2.2.7.2Checks if Google Cloud CDN is using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for a Cloud CDN configuration if any 'OriginSslProtocols' includes 'SSLv3'.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud CDN
2.2.7.3Checks if Google Cloud CDN configurations are encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'originProtocol' is 'HTTP_ONLY' or if 'originProtocol' is 'MATCH_VIEWER' and 'viewerProtocol' is 'ALLOW_ALL'.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud CDN
2.2.7.4Checks if your Google Cloud CDN configurations use HTTPS. The rule is NON_COMPLIANT if the value of 'enableHttp2' is set to 'true' while 'enableCaching' is set to 'true', but the backend service does not support HTTPS.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud CDN
2.2.7.5Checks if your Google Cloud Firestore in Datastore mode has TLS enabled for secure connections. The rule is NON_COMPLIANT if Firestore is not encrypted by transport layer security (TLS).0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Firestore
2.2.7.6Checks if Google Cloud Database Migration service endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Google Cloud Database Migration service does not have an SSL connection configured.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Database Migration Service
2.2.7.7Checks if Google Cloud Database Migration Service endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Database Migration Service
2.2.7.8Checks if Google Cloud Memorystore (Redis) instances have encryption-in-transit enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'transit_encryption_mode' is set to 'DISABLED'.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Memorystore
2.2.7.9Check if Google Cloud's Elasticsearch service (operated through Google Cloud Marketplace) nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the Elasticsearch cluster.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Elasticsearch (via Google Cloud Marketplace)
2.2.7.10Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS frontend with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers and does not check other types of load balancers.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Load Balancing
2.2.7.11Checks whether your Google Cloud Load Balancer SSL proxies are using a custom SSL policy. The rule is only applicable if there are SSL proxy listeners configured for the Load Balancer.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Load Balancing
2.2.7.12Checks if your Google Cloud Platform (GCP) HTTPS Load Balancer SSL certificates are using a predefined policy. The rule is NON_COMPLIANT if the HTTPS Load Balancer SSL certificate's policy does not equal the value of the parameter 'predefinedPolicyName'.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Load Balancing
2.2.7.13Checks if your Google Cloud Load Balancer is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured with SSL or HTTPS.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Load Balancing
2.2.7.14Checks if Google Cloud Dataproc clusters have IAM conditions enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or the security configuration does not satisfy the specified rule parameters.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Dataproc
2.2.7.15Checks if a Google Cloud Pub/Sub topic enforces encryption in transit using HTTPS (TLS) for communication with the subscribers of the topic. The rule is NON_COMPLIANT if plain text communication is enabled for in-transit messages.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Pub/Sub
2.2.7.16Checks whether connections to Google Cloud Elasticsearch (GCP equivalent of OpenSearch) are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Elasticsearch domain 'enableHttps' is not 'true' or is 'true' and 'tlsPolicy' is not in the allowed TLS policies.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Elasticsearch
2.2.7.17Check if Google Cloud's Elasticsearch on GCP (via Google Cloud Marketplace) has end-to-end encryption enabled. The rule is NON_COMPLIANT if the node-to-node encryption is not activated.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Elasticsearch
2.2.7.18Checks if Google BigQuery datasets require secure access (TLS/SSL encryption) for connections. The rule is NON_COMPLIANT if any Google BigQuery dataset does not enforce secure connections.2
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google BigQuery
2.2.7.19Checks if Cloud Storage buckets have policies that require requests to use SSL/TLS. The rule is NON_COMPLIANT if any Cloud Storage bucket has policies allowing HTTP requests.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Google Cloud Storage
3.2.1: Storage of account data is kept to a minimum.92
3.2.1.1Checks if a backup plan in Google Cloud Platform has a backup policy that meets the necessary frequency and retention duration. The policy is NON_COMPLIANT if recovery snapshots are not taken with the required frequency or if they expire before the designated retention time.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Google Cloud Backup and DR
3.2.1.2Checks if a Cloud Storage object (recovery point) retains data for at least the specified retention period. The rule is NON_COMPLIANT if the object's retention policy is less than the required retention duration.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Cloud Storage
3.2.1.3Checks if a Google Cloud Logging LogBucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.1
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Google Cloud Logging
3.2.1.4Checks if a Google Cloud Firestore database retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Google Cloud Firestore
3.2.1.5Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore collections. The rule is NON_COMPLIANT if PITR is not enabled for Firestore collections.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Google Cloud Firestore
3.2.1.6Checks if Persistent Disks are attached to Google Compute Engine instances. Optionally checks if Persistent Disks are set to delete on instance termination.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Google Compute Engine
3.2.1.7Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Google Container Registry (GCR)
3.2.1.8Checks if a lifecycle rule is configured for a Google Cloud Storage bucket. The rule is NON_COMPLIANT if there is no active lifecycle configuration or the configuration does not match the parameter values.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Google Cloud Storage
3.2.1.9Checks if Google Cloud Storage (GCS) buckets with versioning enabled have lifecycle policies configured. The rule is NON_COMPLIANT if the GCS lifecycle policy is not enabled.1
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Google Cloud Storage
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.92
3.3.1.1.1Verifies if a backup policy has a backup job that meets the necessary schedule and retention criteria. The job is deemed NON_COMPLIANT if recovery snapshots are not created at least as frequently as defined by the schedule or if they expire before the defined retention period.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Backup and DR
3.3.1.1.2Checks if a recovery point expiration in Google Cloud Platform (GCP) meets the specified retention period requirements. The rule is NON_COMPLIANT if the recovery point has a retention period shorter than the required retention period, specifically for services like Google Cloud Storage or Google Cloud Backup and DR.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Backup and DR
3.3.1.1.3Checks if a Google Cloud Logging LogBucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.1
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Logging
3.3.1.1.4Checks if a Google Cloud Firestore database's retention policy is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Firestore
3.3.1.1.5Checks if point-in-time recovery (PITR) is enabled for Cloud Firestore or Cloud Bigtable tables. The rule is NON_COMPLIANT if PITR is not enabled for these tables.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Cloud Firestore / Cloud Bigtable
3.3.1.1.6Checks if Persistent Disk volumes are attached to Compute Engine instances. Optionally checks if Persistent Disk volumes are configured to be deleted when an instance is terminated.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Compute Engine
3.3.1.1.7Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Container Registry
3.3.1.1.8Checks if a lifecycle rule is configured for a Google Cloud Storage bucket. The rule is NON_COMPLIANT if there is no active lifecycle configuration rules or the configuration does not match with the parameter values.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage
3.3.1.1.9Checks if Google Cloud Storage (GCS) version-enabled buckets have lifecycle management policies configured. The rule is NON_COMPLIANT if GCS lifecycle management policies are not enabled.1
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.92
3.3.1.3.1Checks if a backup plan has a backup rule that meets the required frequency and retention period in Google Cloud Platform (GCP). The rule is considered NON_COMPLIANT if recovery points are not created at least as frequently as the specified frequency or if they expire before the defined retention period.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Backup and DR
3.3.1.3.2Verifies that a backup in Google Cloud Storage does not expire before the specified retention period. The rule is NON_COMPLIANT if the backup's retention policy is set to less than the required retention period.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage
3.3.1.3.3Checks if a Google Cloud Logging Log Bucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.1
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Logging
3.3.1.3.4Checks if a Google Cloud Firestore database's retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Firestore
3.3.1.3.5Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore databases. The rule is NON_COMPLIANT if PITR is not enabled for Firestore databases.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Firestore
3.3.1.3.6Checks if Persistent Disks are attached to Compute Engine instances. Optionally checks if Persistent Disks are set to delete on instance termination.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Compute Engine
3.3.1.3.7Checks if a private Google Container Registry (GCR) has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Container Registry
3.3.1.3.8Checks if a lifecycle rule is configured for a Google Cloud Storage (GCS) bucket. The rule is NON_COMPLIANT if there is no active Object Lifecycle Management configuration or the configuration does not match with the parameter values.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage
3.3.1.3.9Checks if Google Cloud Storage (GCS) buckets with versioning enabled have lifecycle policies configured. The rule is NON_COMPLIANT if GCS lifecycle policy is not enabled.1
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.92
3.3.2.1Verifies if a backup plan has a backup policy that meets the required frequency and retention period. The policy is NON_COMPLIANT if recovery points are not created at least as frequently as specified or are deleted before the required retention duration.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Backup and DR
3.3.2.2Checks if a backup in Cloud Storage or Persistent Disk has a retention period that meets or exceeds the specified duration. The rule is NON_COMPLIANT if the backup retention policy is shorter than required.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Backup and DR
3.3.2.3Checks if a Google Cloud Logging LogBucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.1
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Logging
3.3.2.4Checks if a Google Cloud Firestore database's retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Firestore
3.3.2.5Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore. The rule is NON_COMPLIANT if PITR is not enabled for Firestore.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Firestore
3.3.2.6Checks if Persistent Disks are attached to Compute Engine instances. Optionally checks if Persistent Disks are set to be deleted when the instance is deleted.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Compute Engine
3.3.2.7Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Container Registry
3.3.2.8Checks if a lifecycle rule is configured for a Google Cloud Storage (GCS) bucket. The rule is NON_COMPLIANT if there are no active lifecycle configuration rules or the configuration does not match with the parameter values.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage
3.3.2.9Checks if Google Cloud Storage (GCS) buckets with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if GCS lifecycle policy is not enabled.1
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.92
3.3.3.1Verifies if a backup policy in GCP has a backup rule that meets the necessary frequency and retention criteria. The rule is deemed NON_COMPLIANT if recovery snapshots are not created at least as frequently as specified in the policy or if they expire before the established retention period.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Backup and DR
3.3.3.2Checks if a backup retention policy for Google Cloud Storage complies with the specified retention period. The rule is NON_COMPLIANT if the backup's retention setting is less than the required duration.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage
3.3.3.3Checks if a Google Cloud Logging LogBucket retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.1
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Logging
3.3.3.4Checks if a Google Cloud Firestore database retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Firestore
3.3.3.5Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore or Cloud Spanner databases. The rule is NON_COMPLIANT if PITR is not enabled for Firestore or Spanner databases.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Firestore / Cloud Spanner
3.3.3.6Checks if Persistent Disks are attached to Compute Engine instances. Optionally checks if Persistent Disks are set to be deleted when the instance is terminated.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Compute Engine
3.3.3.7Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Container Registry
3.3.3.8Checks if a lifecycle rule is configured for a Google Cloud Storage bucket. The rule is NON_COMPLIANT if there is no active lifecycle configuration rules or the configuration does not match with the parameter values.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage
3.3.3.9Checks if Google Cloud Storage (GCS) buckets with versioning enabled have a retention policy configured. The rule is NON_COMPLIANT if GCS retention policy is not enabled.1
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Google Cloud Storage (GCS)
3.5.1: Primary account number (PAN) is secured wherever it is stored.3537
3.5.1.1Checks if all methods in Google Cloud Endpoints services have caching enabled and cache encrypted. The rule is NON_COMPLIANT if any method in a Google Cloud Endpoints service is not configured to cache or the cache is not encrypted.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Endpoints
3.5.1.2Checks if a Google BigQuery dataset is encrypted at rest. The rule is NON_COMPLIANT if encryption of data at rest is not enabled for a BigQuery dataset.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google BigQuery
3.5.1.3Checks if a Google Cloud Platform (GCP) recovery point is encrypted. The rule is NON_COMPLIANT if the recovery point is not encrypted.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Backup and DR
3.5.1.4Checks if Google Cloud Logging log sinks are encrypted with a specified Google Cloud KMS key. The rule is NON_COMPLIANT if a log sink is not encrypted with any KMS key or is encrypted with a KMS key not supplied in the rule parameter.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Logging
3.5.1.5Checks if Google Cloud Audit Logs is configured to use the Google Cloud Key Management Service (Cloud KMS) for encryption. The rule is COMPLIANT if the KmsKeyId is defined.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Audit Logs
3.5.1.6Checks if a Google Cloud Build trigger has encryption enabled for all of its artifacts. The rule is NON_COMPLIANT if 'encryptionDisabled' is set to 'true' for any primary or secondary (if present) artifact configurations.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Build
3.5.1.7Checks if the project contains environment variables GOOGLE_CLOUD_ACCESS_KEY and GOOGLE_CLOUD_SECRET_KEY. The rule is NON_COMPLIANT when the project environment variables contain plaintext credentials.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Resource Manager
3.5.1.8Checks if a Google Cloud Build project configured with Google Cloud Storage (GCS) Logs has encryption enabled for its logs. The rule is NON_COMPLIANT if 'encryptionDisabled' is set to 'true' in the 'storage' configuration of a Cloud Build project.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Build
3.5.1.9Checks if Google Cloud Firestore or Google Cloud Bigtable instances are encrypted. The rule is NON_COMPLIANT if a Firestore or Bigtable instance is not encrypted.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Firestore / Google Cloud Bigtable
3.5.1.10Checks if storage encryption is enabled for your Google Cloud Firestore databases. The rule is NON_COMPLIANT if storage encryption is not enabled.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Firestore
3.5.1.11Checks if Google Cloud Firestore or Google Cloud Bigtable table is encrypted with Google Cloud Key Management Service (KMS). The rule is NON_COMPLIANT if the Firestore or Bigtable table is not encrypted with Google Cloud KMS. The rule is also NON_COMPLIANT if the encrypted Google Cloud KMS key is not present in the keyResourceIds input parameter.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Firestore / Google Cloud Bigtable
3.5.1.12Checks if the Google Cloud Firestore databases are encrypted and checks their status. The rule is COMPLIANT if the status is enabled or enabling.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Firestore
3.5.1.13Checks if Google Cloud Persistent Disk encryption is enabled by default. The rule is NON_COMPLIANT if the encryption is not enabled.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage / Google Compute Engine
3.5.1.14Verifies if secrets are passed as environment variables in Google Cloud Platform containers. The rule is NON_COMPLIANT if any environment variable key matches a key listed in the 'secretKeys' parameter (excluding environment variables from other sources such as Google Cloud Storage).0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Kubernetes Engine (GKE)
3.5.1.15Checks if Google Cloud Filestore is configured to encrypt file data using Google Cloud Key Management Service (Google Cloud KMS). The rule is NON_COMPLIANT if the 'fileShare.encryptionKey.name' is not set or does not match the required KMS key.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Filestore
3.5.1.16Checks if Google Kubernetes Engine (GKE) clusters are configured to have Kubernetes secrets encrypted using Google Cloud KMS. The rule is NON_COMPLIANT if a GKE cluster does not have the appropriate encryption settings in place or if secrets are not being encrypted using the specified KMS key.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Kubernetes Engine (GKE)
3.5.1.17Checks if Google Kubernetes Engine (GKE) clusters are configured to have Kubernetes secrets encrypted using Google Cloud KMS (Key Management Service).1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Kubernetes Engine (GKE)
3.5.1.18Checks if Google Cloud Memorystore for Redis instances have encryption-at-rest enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'redis_version' does not support encryption or if the KMS key does not match the approved KMS key settings.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Memorystore for Redis
3.5.1.19Checks if Google Cloud Elasticsearch (managed by Google Cloud) has encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption at rest option is not enabled.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Elasticsearch
3.5.1.20Checks if attached Google Cloud Persistent Disks are encrypted and optionally are encrypted with a specified CMEK (Customer Managed Encryption Keys). The rule is NON_COMPLIANT if attached Persistent Disks are unencrypted or are encrypted with a CMEK key not in the supplied parameters.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage
3.5.1.21Checks if Google Cloud Pub/Sub topics are encrypted at rest with Google-managed encryption. The rule is NON_COMPLIANT for a Pub/Sub topic if 'encryptionConfiguration' is not present.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Pub/Sub
3.5.1.22Checks if storage encryption is enabled for your Google Cloud SQL instances. The rule is NON_COMPLIANT if storage encryption is not enabled.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud SQL
3.5.1.23Checks if a Google Cloud SQL instance has automated backups encrypted. The rule is NON_COMPLIANT if a Cloud SQL instance does not have automated backups encrypted.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Cloud SQL
3.5.1.24Checks if Google Cloud's Elasticsearch (GCP equivalent of Amazon OpenSearch Service) instances have encryption at rest configuration enabled. The rule is NON_COMPLIANT if the 'encryption' settings are not enabled.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Elasticsearch
3.5.1.25Checks if a Google Cloud SQL instance is encrypted at rest. The rule is NON_COMPLIANT if a Google Cloud SQL instance is not encrypted at rest.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud SQL
3.5.1.26Checks if Google Cloud SQL database backups are encrypted. The rule is NON_COMPLIANT if the Google Cloud SQL database backups are not encrypted.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud SQL
3.5.1.27Checks if storage encryption is enabled for your Google Cloud SQL instances. The rule is NON_COMPLIANT if storage encryption is not enabled.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud SQL
3.5.1.28Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if the dataset does not have audit logging enabled.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google BigQuery
3.5.1.29Checks if Google BigQuery datasets are using a specified Google Cloud Key Management Service (GCP KMS) key for encryption. The rule is COMPLIANT if encryption is enabled and the dataset is encrypted with the key provided in the kmsKeyResource parameter. The rule is NON_COMPLIANT if the dataset is not encrypted or encrypted with another key.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google BigQuery
3.5.1.30Checks if your Google Cloud Storage bucket has default object encryption enabled or that the bucket policy explicitly denies upload requests without server-side encryption. The rule is NON_COMPLIANT if your Google Cloud Storage bucket is not encrypted by default.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage
3.5.1.31Checks if GCS buckets are encrypted with Google Cloud Key Management Service (Cloud KMS). The rule is NON_COMPLIANT if the GCS bucket is not encrypted with a Cloud KMS key.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage (GCS)
3.5.1.32Checks if Google Cloud KMS (Cloud Key Management Service) key is configured for a Google AI Platform endpoint configuration. The rule is NON_COMPLIANT if 'kmsKeyName' is not specified for the Google AI Platform endpoint configuration.2
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google AI Platform
3.5.1.33Checks if a Google Cloud Key Management Service (Google Cloud KMS) key is configured for a Google AI Platform notebook instance. The rule is NON_COMPLIANT if 'kmsKeyName' is not specified for the AI Platform notebook instance.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud AI Platform
3.5.1.34Checks if all secrets in Google Cloud Secret Manager are encrypted using a customer managed encryption key (CMEK) created in Google Cloud Key Management Service (KMS). The rule is COMPLIANT if a secret is encrypted using a customer managed key. This rule is NON_COMPLIANT if a secret is encrypted using the default Google-managed encryption keys.4
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Secret Manager
3.5.1.35Checks if Pub/Sub topics are encrypted with Google Cloud Key Management Service (Google Cloud KMS). The rule is NON_COMPLIANT if a Pub/Sub topic is not encrypted with Google Cloud KMS. Optionally, specify the key resource names for the rule to check.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Pub/Sub
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.99
3.5.1.1.1Checks if Google Cloud Platform (GCP) SSL Certificates are marked for expiration within the specified number of days. GCP manages SSL certificates through Google-managed SSL certificates which are automatically renewed; however, user-managed certificates need manual renewal. The rule is NON_COMPLIANT if your SSL certificates are about to expire.0
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Certificate Manager
3.5.1.1.2Checks if Google Cloud's Certificate Authority Service has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Certificate Authority Service
3.5.1.1.3Checks if a Cloud Endpoints API service uses a valid SSL certificate. The rule is NON_COMPLIANT if the API service does not have an associated SSL certificate enabled.0
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Cloud Endpoints
3.5.1.1.4Checks if the certificate associated with a Google Cloud CDN (Content Delivery Network) is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN distribution uses the default SSL certificate.0
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud CDN
3.5.1.1.5Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured to use SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a certificate from Certificate Manager or is configured with a certificate different from a Certificate Manager certificate.1
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Load Balancing
3.5.1.1.6Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, an SSL or HTTPS listener must be configured with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers and does not apply to other types of load balancers in GCP.1
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Load Balancing
3.5.1.1.7Checks if the managed Google Cloud IAM policies you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.2
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud IAM
3.5.1.1.8Checks if the IAM policies attached to your GCP Service Accounts do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in a policy.4
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud IAM
3.5.1.1.9Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Key Management Service (Google Cloud KMS)
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.3135
3.5.1.3.1Checks if Google Cloud Certificate Manager Certificates in your account are marked for expiration within the specified number of days. Certificates provided by Certificate Manager are automatically renewed if they are managed by Google Cloud. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Certificate Manager
3.5.1.3.2Checks if Google Cloud Certificate Authority Service (GCP CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Certificate Authority Service
3.5.1.3.3Checks if an API Gateway endpoint uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway endpoint does not have an associated SSL certificate.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
API Gateway
3.5.1.3.4Checks if a Backup Vault in GCP has an attached resource-based policy that prevents deletion of recovery points. The rule is NON_COMPLIANT if the Backup Vault does not have resource-based policies or has policies lacking a suitable 'Deny' statement (statement with 'storage.objects.delete', 'storage.objects.update', and 'storage.buckets.setIamPolicy' permissions).0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage
3.5.1.3.5Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN configuration uses the default SSL certificate.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud CDN
3.5.1.3.6Checks if Google Cloud Database Migration Service (Google Cloud DMS) instances are public. The rule is NON_COMPLIANT if the 'public' field is set to true.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Database Migration Service
3.5.1.3.7Checks if Google Cloud Firestore database backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore database backups are public.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Firestore
3.5.1.3.8Checks if Google Cloud Persistent Disk snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots are shared with all users, indicating that Google Cloud Persistent Disk snapshots are public.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Compute Engine
3.5.1.3.9Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the ReadOnlyRootFilesystem parameter in the container specifications of a Kubernetes Pod is set to 'false'.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Kubernetes Engine
3.5.1.3.10Checks if Google Cloud Filestore access control is configured to enforce a root directory. The rule is NON_COMPLIANT if the access path is set to '/' (default root directory of the file system).0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Filestore
3.5.1.3.11Checks if Google Cloud Filestore instances are configured to enforce user identity. The rule is NON_COMPLIANT if 'POSIX user' is not defined or if parameters are provided and there is no match in the corresponding parameter.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Filestore
3.5.1.3.12Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured to use SSL certificates from Google Managed Certificates or other trusted Certificate Authority. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a valid SSL certificate or is configured with a certificate that is not trusted.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Load Balancing
3.5.1.3.13Checks if the Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS backend service with your Global or Regional Load Balancer. This rule is only applicable to HTTP(S) Load Balancers and does not check TCP/UDP Load Balancers.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Load Balancing
3.5.1.3.14Checks if a Google Cloud Platform project has VPC firewall rules configured to block public access settings. The rule is NON_COMPLIANT if the ingress firewall rules allow traffic from 0.0.0.0/0 on ports other than port 22.2
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud VPC Firewall Rules
3.5.1.3.15Checks if the managed GCP Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.2
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud IAM
3.5.1.3.16Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not permit actions that are blocked on all GCP KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on any GCP KMS key in an IAM policy.4
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud IAM
3.5.1.3.17Checks if Google Cloud Key Management Service (GCP KMS) keys are not scheduled for deletion in GCP KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Key Management Service (Cloud KMS)
3.5.1.3.18Checks if the Google Cloud Functions IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access, it is NON_COMPLIANT.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Cloud Functions
3.5.1.3.19Checks if a Google Cloud SQL database instance snapshot is public. The rule is NON_COMPLIANT if any existing and new Cloud SQL snapshot is public.2
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud SQL
3.5.1.3.20Checks if the Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration.enablePublicIp' field is true in the instance configuration.4
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud SQL
3.5.1.3.21Checks if Google Cloud SQL backups are public. The rule is NON_COMPLIANT if any existing and new Google Cloud SQL backups are public.3
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud SQL
3.5.1.3.22Checks if Google BigQuery datasets have public access enabled. The rule is NON_COMPLIANT if the 'access' field contains any entries allowing public (allUsers) access.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google BigQuery
3.5.1.3.23Checks if Google Cloud Storage (GCS) buckets have uniform bucket-level access enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.3
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage
3.5.1.3.24Checks if the required public access prevention settings are configured at the project level in Google Cloud. The rule is only NON_COMPLIANT when the fields set below do not match the corresponding fields in the configuration item.4
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage
3.5.1.3.25Checks if the required Public Access prevention settings are configured at the project level. The rule is NON_COMPLIANT if the configuration item does not match one or more settings from parameters (or default).0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage
3.5.1.3.26Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.2
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage (GCS)
3.5.1.3.27Checks if Object Versioning is enabled on a Google Cloud Storage (GCS) bucket, as MFA Delete equivalent functionality is not available. The rule is NON_COMPLIANT if Object Versioning is not enabled.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage (GCS)
3.5.1.3.28Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Uniform Bucket-Level Access settings, bucket policy, and bucket access control list (ACL).2
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage
3.5.1.3.29Checks if your Google Cloud Storage buckets do not allow public write access. The rule examines the bucket IAM policies, access control policies, and uniform bucket-level access settings.2
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Storage
3.5.1.3.30Checks if direct internet access is disabled for a Google Cloud AI Platform Notebooks instance. The rule is NON_COMPLIANT if an AI Platform Notebooks instance is internet-enabled.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud AI Platform Notebooks
3.5.1.3.31Checks if Google Cloud Document AI processor resources owned by the account are public. The rule is NON_COMPLIANT if Document AI processors with the owner 'Self' are public.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Google Cloud Document AI
3.6.1: Cryptographic keys used to protect stored account data are secured.98
3.6.1.1Checks if Google Cloud Certificate Manager SSL Certificates in your account are marked for expiration within the specified number of days. Certificates managed by Google Cloud are automatically renewed. Certificates that are imported do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Certificate Manager
3.6.1.2Checks if Google Cloud Certificate Authority Service (CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Certificate Authority Service
3.6.1.3Checks if a Google Cloud Endpoints API has an SSL certificate. The rule is NON_COMPLIANT if the Google Cloud Endpoints API does not have an associated SSL certificate.0
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Endpoints
3.6.1.4Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud CDN
3.6.1.5Checks if Google Cloud HTTP(S) Load Balancers have backends that are configured to use SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud certificate.1
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Load Balancing
3.6.1.6Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure you have an SSL or HTTPS listener configured with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers. This rule does not check other types of load balancers.1
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Load Balancing
3.6.1.7Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.2
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud IAM
3.6.1.8Checks if the IAM policies attached to your Google Cloud users, service accounts, and groups do not permit actions that are blocked for all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed for all Google Cloud KMS keys in a policy.3
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud IAM and Cloud KMS
3.6.1.9Checks if Google Cloud Key Management Service (Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Key Management Service (Cloud KMS)
3.6.1.2: Cryptographic keys used to protect stored account data are secured.97
3.6.1.2.1Checks if Google Cloud Certificate Manager certificates in your account are marked for expiration within the specified number of days. Certificates managed by Google Cloud Certificate Manager are automatically renewed, but those imported from other providers are not. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Certificate Manager
3.6.1.2.2Checks if Google Cloud Certificate Authority Service (Google CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Certificate Authority Service
3.6.1.2.3Checks if a Google Cloud Endpoints API has an SSL certificate associated with its configuration. The rule is NON_COMPLIANT if the API does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Endpoints
3.6.1.2.4Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud CDN
3.6.1.2.5Checks if Google Cloud Load Balancers have backend services configured with SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without an SSL certificate or is configured with a certificate that is not from Google Cloud Certificate Manager.1
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Load Balancing
3.6.1.2.6Checks if the Classic Load Balancers use SSL certificates provided by Google Cloud SSL Certificates. To use this rule, an SSL or HTTPS load balancer configuration must be applied with your load balancer in GCP. This rule is only applicable to HTTP(S) Load Balancers. This rule does not check TCP Proxy Load Balancers and Internal Load Balancers.0
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Load Balancing
3.6.1.2.7Checks if the managed GCP Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.2
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud IAM
3.6.1.2.8Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud IAM and Google Cloud KMS
3.6.1.2.9Checks if Google Cloud Key Management Service (GCP KMS) keys are not scheduled for deletion in GCP KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Key Management Service (GCP KMS)
3.6.1.3: Cryptographic keys used to protect stored account data are secured.99
3.6.1.3.1Checks if Google Cloud Platform SSL Certificates in your project are marked for expiration within the specified number of days. Google-managed SSL certificates are automatically renewed. User-managed certificates are not automatically renewed. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Certificate Manager
3.6.1.3.2Checks if Google Cloud Certificate Authority Service (Google Cloud CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Certificate Authority Service
3.6.1.3.3Checks if a Google Cloud HTTP(S) Load Balancer front-end configuration uses an SSL certificate. The rule is NON_COMPLIANT if the load balancer does not have an associated SSL certificate.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud HTTP(S) Load Balancing
3.6.1.3.4Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud CDN
3.6.1.3.5Checks if Google Cloud Load Balancers (both HTTP(S) Load Balancers and TCP/UDP Load Balancers) have backend services and target proxies configured to use certificates from Google-managed SSL Certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service or target proxy that is configured without a Google-managed SSL Certificate or is configured with a certificate different from a Google-managed SSL Certificate.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Load Balancing
3.6.1.3.6Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS frontend configuration with your Google Cloud Load Balancer. This rule is only applicable to HTTPS Load Balancers. This rule does not check TCP Load Balancers or Internal Load Balancers.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Load Balancer
3.6.1.3.7Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud IAM
3.6.1.3.8Checks if the IAM policies attached to your GCP users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys in an IAM policy.4
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud IAM and Google Cloud KMS
3.6.1.3.9Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud KMS
3.6.1.4: Cryptographic keys used to protect stored account data are secured.99
3.6.1.4.1Checks if Google Cloud Certificate Manager Certificates in your project are marked for expiration within the specified number of days. Certificates provided by Certificate Manager are automatically renewed. Certificate Manager does not automatically renew certificates that you import. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Certificate Manager
3.6.1.4.2Checks if Google Cloud Certificate Authority Service has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Certificate Authority Service
3.6.1.4.3Checks if an API Gateway stage uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway stage does not have an associated SSL certificate.0
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
API Gateway
3.6.1.4.4Checks if the SSL certificate associated with a Google Cloud CDN is a default certificate. The rule is NON_COMPLIANT if a Google Cloud CDN uses the default SSL certificate.0
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud CDN
3.6.1.4.5Checks if Google Cloud Load Balancers have backend services configured with HTTPS certificates from Google Managed SSL Certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a Google Managed SSL certificate or is configured with a certificate not issued by Google.1
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Load Balancing
3.6.1.4.6Checks if the Google Cloud HTTP(S) Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure that an SSL or HTTPS frontend configuration is set up with your HTTP(S) Load Balancer. This rule is only applicable to HTTP(S) Load Balancers. This rule does not check TCP/SSL Proxy Load Balancers or Internal Load Balancers.1
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud HTTP(S) Load Balancer
3.6.1.4.7Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.2
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud IAM
3.6.1.4.8Checks if the IAM policies attached to your GCP users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.4
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud IAM
3.6.1.4.9Checks if Google Cloud Key Management Service (GCP KMS) keys are not scheduled for deletion in GCP KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Google Cloud Key Management Service (GCP KMS)
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.107
3.7.1.1Checks if Google Cloud Certificate Manager certificates in your account are marked for expiration within the specified number of days. Certificates in Google Cloud can be managed, including automatic renewals for managed certificates. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Manager
3.7.1.2Checks if RSA certificates managed by Google Cloud's Certificate Manager have a key length of at least '2048' bits. The rule is NON_COMPLIANT if the minimum key length is less than 2048 bits.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Manager
3.7.1.3Checks if Google Cloud Certificate Authority Service (GCP CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Authority Service
3.7.1.4Checks if a Cloud Endpoint uses an SSL certificate. The rule is NON_COMPLIANT if the Cloud Endpoint does not have an associated SSL certificate.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Cloud Endpoints
3.7.1.5Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN configuration uses the default SSL certificate.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud CDN
3.7.1.6Checks if Google Cloud HTTPS Load Balancers have backend services configured with SSL/TLS certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 HTTPS Load Balancer has at least 1 backend service that is configured without a SSL/TLS certificate from Google Cloud Certificate Manager or is configured with a certificate different from those managed by Google Cloud Certificate Manager.1
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.1.7Checks if the Global Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS frontend with your Global Load Balancer. This rule is only applicable to Global Load Balancers. This rule does not check Regional Load Balancers or Internal Load Balancers.1
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.1.8Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM
3.7.1.9Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on any Google Cloud KMS key in an IAM policy.3
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM
3.7.1.10Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Key Management Service (Google Cloud KMS)
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.98
3.7.2.1Checks if Google Cloud's Certificate Manager Certificates in your project are marked for expiration within the specified number of days. Certificates provided by Google Cloud are automatically renewed. Google Cloud does not automatically renew certificates that you import. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Manager
3.7.2.2Checks if Google Cloud Private CA has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Authority Service
3.7.2.3Checks if a Cloud Endpoints API uses an SSL certificate. The rule is NON_COMPLIANT if the Cloud Endpoints API does not have an associated SSL certificate.0
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Cloud Endpoints
3.7.2.4Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud CDN
3.7.2.5Checks if Google Cloud Load Balancers have backend services configured with SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without an SSL certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud Certificate Manager certificate.1
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.2.6Checks if the HTTPS Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an HTTPS or SSL proxy load balancer. This rule is only applicable to HTTPS Load Balancers. This rule does not check TCP/UDP Load Balancers.1
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.2.7Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM and Google Cloud KMS
3.7.2.8Checks if the IAM policies attached to your GCP IAM users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all GCP KMS keys in an IAM policy.4
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM
3.7.2.9Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for destruction in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for destruction.1
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud KMS
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.109
3.7.4.1Checks if Google Cloud Certificate Manager Certificates in your account are marked for expiration within the specified number of days. Certificates managed by Google Cloud Certificate Manager can be automatically renewed, but the auto-renewal is dependent on the proper configuration. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Manager
3.7.4.2Checks if Google Cloud Certificate Authority Service (CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Authority Service
3.7.4.3Checks if a Google Cloud Endpoints API has an SSL certificate associated. The rule is NON_COMPLIANT if the API does not have an associated SSL certificate.0
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Endpoints
3.7.4.4Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud CDN
3.7.4.5Checks if automatic key rotation is enabled for each key and matches to the key ID of the customer created Google Cloud KMS key. The rule is NON_COMPLIANT if the IAM role associated with the resource does not have the cloudkms.keys.get permission3
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Key Management Service (KMS)
3.7.4.6Checks if Google Cloud Load Balancers (including HTTP(S) Load Balancers and TCP/UDP Load Balancers) have backend services that are configured to use SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from one in Google Cloud Certificate Manager.1
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.4.7Checks if the Classic Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS frontend configuration with your Network Load Balancer. This rule is only applicable to Classic Load Balancers. This rule does not check HTTP(S) Load Balancers.0
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.4.8Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM and Google Cloud KMS
3.7.4.9Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM
3.7.4.10Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud KMS
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.23
3.7.5.1Checks if Google Cloud Certificate Manager SSL certificates in your account are nearing expiration within the specified number of days. Certificates managed by Google Cloud are automatically renewed, while those imported must be manually renewed. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Manager
3.7.5.2Checks if automatic key rotation is enabled for each key in Google Cloud's KMS and matches to the key ID of the customer created Google Cloud KMS key. The rule is NON_COMPLIANT if the IAM role associated with the resource does not have the 'cloudkms.keys.get' permission.3
Attributes
- Section
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Key Management Service (KMS)
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.98
3.7.6.1Checks if Google Cloud Certificate Manager certificates in your account are marked for expiration within the specified number of days. Certificates provided by Google Cloud are not automatically renewed, and you must manually renew them before expiration. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Manager
3.7.6.2Checks if Google Cloud Certificate Authority Service (GCP CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Authority Service
3.7.6.3Checks if an API Gateway endpoint uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway endpoint does not have an associated SSL certificate.0
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
API Gateway
3.7.6.4Checks if the SSL certificate associated with a Google Cloud CDN is the default Google-managed SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN configuration uses the default Google-managed SSL certificate.0
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud CDN
3.7.6.5Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured to use SSL certificates from Google Managed SSL Certificates. This rule is NON_COMPLIANT if at least 1 HTTP(S) Load Balancer has at least 1 backend service that is configured without a Google Managed SSL Certificate or is configured with a certificate different from a Google Managed SSL Certificate.1
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.6.6Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. This rule is applicable only to HTTP(S) Load Balancers. It does not check TCP/UDP Load Balancers.1
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.6.7Verifies that the Google Cloud IAM policies do not permit blocked actions on Google Cloud KMS keys. The rule is considered NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the IAM policy.2
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM
3.7.6.8Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM
3.7.6.9Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Key Management Service (Google Cloud KMS)
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.98
3.7.7.1Checks if Google Cloud Certificate Manager certificates in your project are marked for expiration within the specified number of days. Certificates created by Google Cloud Certificate Manager are automatically renewed. However, imported certificates are not automatically renewed. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Manager
3.7.7.2Checks if Google Cloud Certificate Authority Service (GCP CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Certificate Authority Service
3.7.7.3Checks if a Cloud Endpoints service configuration is using an SSL certificate. The rule is NON_COMPLIANT if the Cloud Endpoints service does not have an associated SSL certificate.0
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Cloud Endpoints
3.7.7.4Checks if the certificate associated with a Google Cloud CDN (Content Delivery Network) backend service is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN backend service uses the default SSL certificate.0
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud CDN
3.7.7.5Checks if Google Cloud Load Balancers have backend services configured to use certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud Certificate Manager certificate.1
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.7.6Checks if the Network Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure your Network Load Balancer has a frontend configuration with HTTPS. This rule is applicable only to Network Load Balancers and does not check HTTP(S) Load Balancers.1
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Load Balancing
3.7.7.7Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM
3.7.7.8Checks if the IAM policies attached to your Google Cloud users, service accounts, and groups do not allow blocked actions on all GCP KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all GCP KMS keys in an IAM policy.4
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud IAM
3.7.7.9Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.1
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Google Cloud Key Management Service (Google Cloud KMS)
4.2.1: PAN is protected with strong cryptography during transmission.1911
4.2.1.1Checks if HTTP to HTTPS redirection is configured on all backend services associated with Google Cloud Load Balancers. The rule is NON_COMPLIANT if one or more backend services do not have HTTP to HTTPS redirection configured or if any backend services forward requests to another HTTP backend service instead of redirecting.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancing
4.2.1.2Checks if Google Cloud CDN (Cloud Content Delivery Network) backends are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for a Google Cloud CDN backend if any 'OriginSslProtocols' includes 'SSLv3'.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud CDN
4.2.1.3Checks if Google Cloud CDN is encrypting traffic to custom backends. The rule is NON_COMPLIANT if 'originProtocol' is 'HTTP' and 'clientRedirect' is 'ALLOW_ALL'.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud CDN
4.2.1.4Checks if your Google Cloud CDN configurations enforce HTTPS by verifying that the 'secure' option is enabled for the load balancer backend service. The rule is NON_COMPLIANT if the load balancer allows HTTP traffic without redirection to HTTPS.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud CDN
4.2.1.5Checks if your Google Cloud Firestore is set to use HTTPS for API requests. The rule is NON_COMPLIANT if Firestore does not have HTTPS enabled for secure communication.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Firestore
4.2.1.6Checks if Google Cloud Database Migration Service (GCP DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if GCP DMS does not have an SSL connection configured.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Database Migration Service
4.2.1.7Checks if Google Cloud Platform (GCP) Cloud SQL for Redis data stores is configured to use SSL encryption for data communicated with other endpoints. The rule is NON_COMPLIANT if SSL encryption is not enabled.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud SQL
4.2.1.8Checks if Google Cloud Memorystore (Redis) instances have in-transit encryption enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'transitEncryptionMode' is set to 'DISABLED'.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Memorystore
4.2.1.9Check if Google Cloud's Elasticsearch nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the ElastiSearch cluster.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Elasticsearch
4.2.1.10Checks if the Google Cloud Load Balancers (GCLB) use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an HTTPS load balancer with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers. This rule does not check TCP Proxy Load Balancers or SSL Proxy Load Balancers.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancer
4.2.1.11Checks whether your Google Cloud Platform (GCP) HTTPS Load Balancer is using a custom SSL policy. The rule is only applicable if there are SSL listeners for the HTTPS Load Balancer.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancing
4.2.1.12Checks if your Google Cloud Load Balancer SSL certificates use a predefined policy. The rule is NON_COMPLIANT if the Google Cloud Load Balancer HTTPS/SSL listener's policy does not equal the value of the parameter 'predefinedPolicyName'.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancing
4.2.1.13Checks if your Google Cloud Platform Load Balancer is configured with SSL (HTTPS) backend services. The rule is NON_COMPLIANT if a backend service is not configured with SSL or HTTPS.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancing
4.2.1.14Checks if Google Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not satisfy the specified rule parameters.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Dataproc
4.2.1.15Checks if a Google Cloud Pub/Sub topic enforces encryption in transit using HTTPS (TLS) with the broker nodes of the topic. The rule is NON_COMPLIANT if plain text communication is enabled for in-topic broker node connections.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Pub/Sub
4.2.1.16Checks whether connections to Google Cloud Search domains are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Search domain 'RequireHTTPS' is not 'true' or is 'true' and the 'TLSVersion' is not in the acceptable security policies.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Search
4.2.1.17Check if Google Cloud's Elasticsearch (GCP equivalent to Amazon OpenSearch Service) nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the cluster.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Elasticsearch on Google Cloud
4.2.1.18Checks if Google BigQuery requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Google BigQuery dataset has parameter `enable_legacy_sql` not set to false, as BigQuery encrypts data in transit using TLS by default.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
BigQuery
4.2.1.19Checks if Google Cloud Storage buckets have policies that require requests to use SSL/TLS. The rule is NON_COMPLIANT if any Cloud Storage bucket has policies allowing HTTP requests.2
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Storage
4.2.1.1: PAN is protected with strong cryptography during transmission.2714
4.2.1.1.1Checks if Google Cloud Managed SSL Certificates in your project are about to expire within the specified number of days. Managed SSL Certificates are automatically renewed by Google Cloud. The rule is NON_COMPLIANT if your certificates are about to expire.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Managed SSL Certificates
4.2.1.1.2Checks if Google Cloud Certificate Authority (GCP Certificate Authority Service) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
GCP Certificate Authority Service
4.2.1.1.3Checks if HTTP to HTTPS redirection is configured on all HTTP load balancers. The rule is NON_COMPLIANT if one or more HTTP load balancers do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP load balancers have forwarding to an HTTP listener instead of redirection.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancing
4.2.1.1.4Checks if an API Gateway endpoint uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway endpoint does not have an associated SSL certificate.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
API Gateway
4.2.1.1.5Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud CDN
4.2.1.1.6Checks if Google Cloud CDN is using deprecated SSL protocols for HTTPS communication between Google Cloud CDN edge locations and backend services. This rule is NON_COMPLIANT for a Cloud CDN if any 'SslProtocols' includes 'SSLv3'.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud CDN
4.2.1.1.7Checks if Google Cloud CDN is encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'OriginProtocolPolicy' is 'HTTP_ONLY' or if 'OriginProtocolPolicy' is 'MATCH_VIEWER' and 'ViewerProtocolPolicy' is 'ALLOW_ALL'.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud CDN
4.2.1.1.8Checks if your Google Cloud CDN uses HTTPS for serving content (directly or via a redirection). The rule is NON_COMPLIANT if the value of 'https' is not enforced in the Load Balancer settings for the backend service.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud CDN
4.2.1.1.9Checks if your Google Cloud Firestore database has transport security enabled. The rule is NON_COMPLIANT if a Firestore database is not secured by Transport Layer Security (TLS).0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Firestore
4.2.1.1.10Checks if Google Cloud Database Migration Service (GCP DMS) connections are configured with an SSL connection. The rule is NON_COMPLIANT if GCP DMS does not have an SSL connection configured.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Database Migration Service
4.2.1.1.11Checks if Google Cloud Database Migration Service (GCP DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Database Migration Service
4.2.1.1.12Checks if Google Cloud Memorystore for Redis replication instances have encryption-in-transit enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'transitEncryptionEnabled' is set to 'false'.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Memorystore
4.2.1.1.13Check if Google Cloud's Elasticsearch Service nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Cloud ElasticSearch Service
4.2.1.1.14Checks if Google Cloud Load Balancers have backend services configured with SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud Certificate Manager certificate.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancing
4.2.1.1.15Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure an SSL or HTTPS proxy is configured with your Google Cloud Load Balancer. This rule is only applicable to External Load Balancers. This rule does not check Internal Load Balancers.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancing
4.2.1.1.16Checks whether your Google Cloud Load Balancer SSL certificates are using a custom policy. The rule is only applicable if there are SSL certificates associated with the Google Cloud Load Balancer.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancer
4.2.1.1.17Checks if your Google Cloud Load Balancer (GCLB) SSL policies use a predefined policy. The rule is NON_COMPLIANT if the GCLB HTTPS/SSL listener's policy does not equal the value of the parameter 'predefinedPolicyName'.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancing
4.2.1.1.18Checks if your Google Cloud Load Balancer is configured with HTTPS or SSL certificates. The rule is NON_COMPLIANT if a backend service does not have an SSL certificate configured for HTTPS traffic.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Load Balancing
4.2.1.1.19Checks if Google Cloud Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or the security configuration does not satisfy the specified rule parameters.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Dataproc
4.2.1.1.20Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.2
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud IAM
4.2.1.1.21Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud IAM
4.2.1.1.22Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for destruction in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for destruction.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud KMS
4.2.1.1.23Checks if a Google Cloud Pub/Sub topic enforces encryption in transit using HTTPS (TLS) for communication between publishers and subscribers. The rule is NON_COMPLIANT if plain text communication is enabled for in-transit messages.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Pub/Sub
4.2.1.1.24Checks whether connections to Google Cloud Elasticsearch (GCP equivalent of Amazon OpenSearch) are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Elasticsearch domain 'enforceHTTPS' is not 'true' or is 'true' and 'tlsSecurityPolicy' is not in 'tlsPolicies'.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Elasticsearch
4.2.1.1.25Check if Google Cloud's Managed Service for Elasticsearch nodes are encrypted end to end. The rule is NON_COMPLIANT if the communication between nodes is not encrypted.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Managed Service for Elasticsearch
4.2.1.1.26Checks if Google BigQuery datasets require TLS/SSL encryption to connect to SQL clients. The rule is NON_COMPLIANT if any Google BigQuery dataset has parameter 'require_ssl' not set to true.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
BigQuery
4.2.1.1.27Checks if Google Cloud Storage buckets have policies that require requests to use SSL/TLS. The rule is NON_COMPLIANT if any Google Cloud Storage bucket has policies allowing HTTP requests.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Google Cloud Storage
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.3647
5.3.4.1Checks if Google Cloud Endpoints (API Gateway in GCP) has access logging enabled. The rule is NON_COMPLIANT if 'access_log' is not present in the API configuration.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Endpoints
5.3.4.2Checks if all methods in Google Cloud Endpoints configurations have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logLevel is neither ERROR nor INFO.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Endpoints
5.3.4.3Checks if Google Cloud Trace is enabled for Google Cloud Functions or Cloud Run services. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Trace
5.3.4.4Checks if a Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is set to a value other than ERROR or ALL.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud API Gateway
5.3.4.5Checks if Network Load Balancers (NLB) are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if NLB Desync mitigation mode does not match with the user-defined Desync mitigation mode.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Network Load Balancing
5.3.4.6Checks if Google Cloud CDN backends are configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN backend does not have logging configured.2
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud CDN
5.3.4.7Checks if at least one Google Cloud Logging service is logging Google Cloud Storage (GCS) data access events for all GCS buckets. The rule is NON_COMPLIANT if there are no logging configurations that record GCS data access events.4
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Logging
5.3.4.8Checks that there is at least one Google Cloud Audit Log configured with security best practices. This rule is COMPLIANT if there is at least one log that meets all of the following:4
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Logging
5.3.4.9Google Cloud Logging must be enabled to ensure that all actions and events in the project are recorded, similar to AWS CloudTrail.2
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Logging
5.3.4.10Checks if a Google Cloud Build project has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Build
5.3.4.11Checks if a Google Cloud Logging log bucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Logging
5.3.4.12Checks if logging is enabled with a valid severity level for Google Cloud Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Database Migration Service
5.3.4.13Checks if a Google Cloud Firestore (with Datastore compatibility) instance has Cloud Logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Cloud Logging enabled for audit logs.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Firestore
5.3.4.14Checks if Google Cloud VPN has logging enabled for the tunnel. The rule is NON_COMPLIANT if 'LoggingEnabled' is set to false.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud VPN
5.3.4.15Checks if logging configuration is set on active Google Kubernetes Engine (GKE) Pod Definitions. This rule is NON_COMPLIANT if an active GKE Pod Definition does not have the logging configuration resource defined or the value for logging configuration is null in at least one container definition.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Kubernetes Engine (GKE)
5.3.4.16Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Kubernetes Engine (GKE)
5.3.4.17Checks if Google Cloud Elasticsearch domains (via Google Cloud's Elastic Stack solution) are configured to send logs to Google Cloud Logging. The rule is COMPLIANT if logging is enabled for a Google Cloud Elasticsearch domain. This rule is NON_COMPLIANT if logging is not configured.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Logging
5.3.4.18Checks if Google Cloud Platform App Engine services are configured to send logs to Cloud Logging. The rule is NON_COMPLIANT if the value of `logHealthChecks` is false.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud App Engine
5.3.4.19Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging is not enabled or the log bucket is not equal to the specified Cloud Storage bucket name.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Load Balancing
5.3.4.20Checks if Google Cloud Pub/Sub subscriptions have audit logging enabled. The rule is NON_COMPLIANT if a subscription does not have audit logging enabled.2
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Pub/Sub
5.3.4.21Checks if a Google Cloud Pub/Sub service has Cloud Logging (formerly Stackdriver Logging) enabled for audit logs. The rule is NON_COMPLIANT if audit logging is not enabled.2
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Pub/Sub
5.3.4.22In GCP, enabling audit logging across multiple regions can be achieved using Google Cloud Audit Logs, ensuring that logs are collected and stored in a centralized location, similar to AWS CloudTrail. This service provides multi-regional logging capabilities.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Audit Logs
5.3.4.23Checks if a Google Cloud SQL instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.4
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Cloud SQL
5.3.4.24Checks if Google Cloud Platform (GCP) Firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not enabled for the firewall rules.3
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Firewall
5.3.4.25Checks if Google Cloud Elasticsearch (GCP variant of OpenSearch) clusters have audit logging enabled. The rule is NON_COMPLIANT if a Google Cloud Elasticsearch cluster does not have audit logging enabled.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Elasticsearch
5.3.4.26Checks if Google Cloud Elasticsearch (GCP's equivalent to Amazon OpenSearch Service) clusters are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if logging is not configured.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Elasticsearch
5.3.4.27Checks if Google Cloud SQL for MySQL instances are configured to export logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log export configured.4
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud SQL
5.3.4.28Checks if logging is enabled for Google Cloud SQL databases. The rule is NON_COMPLIANT if any log types are not enabled.4
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud SQL
5.3.4.29Checks if Google BigQuery datasets are logging audits to a specific logging sink. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'sinkNames' parameter is provided but the audit logging destination does not match.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google BigQuery
5.3.4.30Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if audit logging is not enabled for the dataset.2
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google BigQuery
5.3.4.31Checks if Cloud DNS query logging is enabled for your Google Cloud Platform (GCP) Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your GCP Cloud DNS managed zones.2
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Cloud DNS
5.3.4.32Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.2
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Cloud Storage
5.3.4.33Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration does not meet the minimum requirements.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Workflows
5.3.4.34Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are enabled for all GCP VPC networks. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.3
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud VPC
5.3.4.35Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the specified value.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Google Cloud Armor
5.3.4.36Checks if logging is enabled on GCP Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
GCP Cloud Armor
6.3.3: Security vulnerabilities are identified and addressed.111
6.3.3.1Checks if all of the specified applications are installed on the instance. Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to instances running that platform.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google Cloud Compute Engine (OS Config)
6.3.3.2Checks if the compliance status of Google Cloud Compute Engine instance patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation. The rule is compliant if the field status is COMPLIANT.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google Cloud Compute Engine
6.3.3.3Checks if Google Cloud Run services are set to the latest platform version. The rule is NON_COMPLIANT if the platform is not set to LATEST_VERSION, or if neither the latestLinuxVersion nor latestWindowsVersion are specified as parameters.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google Cloud Run
6.3.3.4Checks if a Google Kubernetes Engine (GKE) cluster is running the oldest supported version. The rule is NON_COMPLIANT if a GKE cluster is running the oldest supported version (equal to the parameter 'oldestVersionSupported').0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google Kubernetes Engine (GKE)
6.3.3.5Checks if a Google Kubernetes Engine (GKE) cluster is running a supported Kubernetes version. This rule is NON_COMPLIANT if a GKE cluster is running an unsupported version (less than the parameter 'oldestVersionSupported').0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google Kubernetes Engine (GKE)
6.3.3.6Checks if Google Cloud Memorystore for Redis instances have automatic updates enabled. The rule is NON_COMPLIANT for a Memorystore instance if it is using the Redis engine and automatic updates are not enabled.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google Cloud Memorystore
6.3.3.7Checks if automatic application updates in a GCP App Engine environment are enabled. The rule is COMPLIANT if the value for automatic updates is set to true. The rule is NON_COMPLIANT if the value for automatic updates is set to false, or if a parameter is provided and its value does not match the existing configurations.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google App Engine
6.3.3.8Checks if the Google Cloud Function settings for runtime, service account, timeout, and memory size match the expected values. The rule ignores functions with 'container' deployment type and functions with runtime set to 'OS-only Runtime'. The rule is NON_COMPLIANT if the Cloud Function settings do not match the expected values.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google Cloud Functions
6.3.3.9Checks if Google Cloud Elasticsearch (GCE) version updates are available but not installed. The rule is NON_COMPLIANT for an Elasticsearch cluster if the latest software updates are not installed.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google Cloud Elasticsearch
6.3.3.10Checks if Google Cloud SQL instances are configured for automatic minor version upgrades. The rule is NON_COMPLIANT if the value of 'autoUpgrade' is false.1
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google Cloud SQL
6.3.3.11Checks if Google BigQuery datasets have the specified maintenance settings. The rule is NON_COMPLIANT if the automatic upgrades to major version are disabled.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Google BigQuery
6.4.1: Public-facing web applications are protected against attacks.141
6.4.1.1Checks if Google Cloud Armor is enabled on Google Cloud Load Balancers. The rule is NON_COMPLIANT if key: armor.enabled is set to false.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.1.2Checks if a Google Cloud API Gateway API configuration is using a Google Cloud Armor security policy. The rule is NON_COMPLIANT if a Google Cloud Armor policy is not used or if the used policy does not match what is specified in the rule parameter.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.1.3Checks if Google Cloud Apigee APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud Apigee API if it is not associated with a security policy.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Apigee
6.4.1.4Checks if Google Cloud CDN (Content Delivery Network) is associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN is not associated with a Cloud Armor security policy.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud CDN
6.4.1.5Checks if the security policy is associated with a Global External HTTP(S) Load Balancer or Cloud CDN in GCP. When Google Cloud Platform Firewall Rules are set up, the policy owner specifies the security policy ID in the GCP policy and can optionally enable remediation.1
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Firewall
6.4.1.6Verifies that the security policies associated with the GCP Web Application Firewall (WAF) are applied in the correct order of precedence. The correct precedence is determined by the ranks specified in the rules configuration. When Google Cloud Security Policies are established, the highest precedence is given the lowest numeric value (0), followed by subsequent values (1, 2, etc.). The policy owner defines the order in the security policy configuration and can implement automatic remediation if desired.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.1.7Checks if Cloud Armor Security Policies contain rules. The policy is NON_COMPLIANT if there are no rules in a Cloud Armor Security Policy.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Cloud Armor
6.4.1.8Checks if a Google Cloud Armor Security Policy contains any security rules. This rule is NON_COMPLIANT if a Security Policy does not contain any security rules.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.1.9Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if there are no rules present within the security policy.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.1.10Checks if a Google Cloud Armor security policy rule contains any conditions. The rule is NON_COMPLIANT if no conditions are present within the Cloud Armor security policy rule.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.1.11Verifies if a Cloud Armor Security Policy includes any security rules or rule groups. This rule is NON_COMPLIANT if a Security Policy does not contain any security rule or rule group.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Cloud Armor
6.4.1.12Checks if Google Cloud Armor security policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Google Cloud Armor security policy.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.1.13Checks whether Google Cloud Armor security policy rule contains conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.1.14Checks if a Google Cloud Armor Security Policy contains any security rules. The policy is NON_COMPLIANT if there are no security rules defined within the policy.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.2: Public-facing web applications are protected against attacks.140
6.4.2.1Checks if Google Cloud Armor is enabled on Google Cloud Load Balancers (GCLBs). The rule is NON_COMPLIANT if key: armor.enabled is set to false.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.2.2Checks if a Google Cloud Endpoints API is using a Google Cloud Armor security policy. The rule is NON_COMPLIANT if a Google Cloud Armor security policy is not used or if the used security policy does not match what is listed in the rule parameter.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Endpoints
6.4.2.3Checks if Google Cloud Endpoints APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud Endpoints API if it is not associated with a security policy.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Endpoints
6.4.2.4Checks if Google Cloud CDN (Content Delivery Network) is associated with a Google Cloud Armor security policy. The rule is NON_COMPLIANT if a Cloud CDN is not associated with a Cloud Armor policy.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud CDN
6.4.2.5Checks if the security policy is associated with a Google Cloud Load Balancer, Google Cloud Armor security policies, or Cloud CDN. When Google Cloud Armor creates this rule, the policy owner specifies the securityPolicyId in the policy and can optionally enable remediation.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.2.6Verifies if the firewall rules within the Google Cloud Armor security policy are in the correct order based on their priority. The priority is determined by the sequence in which firewall rules are defined in the security policy. Google Cloud Armor allows the user to specify the order of the rules, starting from the highest priority (0) and increasing subsequent priorities (1, 2, etc.). Remediation can be optionally implemented to correct misconfigured priorities.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.2.7Checks if Google Cloud Armor Security Policies contain rules. The rule is NON_COMPLIANT if there are no rules in a Google Cloud Armor Security Policy.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.2.8Checks if a Google Cloud Armor security policy contains any security rules. This rule is NON_COMPLIANT if a security policy does not contain any security rules.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.2.9Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if there are no rules present within the security policy.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.2.10Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Cloud Armor security policy.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Cloud Armor
6.4.2.11Checks whether a Google Cloud Armor Security Policy contains any security rules. This rule is NON_COMPLIANT if a Security Policy does not contain any security rules.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.2.12Checks if Cloud Armor security policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor security policy.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Cloud Armor
6.4.2.13Checks whether a Google Cloud Armor security policy rule contains at least one condition. This rule is COMPLIANT if the security policy rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.4.2.14Checks if a Google Cloud Armor Security Policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within a Security Policy.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Google Cloud Armor
6.5.5: Changes to all system components are managed securely.20
6.5.5.1Checks if the Google Cloud Function is not using the default traffic allocation settings. The rule is NON_COMPLIANT if the Cloud Function is using the traffic allocation of '100% to the latest version'.0
Attributes
- Section
6.5.5: Changes to all system components are managed securely.
- Service
Google Cloud Functions
6.5.5.2Verifies if the first deployment step of Google Cloud Build performs multiple deployments. Optionally checks if each following stage deploys to more than the specified number of deployments (deploymentLimit).0
Attributes
- Section
6.5.5: Changes to all system components are managed securely.
- Service
Google Cloud Build
6.5.6: Changes to all system components are managed securely.20
6.5.6.1Checks if the Cloud Function's deployment configuration is not using the default deployment strategy. The rule is NON_COMPLIANT if the Cloud Function is using the deployment strategy 'ALWAYS_ACTIVE'.0
Attributes
- Section
6.5.6: Changes to all system components are managed securely.
- Service
Cloud Functions
6.5.6.2Checks if the first deployment stage of Google Cloud Deploy performs more than one deployment. Optionally checks if each of the subsequent remaining stages deploy to more than the specified number of deployments (deploymentLimit).0
Attributes
- Section
6.5.6: Changes to all system components are managed securely.
- Service
Google Cloud Deploy
7.2.1: Access to system components and data is appropriately defined and assigned.2932
7.2.1.1Checks if a GCP project is part of an Organization. The rule is NON_COMPLIANT if a GCP project is not part of an Organization or the Organization ID does not match rule parameter OrganizationId.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Resource Manager
7.2.1.2Checks if a backup vault in Google Cloud Platform (GCP) has an attached resource-based policy that prevents deletion of backup snapshots. The rule is considered NON_COMPLIANT if the Backup Vault does not have resource-based policies or has policies without a suitable 'Deny' statement (statement with 'storage.objects.delete', 'storage.objects.update', and 'storage.buckets.setIamPolicy' permissions).0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.1.3Checks if a Google Cloud Build (GCB) configuration has privileged mode enabled. The rule is NON_COMPLIANT for a GCB build configuration if 'privileged' is set to 'true'.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Build
7.2.1.4Checks if custom Google Cloud Pub/Sub topics have an IAM policy attached. The rule is NON_COMPLIANT for custom Pub/Sub topics without an IAM policy attached.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Pub/Sub
7.2.1.5Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.2
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.1.6Checks if the privileged parameter in the container definition of Google Kubernetes Engine (GKE) Pod specifications is set to 'false'. The rule is NON_COMPLIANT if the privileged parameter is 'true'.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Kubernetes Engine (GKE)
7.2.1.7Checks if Google Cloud Run (GCR) services only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the 'Readiness checks' option for the service does not enforce read-only file system permissions.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Run
7.2.1.8Checks if Google Kubernetes Engine (GKE) deployment specifications have a security context defined to specify a user for containers to run on. The rule is NON_COMPLIANT if the 'runAsUser' parameter is not present or set to '0' (root).0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Kubernetes Engine (GKE)
7.2.1.9Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.1.10Checks if the IAM policies attached to your GCP service accounts, roles, and groups do not allow blocked actions on all GCP Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all GCP Cloud KMS keys in an IAM policy.4
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM and Cloud KMS
7.2.1.11Checks if the IAM feature is not in use. The rule is NON_COMPLIANT if a Google Cloud Identity (GCI) user, service account, or Google Group has any IAM policies that are attached inline rather than using predefined IAM roles.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.1.12Checks in each Google Cloud Identity and Access Management (IAM) resource if a policy resource name (IAM role) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the role is attached to the IAM resource.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.1.13Checks whether the IAM policy is attached to an IAM user, a group with one or more IAM users, or a service account in Google Cloud Platform (GCP).0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Identity and Access Management (IAM)
7.2.1.14Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'role': 'roles/owner' which effectively allows all permissions on all resources.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.1.15Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.3
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.1.16Checks if all specified managed IAM roles are associated with a Google Cloud IAM service account. The rule is NON_COMPLIANT if a managed IAM role is not associated with the service account.3
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.1.17Checks if the root user access key is available in Google Cloud Platform. The rule is COMPLIANT if the user access key does not exist. Otherwise, NON_COMPLIANT.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.1.18Verifies if IAM users are associated with at least one IAM group in Google Cloud Platform.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Identity and Access Management (IAM)
7.2.1.19Checks if none of your Google Cloud IAM users have roles or permissions directly attached to them. IAM users must inherit permissions from IAM groups or service accounts. The rule is NON_COMPLIANT if there is at least one custom role or permission that is directly attached to the IAM user.3
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.1.20Checks if a Google Cloud Spanner instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud Spanner instance does not have IAM database authentication enabled.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Spanner
7.2.1.21Checks if Google Cloud Elasticsearch clusters have fine-grained access control enabled. The rule is NON_COMPLIANT if IAM permissions are not set up correctly for the Elasticsearch cluster.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Elasticsearch
7.2.1.22Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.2
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud SQL
7.2.1.23Checks if a Google Cloud SQL instance has Cloud Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud SQL
7.2.1.24Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.3
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.1.25Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud accounts. For example, the rule checks that the GCS bucket policy does not allow another Google Cloud account to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.3
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.1.26Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud IAM principals, service accounts, IP addresses, or VPC Service Controls that you provide. The rule is COMPLIANT if a bucket policy is not present.3
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.1.27Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.2
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.1.28Checks if the Google AI Platform Notebooks Root Access setting is enabled for AI Platform Notebook instances. The rule is NON_COMPLIANT if the Root Access setting is set to 'Enabled' for an AI Platform Notebook instance.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google AI Platform Notebooks
7.2.1.29Checks if the Google Cloud Incident Response Team (GCSIRT) can access your GCP account. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for GCSIRT access is not configured.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Armor
7.2.2: Access to system components and data is appropriately defined and assigned.2936
7.2.2.1Checks if a GCP project is part of an organization. The rule is NON_COMPLIANT if a GCP project is not linked to any organization or the organization ID does not match the specified rule parameter OrganizationId.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Resource Manager
7.2.2.2Checks if a GCP Cloud Storage bucket used for backups has an attached IAM policy preventing deletion of backup files. The rule is NON_COMPLIANT if the bucket does not have IAM policies or has policies without sufficient 'Deny' permissions regarding the deletion of objects in the bucket.3
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.2.3Checks if a Google Cloud Build project has privileged mode enabled. The rule is NON_COMPLIANT for a Cloud Build project if 'privileged' option is set to 'true'.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Build
7.2.2.4Checks if custom Google Cloud Pub/Sub schemas have a resource policy attached. The rule is NON_COMPLIANT for custom schemas without a resource policy attached.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Pub/Sub
7.2.2.5Checks if a Google Compute Engine (GCE) instance has a Google Cloud Identity and Access Management (IAM) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Identity and Access Management (IAM)
7.2.2.6Checks if the Privileged flag in the IAM policy for GKE Pod specifications is set to 'true'. The rule is NON_COMPLIANT if the Privileged flag is 'true'.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Kubernetes Engine (GKE)
7.2.2.7Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem field in the Pod specification is set to ‘false’.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Kubernetes Engine (GKE)
7.2.2.8Checks if Google Kubernetes Engine (GKE) Pod specifications define a user for containers to run on. The rule is NON_COMPLIANT if the 'securityContext.runAsUser' parameter is not present or set to '0' (root user).0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Kubernetes Engine (GKE)
7.2.2.9Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.2.10Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM and KMS
7.2.2.11Checks if the IAM user, role, or group has any custom IAM policies that are directly attached to them, which would indicate that inline policy features are being used. The rule is NON_COMPLIANT if a Google Cloud IAM (Identity and Access Management) user, service account, or group has any custom IAM policy bindings.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.2.12Checks in each Google Cloud IAM resource if a policy (Policy ID) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy is attached to the IAM resource.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.2.13Checks whether the IAM policy is attached to a Google Cloud IAM user, a group with one or more IAM users, or a service account with one or more trusted identities.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
IAM
7.2.2.14Checks if Google Cloud Identity and Access Management (IAM) policies have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'allow' permissions on all roles over 'all resources'.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.2.15Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.3
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.2.16Checks if all Google Cloud Platform (GCP) Identity and Access Management (IAM) roles have the specified policies attached. The rule is NON_COMPLIANT if a specified policy is not attached to the IAM role.2
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.2.17Checks if the Google Cloud Platform (GCP) service account with owner privileges exists. The rule is COMPLIANT if the service account does not exist. Otherwise, NON_COMPLIANT.2
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
IAM (Identity and Access Management)
7.2.2.18Verifies if IAM users are part of at least one IAM group in Google Cloud Platform.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Identity and Access Management (IAM)
7.2.2.19Checks if none of your Google Cloud Platform (GCP) Identity and Access Management (IAM) users have custom roles or permissions attached directly to them. IAM users should inherit permissions from IAM groups or predefined roles. The rule is NON_COMPLIANT if there is at least one custom role or permission directly attached to the IAM user.3
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.2.20Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.2
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud SQL
7.2.2.21Checks if Google Cloud Elasticsearch instances have fine-grained access control enabled. The rule is NON_COMPLIANT if IAM roles and permissions are not properly configured for the Elasticsearch instance.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Elasticsearch
7.2.2.22Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Cloud SQL instance does not have IAM database authentication enabled.3
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Cloud SQL
7.2.2.23Checks if a Google Cloud SQL instance has Google Cloud Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud SQL
7.2.2.24Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.3
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.2.25Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. The rule checks that the GCS bucket policy does not allow another Google Cloud project to perform any storage.buckets.get* actions and storage.objects.delete on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.3
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.2.26Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, service accounts, IAM roles, or specified IP addresses. The rule is COMPLIANT if a bucket policy is not present.3
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.2.27Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.2
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.2.28Checks if the Google AI Platform Notebook instance has root access enabled. The rule is NON_COMPLIANT if the root access is set to 'Enabled' for a Google AI Platform Notebook instance.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google AI Platform
7.2.2.29Checks if the Google Cloud Security Incident Response Team (SIRT) can access your GCP project. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for SIRT access is not configured.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Armor
7.2.3: Access to system components and data is appropriately defined and assigned.96
7.2.3.1Checks if a Cloud Build project environment has privileged mode enabled. The rule is NON_COMPLIANT for a Cloud Build project if 'privileged' is set to 'true'.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Cloud Build
7.2.3.2Checks if Google Cloud Pub/Sub schema registries have an access control policy attached. The rule is NON_COMPLIANT for custom schema registries without an access control policy attached.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Pub/Sub
7.2.3.3Checks if the 'privileged' flag in the container configuration of Google Kubernetes Engine (GKE) Pod specifications is set to 'true'. The rule is NON_COMPLIANT if the 'privileged' flag is 'true'.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Google Kubernetes Engine (GKE)
7.2.3.4Checks if Google Kubernetes Engine (GKE) Pod specifications specify a user for containers to run on. The rule is NON_COMPLIANT if the 'securityContext.runAsUser' parameter is not present or set to '0'.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Google Kubernetes Engine (GKE)
7.2.3.5Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.2
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM / Google Cloud KMS
7.2.3.6Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM and Google Cloud KMS
7.2.3.7Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'role: 'roles/owner' which grants broad permissions over all resources.1
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.3.8Checks if the root user service account key exists. The rule is COMPLIANT if the service account key does not exist. Otherwise, NON_COMPLIANT.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Identity and Access Management (IAM)
7.2.3.9Checks if the Vertex AI Workbench Root Access setting is enabled for Vertex AI Workbench Notebooks. The rule is NON_COMPLIANT if the Root Access setting is set to 'Enabled' for a Vertex AI Workbench Notebook instance.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Vertex AI
7.2.4: Access to system components and data is appropriately defined and assigned.30
7.2.4.1Checks whether IAM groups in Google Cloud Platform (GCP) have at least one IAM user associated with them.0
Attributes
- Section
7.2.4: Access to system components and data is appropriately defined and assigned.
- Service
Identity and Access Management (IAM)
7.2.4.2Checks if your Google Cloud IAM users have passwords or active access keys that have not been used within the specified number of days you provided. The rule is NON_COMPLIANT if there are inactive accounts not recently used.0
Attributes
- Section
7.2.4: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.4.3Checks if Google Cloud Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.0
Attributes
- Section
7.2.4: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Secret Manager
7.2.5: Access to system components and data is appropriately defined and assigned.2237
7.2.5.1Checks if a Google Cloud account is part of Google Cloud Resource Manager Organization. The rule is NON_COMPLIANT if a Google Cloud account is not part of an Organization or the Organization ID does not match rule parameter MasterAccountId.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Resource Manager
7.2.5.2Checks if a Google Cloud Storage bucket has an attached IAM policy that prevents deletion of objects. The rule is NON_COMPLIANT if the Cloud Storage bucket does not have IAM policies or has policies without suitable 'Deny' statements (statements with storage.objects.delete and storage.objects.update permissions).2
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.5.3Checks if a Compute Engine instance has a Google Cloud Identity and Access Management (IAM) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the Compute Engine instance.2
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Compute Engine
7.2.5.4Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the 'readOnlyRootFilesystem' parameter in the Pod Security Policy or the Pod specification is set to 'false'.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Kubernetes Engine (GKE)
7.2.5.5Checks if the managed Google Cloud IAM policies you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.2
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.5.6Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.5.7Verifies that no IAM users, roles, or groups have inline policies defined in Google Cloud Platform, where a non-compliant status is assigned if any are found.3
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Identity and Access Management (IAM)
7.2.5.8Checks in each Google Cloud Platform Identity and Access Management (IAM) resource, if a policy Google Resource Name (GRN) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy GRN is attached to the IAM resource.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.5.9Checks whether the IAM policy is attached to a Google Cloud Identity and Access Management (IAM) user, a group with one or more IAM users, or a service account with one or more trusted entities.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.5.10Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'allow' with 'roles/owner' over '//cloudresourcemanager.googleapis.com/projects/{project_id}'.3
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.5.11Checks if GCP IAM policies that you create grant permissions to all actions on individual GCP resources. The rule is NON_COMPLIANT if any customer managed IAM policy allows full access to at least 1 GCP service.3
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.5.12Checks if all specified IAM policies are attached to the Google Cloud Identity and Access Management (IAM) role. The rule is NON_COMPLIANT if a specified policy is not attached to the IAM role.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.5.13Checks if none of your Google Cloud IAM users have roles directly attached. IAM users must inherit permissions from IAM groups or service accounts. The rule is NON_COMPLIANT if there is at least one role that is directly attached to the IAM user.3
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.5.14Checks if a Google Cloud Spanner instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud Spanner instance does not have IAM database authentication enabled.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Spanner
7.2.5.15Checks if Google Cloud Search has fine-grained access control enabled. The rule is NON_COMPLIANT if IAM roles and permissions are not properly configured for the Search resources.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Search
7.2.5.16Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.2
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud SQL
7.2.5.17Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.2
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud SQL
7.2.5.18Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.3
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.5.19Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other GCP projects. For example, the rule checks that the GCS bucket policy does not allow another GCP project to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.3
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.5.20Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, federated users, service accounts, IP addresses, or VPCs that you provide. The rule is COMPLIANT if a bucket policy is not present.3
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.5.21Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.2
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.5.22Checks if the Google Cloud Security Team (GCST) can access your Google Cloud account. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for GCST access is not configured.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Armor
7.2.5.1: Access to system components and data is appropriately defined and assigned.32
7.2.5.1.1Verifies if IAM Groups in Google Cloud Platform have at least one IAM User assigned to them.0
Attributes
- Section
7.2.5.1: Access to system components and data is appropriately defined and assigned.
- Service
IAM (Identity and Access Management)
7.2.5.1.2Checks if your GCP Identity and Access Management (IAM) users have service account keys that have not been used within the specified number of days you provided. The rule is NON_COMPLIANT if there are inactive accounts not recently used.2
Attributes
- Section
7.2.5.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud IAM
7.2.5.1.3Checks if Google Cloud Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.0
Attributes
- Section
7.2.5.1: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Secret Manager
7.2.6: Access to system components and data is appropriately defined and assigned.55
7.2.6.1Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container specification is set to ‘false’.0
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Google Kubernetes Engine (GKE)
7.2.6.2Checks whether IAM users are members of at least one IAM group in Google Cloud Platform (GCP).0
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Identity and Access Management (IAM)
7.2.6.3Checks if Google Cloud's Managed Service for Elasticsearch has IAM roles properly configured for access control. The rule is NON_COMPLIANT if IAM roles are not set correctly for the Elasticsearch service.0
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Elasticsearch
7.2.6.4Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket IAM policy does not allow another Google Cloud project to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket IAM policy.3
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.2.6.5Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.2
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Google Cloud Storage
7.3.1: Access to system components and data is managed via an access control system(s).2241
7.3.1.1Checks if a GCP project is part of an Organization. The rule is NON_COMPLIANT if a GCP project is not part of an Organization or the Organization ID does not match the specified parameter OrganizationId.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Cloud Resource Manager
7.3.1.2Checks if a Google Cloud Storage bucket used for backups has an attached IAM policy which prevents deletion of backup objects. The rule is NON_COMPLIANT if the Storage bucket does not have IAM policies or has policies without a suitable 'Deny' statement (statement with storage.objects.delete, storage.objects.update permissions).1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.1.3Checks if a Google Compute Engine (GCE) instance has a Google Cloud Identity and Access Management (IAM) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.1.4Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the 'readOnlyRootFilesystem' parameter in the container specification of the Pod definition is set to 'false'.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Kubernetes Engine (GKE)
7.3.1.5Checks if the managed GCP Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.2
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.1.6Checks if the IAM policies attached to your GCP service accounts and roles do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.4
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.1.7Checks if there are any IAM policies directly attached to GCP service accounts, which would indicate the service accounts have inline policies. The rule is NON_COMPLIANT if a GCP service account has any IAM role directly attached.4
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Identity and Access Management (IAM)
7.3.1.8Checks in each Google Cloud Identity and Access Management (IAM) resource if a policy (IAM Role or Permission) associated with the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy is attached to the IAM resource.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.1.9Verifies if the Google Cloud IAM policy is attached to a Google Cloud user, a Google Cloud group with one or more users, or a Google Cloud service account with one or more trusted entities.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.1.10Checks if Google Cloud Identity and Access Management (IAM) policies have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy binding includes 'role' that allows '*' permissions to 'allUsers'.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.1.11Checks if Google Cloud Identity and Access Management (IAM) policies grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.3
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.1.12Checks if all predefined IAM roles specified in the list are assigned to the Google Cloud IAM service account. The rule is NON_COMPLIANT if a predefined role is not assigned to the service account.4
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Identity and Access Management (IAM)
7.3.1.13Checks if none of your Google Cloud IAM (Identity and Access Management) users have custom roles or permissions assigned directly. IAM users (service accounts) should inherit permissions from IAM groups or organizational policies. The rule is NON_COMPLIANT if there is at least one custom role or permission assigned directly to the IAM user.3
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.1.14Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.2
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud SQL
7.3.1.15Checks if Google Cloud Elasticsearch Service instances have fine-grained access control enabled. The rule is NON_COMPLIANT if the fine-grained access control setting is not enabled for the Elasticsearch instance.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Elasticsearch Service
7.3.1.16Checks if a Google Cloud SQL instance has Google Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.2
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud SQL
7.3.1.17Checks if a Google Cloud SQL instance has Google Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.2
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud SQL
7.3.1.18Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.3
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.1.19Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket policy does not allow another Google Cloud project to perform any storage.objects.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.3
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.1.20Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud IAM principals, service accounts, IP addresses, or VPC Service Controls that you provide. The rule is COMPLIANT if a bucket policy is not present.3
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.1.21Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.2
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.1.22Checks if the Google Cloud Security Operations Center (SOC) can access your Google Cloud account. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for SOC access is not configured.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Armor
7.3.2: Access to system components and data is managed via an access control system(s).2228
7.3.2.1Checks if a GCP project belongs to a Google Cloud Organization. The rule is NON_COMPLIANT if a GCP project is not part of a Google Cloud Organization or if the Organization ID does not match the specified parameter.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Resource Manager
7.3.2.2Checks if a backup plan in Google Cloud Platform (GCP) has a resource policy that prevents the deletion of backup snapshots. The rule is NON_COMPLIANT if the backup plan does not have resource policies or has policies without a suitable 'Deny' statement (conditions that restrict deletion operations on the backup resources).0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Backup and DR
7.3.2.3Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM (Identity and Access Management) service account attached to it. The rule is NON_COMPLIANT if no service account is attached to the GCE instance.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Compute Engine
7.3.2.4Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container specification is set to 'false'.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Kubernetes Engine
7.3.2.5Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud KMS
7.3.2.6Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.2.7Checks if IAM policies are managed instead of using inline policies. The rule is NON_COMPLIANT if a Google Cloud IAM user, service account, or group has any inline policy instead of only using Google Cloud IAM custom roles and permissions.2
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.2.8Checks in each GCP Identity and Access Management (IAM) resource if a policy (e.g., IAM Role or IAM Policy) is attached to the IAM resource. The rule is NON_COMPLIANT if the specified policy is attached to the IAM resource.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.2.9Checks whether the IAM policy is attached to a GCP user (service account), a Google group containing one or more users, or a GCP role with one or more principals.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
IAM (Identity and Access Management)
7.3.2.10Checks if Google Cloud Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer-managed IAM policy binding includes 'role: roles/owner' or any role that grants permissions to all actions over 'resource: /*'.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.2.11Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any custom IAM policy allows full access to at least 1 Google Cloud service.2
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.2.12Checks if all managed IAM roles specified in the list of IAM policies are attached to the Google Cloud Identity and Access Management (IAM) role. The rule is NON_COMPLIANT if a managed policy is not attached to the IAM role.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Identity and Access Management (IAM)
7.3.2.13Checks if none of your Google Cloud Platform (GCP) IAM users have custom roles or permissions directly attached. IAM users must inherit permissions from IAM groups or predefined roles. The rule is NON_COMPLIANT if there is at least one custom role or permission attached directly to the IAM user.3
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.2.14Checks if a Google Cloud Spanner instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud Spanner instance does not have IAM database authentication enabled.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Spanner
7.3.2.15Checks if Google Cloud's Elasticsearch Service (managed by Elastic) domains have fine-grained access control enabled. The rule is NON_COMPLIANT if security features are not enabled for the Elasticsearch Service domain.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Elasticsearch Service
7.3.2.16Checks if a Google Cloud SQL instance has Cloud Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Cloud SQL instance does not have IAM authentication enabled.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Cloud SQL
7.3.2.17Checks if a Google Cloud SQL instance has Google Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Cloud IAM authentication enabled.3
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud SQL
7.3.2.18Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.3
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.2.19Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other GCP projects or external accounts. The rule checks that the GCS bucket IAM policy does not allow another GCP project or external account to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket IAM policy.3
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.2.20Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, service accounts, IP addresses, or VPCs that you provide. The rule is COMPLIANT if a bucket policy does not allow public access.2
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.2.21Checks if your Google Cloud Storage bucket IAM policies do not allow other inter-account permissions than the control Google Cloud Storage bucket IAM policy that you provide.2
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.2.22Checks if the Google Cloud Security Command Center (SCC) can access your Google Cloud project. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for SCC access is not configured.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Armor
7.3.3: Access to system components and data is managed via an access control system(s).2239
7.3.3.1Checks if a GCP project is part of an organization. The rule is NON_COMPLIANT if a GCP project is not associated with an organization or if the organization ID does not match the rule parameter 'OrganizationId'.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Cloud Resource Manager
7.3.3.2Checks if a Google Cloud Backup (GCB) Vault has an attached IAM policy which prevents deletion of backup recovery points. The rule is NON_COMPLIANT if the Backup Vault does not have IAM policies or has policies without appropriate 'deny' conditions.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Backup
7.3.3.3Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.2
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.3.4Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container spec is set to 'false'.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Kubernetes Engine (GKE)
7.3.3.5Checks if the managed GCP Identity and Access Management (IAM) policies do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.3
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.3.6Verifies that the IAM policies associated with your GCP service accounts and Google groups do not permit actions that are blocked by GCP's key management controls on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in a policy.4
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.3.7Checks if the IAM policy feature is not in use. The rule is NON_COMPLIANT if a Google Cloud Identity and Access Management (IAM) user, service account, or IAM group has any inline policies associated with them.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Identity and Access Management (IAM)
7.3.3.8Checks in each Google Cloud IAM resource, if a policy specified by Resource Name (URN) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy URN is attached to the IAM resource.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.3.9Checks whether the IAM policy is attached to a Google Cloud IAM user, a Google Group with one or more IAM users, or a Google Service Account with one or more trusted identities.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.3.10Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'binding' with 'role' that grants 'roles/owner', 'roles/editor', or any other role that has broad permissions over 'allUsers' or 'allAuthenticatedUsers' over 'projects/*'.2
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Identity and Access Management (IAM)
7.3.3.11Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.3
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.3.12Checks if all specified IAM roles in Google Cloud have the required IAM policies attached. The rule is NON_COMPLIANT if a required IAM policy is not attached to the role.4
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.3.13Checks if none of your Google Cloud IAM users have policies attached. IAM users must inherit permissions from IAM groups or roles. The rule is NON_COMPLIANT if there is at least one policy that is attached to the IAM user.2
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud IAM
7.3.3.14Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.2
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud SQL
7.3.3.15Checks if Google Cloud Search instances have fine-grained access control enabled. The rule is NON_COMPLIANT if IAM policies do not enforce fine-grained access control for the Cloud Search instance.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Search
7.3.3.16Checks if a Google Cloud SQL instance has Google Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.2
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud SQL
7.3.3.17Checks if a Google Cloud SQL instance has Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have Cloud IAM authentication enabled.3
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud SQL
7.3.3.18Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.3
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.3.19Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the Google Cloud Storage bucket IAM policy does not allow another Google Cloud project to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Google Cloud Storage bucket IAM policy.3
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.3.20Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, IAM users, service accounts, IP addresses, or VPCs that you provide. The rule is COMPLIANT if a bucket policy is not present.3
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.3.21Checks if your Google Cloud Storage bucket permissions do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.2
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Google Cloud Storage
7.3.3.22Checks if the Google Cloud Armor Security Team can access your GCP project. The rule is NON_COMPLIANT if Cloud Armor is enabled but the role for the Security Team access is not configured.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Cloud Armor
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.53
8.2.1.1Checks if running Google Compute Engine (GCE) instances are launched using Google Cloud Keys. The rule is NON_COMPLIANT if a running GCE instance is launched with a service account key.1
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Compute Engine
8.2.1.2Checks whether IAM groups in GCP have at least one IAM member (user/service account)0
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Identity and Access Management (IAM)
8.2.1.3Checks whether the IAM policy is attached to a Google Cloud Identity and Access Management (IAM) user, or to a group of users, or to a service account with trusted identities.0
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.1.4Checks if the Google Cloud Platform (GCP) root service account (unrestricted access) key is available. The rule is COMPLIANT if the service account key does not exist. Otherwise, NON_COMPLIANT.2
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
IAM (Identity and Access Management)
8.2.1.5Verifies if IAM users belong to at least one IAM group in Google Cloud Platform.0
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Identity and Access Management (IAM)
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.113
8.2.2.1Checks if the project contains environment variables GOOGLE_APPLICATION_CREDENTIALS. The rule is NON_COMPLIANT when the project environment variables contain plaintext credentials.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Environment Variables
8.2.2.2Checks if running Google Compute Engine (GCE) instances are launched using Google Cloud key pairs. The rule is NON_COMPLIANT if a running GCE instance is launched with a key pair.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Compute Engine
8.2.2.3Checks if secrets are passed as container environment variables. The rule is NON_COMPLIANT if 1 or more environment variable key matches a key listed in the 'secretKeys' parameter (excluding environmental variables from other locations such as Google Cloud Storage).0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Kubernetes Engine
8.2.2.4Checks whether IAM groups have at least one IAM user in Google Cloud Platform.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Identity and Access Management (IAM)
8.2.2.5Checks whether the IAM policy is attached to a Google Cloud IAM user, a group of Google Cloud IAM users, or a Google Cloud IAM role with one or more trusted entities.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.2.6Checks if the Google Cloud project has any service account key with Owner role. The rule is COMPLIANT if no service account key with the Owner role exists. Otherwise, NON_COMPLIANT.3
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
IAM (Identity and Access Management)
8.2.2.7Checks whether IAM users are members of at least one IAM group in Google Cloud Platform (GCP). This can be done using the Identity and Access Management (IAM) service to review roles and group memberships.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Identity and Access Management (IAM)
8.2.2.8Checks if Google Secret Manager secret has rotation enabled. The rule also checks an optional maxAllowedRotationFrequency parameter. If specified, the rotation frequency of the secret is compared with the max allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation or if the rotation frequency exceeds the specified maxAllowedRotationFrequency.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Secret Manager
8.2.2.9Checks if Google Cloud Secret Manager secrets rotated successfully according to the rotation schedule. Secret Manager monitors the rotation date, and the rule is NON_COMPLIANT if the date passes and the secret isn't rotated.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Secret Manager
8.2.2.10Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Secret Manager
8.2.2.11Checks if Google Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Secret Manager
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.50
8.2.4.1Checks if running Google Compute Engine (GCE) instances are launched using Google Cloud key pairs. The rule is NON_COMPLIANT if a running GCE instance is launched with a key pair.0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Compute Engine
8.2.4.2Verifica se os grupos IAM têm pelo menos um usuário IAM.0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.4.3Verifies if the IAM policy is attached to a Google Cloud IAM user, a Google Group containing one or more IAM users, or a Google Cloud IAM Role that has one or more trusted identities.0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.4.4Check if the service account with editor or owner roles has been assigned. The rule is COMPLIANT if such service accounts do not exist. Otherwise, NON_COMPLIANT.0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
IAM (Identity and Access Management)
8.2.4.5Verifies if IAM users are included in at least one IAM group within Google Cloud Platform (GCP).0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.53
8.2.5.1Checks if running Google Compute Engine (GCE) instances are launched using SSH keys. The rule is NON_COMPLIANT if a running GCE instance is launched with a project-wide SSH key.1
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Compute Engine
8.2.5.2In Google Cloud Platform (GCP), this can be achieved by checking the IAM policy of a group to see if it contains any IAM members. This involves verifying that each IAM group has at least one user assigned in the IAM roles.0
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
IAM (Identity and Access Management)
8.2.5.3Verifies whether the IAM policy is attached to a Google Cloud IAM user, a Google Group that contains one or more IAM users, or a Google IAM role that is associated with one or more service accounts.0
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
IAM
8.2.5.4Checks if the Google Cloud IAM service account key for the root user exists. The rule is COMPLIANT if the service account key does not exist. Otherwise, NON_COMPLIANT.2
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.5.5Checks whether IAM users are members of at least one IAM group in Google Cloud Platform (GCP).0
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.30
8.2.6.1Checks whether IAM groups in Google Cloud Platform have at least one IAM user assigned to them.0
Attributes
- Section
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Identity and Access Management (IAM)
8.2.6.2Checks if your GCP Identity and Access Management (IAM) users have passwords or active service account keys that have not been used within the specified number of days. The rule is NON_COMPLIANT if there are inactive accounts not recently used.0
Attributes
- Section
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.6.3Checks if Google Cloud Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.0
Attributes
- Section
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Secret Manager
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.2233
8.2.7.1Checks if a GCP project is part of a Google Cloud Organization. The rule is NON_COMPLIANT if a GCP project is not associated with the organization or if the Organization ID does not match the rule parameter MasterOrganizationId.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Resource Manager
8.2.7.2Checks if a GCP Backup Policy has suitable IAM policies attached to it to prevent the deletion of backup sources. The rule is NON_COMPLIANT if the Backup Policy does not have IAM policies or has policies without a suitable 'deny' condition (condition with storage.objects.delete, storage.objects.update permissions).0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Cloud Storage
8.2.7.3Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM (Identity and Access Management) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Compute Engine (GCE)
8.2.7.4Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem field in the container spec of GKE Pod definitions is set to 'false'.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Kubernetes Engine (GKE)
8.2.7.5Verifies that the IAM policies within Google Cloud Platform do not permit disallowed actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any disallowed action is allowed on Google Cloud KMS keys by the IAM policy.3
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.7.6Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on any Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM and Cloud KMS
8.2.7.7Checks if the IAM policy feature is not in use. The rule is NON_COMPLIANT if a Google Cloud Identity (GCP IAM) user, IAM role, or IAM group has any inline policy.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.7.8Checks in each Google Cloud IAM resource if a policy (role or binding) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy is attached to the IAM resource.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.7.9Checks whether the IAM policy ARN is attached to a user, group, or role with associated members in Google Cloud Platform.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Identity and Access Management (IAM)
8.2.7.10Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer-managed IAM policy binding includes 'role' that grants 'roles/owner' or 'roles/editor' over 'allUsers'.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.7.11Checks if Google Cloud IAM roles that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer managed IAM role allows full access to at least 1 Google Cloud service.3
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.7.12Checks if all Google Cloud IAM policies specified in the list of IAM roles are attached to the Google Cloud IAM role. The rule is NON_COMPLIANT if a IAM policy is not attached to the IAM role.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.7.13Checks if none of your Google Cloud IAM users have roles attached directly. IAM users must inherit permissions from IAM groups or service accounts. The rule is NON_COMPLIANT if there is at least one role that is attached directly to the IAM user.3
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.7.14Checks if a Google Cloud SQL instance has Google Cloud IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.3
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud SQL
8.2.7.15Checks if Google Cloud Search has fine-grained access control enabled. The rule is NON_COMPLIANT if security features for Cloud Search are not configured correctly.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Search
8.2.7.16Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Cloud SQL instance does not have IAM database authentication enabled.3
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud SQL
8.2.7.17Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.2
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud SQL
8.2.7.18Checks if Google Cloud Storage Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.3
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Storage
8.2.7.19Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket IAM policy does not allow another Google Cloud project to perform any storage.buckets.get and storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket IAM policy.3
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Storage
8.2.7.20Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the GCP principals, service accounts, or IP addresses that you provide. The rule is COMPLIANT if a bucket policy (IAM role bindings) is not present.3
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Storage
8.2.7.21Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Cloud Storage bucket policy that you provide.2
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Storage
8.2.7.22Checks if the Google Cloud Incident Response Team (GCSIRT) can access your GCP project. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for GCSIRT access is not configured.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Armor
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.2428
8.2.8.1Checks if a Google Cloud account is part of Google Cloud Resource Manager Organization. The rule is NON_COMPLIANT if a Google Cloud project is not associated with any organization or the organization's ID does not match the specified OrganizationId parameter.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Resource Manager
8.2.8.2Checks whether only the Google Cloud Platform (GCP) Metadata Server v2 is enabled. This rule is NON_COMPLIANT if the Metadata version is not specified in the instance configuration or if both Metadata v1 and v2 are enabled.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Compute Engine
8.2.8.3Checks if a Google Cloud Platform (GCP) Backup Policy has an attached resource-based IAM policy which prevents deletion of recovery points. The rule is NON_COMPLIANT if the Backup Policy does not have IAM policies or has policies without a suitable 'Deny' statement (statement with roles/storage.admin permissions for backup deletion).0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Storage
8.2.8.4Checks if your Google Compute Engine (GCE) instance metadata version is configured with the Enhanced Metadata feature enabled. The rule is NON_COMPLIANT if the metadata access is set to legacy mode.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Compute Engine
8.2.8.5Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.2
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.8.6Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the ReadOnlyRootFilesystem parameter in the container specification of the Pod definition is set to 'false'.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Kubernetes Engine
8.2.8.7Checks if the managed Google Cloud Identity and Access Management (IAM) policies you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.8.8Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow forbidden actions on Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any forbidden action is permitted on all Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM & Cloud KMS
8.2.8.9Checks if the IAM policy feature is not in use. The rule is NON_COMPLIANT if a Google Cloud Identity and Access Management (IAM) user, service account, or IAM group has any IAM policy bindings attached directly to them instead of using predefined roles or custom roles.2
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Identity and Access Management (IAM)
8.2.8.10Checks in each Google Cloud IAM resource if a policy Google Cloud Resource Name (GCRN) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy GCRN is attached to the IAM resource.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.8.11Checks whether the IAM policy is attached to a Google Cloud IAM user, a group with one or more IAM users, or a Google Cloud IAM role with one or more trusted entities.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Identity and Access Management (IAM)
8.2.8.12Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'role' that allows all actions on all resources.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.8.13Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.3
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.8.14Checks if all IAM policies specified in the list are attached to the Google Cloud IAM role. The rule is NON_COMPLIANT if a managed policy is not attached to the IAM role.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.8.15Checks if none of your Google Cloud IAM users have policies attached directly to them. IAM users must inherit permissions from IAM roles or groups. The rule is NON_COMPLIANT if there is at least one policy that is attached to the IAM user.2
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud IAM
8.2.8.16Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.2
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud SQL
8.2.8.17Checks if Google Cloud Elasticsearch domains have fine-grained access control enabled. The rule is NON_COMPLIANT if IAM roles and permissions for the Elasticsearch Service are not configured properly to enforce fine-grained access control.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Elasticsearch
8.2.8.18Checks if a Google Cloud SQL instance has IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud SQL
8.2.8.19Checks if a Google Cloud SQL instance has Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud SQL
8.2.8.20Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.3
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Storage
8.2.8.21Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other GCP projects. For example, the rule checks that the GCS bucket IAM policy does not allow another GCP project to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket IAM policy.3
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Storage
8.2.8.22Checks that the access granted by the Google Cloud Storage bucket is restricted to specified Google Cloud principals, service accounts, user accounts, or IP addresses provided. The rule is COMPLIANT if a bucket policy is not present.3
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Storage
8.2.8.23Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.2
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Storage
8.2.8.24Checks if the Google Cloud Security Team can access your GCP project. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for Security Team access is not configured.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Google Cloud Armor
8.3.2: Strong authentication for users and administrators is established and managed.5436
8.3.2.1Checks if HTTP to HTTPS redirection is configured on all HTTP(S) Load Balancers in Google Cloud Platform. The rule is NON_COMPLIANT if one or more HTTP(S) Load Balancer configurations do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP(S) Load Balancer configurations forward traffic to an HTTP listener instead of redirecting to HTTPS.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud HTTP(S) Load Balancing
8.3.2.2Checks if all methods in Google Cloud API Gateway APIs have cache enabled and cache encrypted. The rule is NON_COMPLIANT if any method in a Google Cloud API Gateway API is not configured to cache or the cache is not encrypted.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud API Gateway
8.3.2.3Checks if a Google BigQuery dataset is encrypted at rest. The rule is NON_COMPLIANT if encryption of data at rest is not enabled for a BigQuery dataset.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
BigQuery
8.3.2.4Checks if a Cloud Storage backup snapshot is encrypted. The rule is NON_COMPLIANT if the snapshot is not encrypted.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Cloud Storage
8.3.2.5Checks if Google Cloud CDN distributions are using deprecated SSL protocols for HTTPS communication between CDN edge locations and custom origins. This rule is NON_COMPLIANT for a Google Cloud CDN distribution if any 'OriginSslProtocols' includes 'SSLv3'.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud CDN
8.3.2.6Checks if Google Cloud CDN is encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'OriginProtocol' is 'HTTP' or if 'OriginProtocol' is 'MATCH_VIEWER' and 'ViewerProtocol' is 'ALLOW_ALL'.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud CDN
8.3.2.7Checks if your Google Cloud CDN configurations use HTTPS. The rule is NON_COMPLIANT if the value of 'https' is not enforced for the backend services serving content.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud CDN
8.3.2.8Checks if Google Cloud Logging (Stackdriver Logging) log sinks are encrypted with a specified Google Cloud KMS key or any KMS key. The rule is NON_COMPLIANT if a log sink is not encrypted with a KMS key or is encrypted with a KMS key that is not supplied in the rule parameter.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Logging
8.3.2.9Checks if Google Cloud Audit Logs is configured to use Cloud KMS for encryption. The rule is COMPLIANT if the KmsKeyId for the service account is defined.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Audit Logs
8.3.2.10Checks if a Google Cloud Build configuration has encryption enabled for all of its artifacts. The rule is NON_COMPLIANT if 'encryptionDisabled' is set to 'true' for any artifact configurations in the build triggers.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Build
8.3.2.11Checks if the project contains environment variables GOOGLE_CLOUD_ACCESS_KEY_ID and GOOGLE_CLOUD_SECRET_ACCESS_KEY. The rule is NON_COMPLIANT when the project environment variables contain plaintext credentials.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Platform (GCP)
8.3.2.12Checks if a Google Cloud Build (GCB) project configured with Google Cloud Storage (GCS) logs has encryption enabled for its logs. The rule is NON_COMPLIANT if 'encryptionDisabled' is set to 'true' in the GCS logs configuration of a Cloud Build project.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Build
8.3.2.13Checks if Google Cloud Datastore instances are encrypted. The rule is NON_COMPLIANT if a Datastore instance is not encrypted.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Datastore
8.3.2.14Checks if your Google Cloud Firestore database has network encryption enabled. The rule is NON_COMPLIANT if a Firestore database is not encrypted by transport layer security (TLS).0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Firestore
8.3.2.15Checks if Google Cloud Database Migration Service (GCP DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Google Cloud DMS does not have an SSL connection configured.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Database Migration Service
8.3.2.16Checks if Google Cloud Database Migration Service (GCDMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Database Migration Service
8.3.2.17Checks if storage encryption is enabled for Google Cloud Firestore. The rule is NON_COMPLIANT if storage encryption is not enabled.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Firestore
8.3.2.18Checks if Google Cloud Firestore is encrypted with Google Cloud Key Management Service (KMS). The rule is NON_COMPLIANT if the Google Cloud Firestore database is not encrypted with Google Cloud KMS. The rule is also NON_COMPLIANT if the specified Google Cloud KMS key is not present in the kmsKeyArns input parameter.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Firestore
8.3.2.19Checks if the Google Cloud Firestore databases are encrypted and checks their status. The rule is COMPLIANT if the status is enabled or enabling.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Firestore
8.3.2.20Checks if Google Cloud Persistent Disk encryption is enabled by default. The rule is NON_COMPLIANT if the encryption is not enabled.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Compute Engine
8.3.2.21Checks if secrets are passed as environment variables in Google Cloud Run or Google Kubernetes Engine (GKE). The rule is NON_COMPLIANT if 1 or more environment variable key matches a key listed in the 'secretKeys' parameter, excluding variables from other sources like Google Cloud Storage.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Run / Google Kubernetes Engine
8.3.2.22Checks if Google Cloud Filestore is configured to encrypt the file data using Google Cloud Key Management Service (Google Cloud KMS). The rule is NON_COMPLIANT if the 'encryptionKey' parameter in the Filestore instance configuration does not match the specified KMS key.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Filestore
8.3.2.23Checks if Google Kubernetes Engine (GKE) clusters are configured to have Kubernetes secrets encrypted using Google Cloud KMS. The rule is NON_COMPLIANT if a GKE cluster does not have an encryption configuration for secrets or if the encryption configuration does not specify secrets as a resource.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Kubernetes Engine (GKE)
8.3.2.24Checks if Google Kubernetes Engine (GKE) clusters are configured to have Kubernetes secrets encrypted using Google Cloud Key Management Service (KMS) keys.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Kubernetes Engine (GKE)
8.3.2.25Checks if Google Cloud Memorystore for Redis instances have encryption-at-rest enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'redisConfig.enableAuth' is disabled or if the 'redisConfig.kmsKeyName' does not match the approvedKmsKeyArns parameter.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Memorystore
8.3.2.26Checks if Google Cloud Memorystore for Redis instances have encryption-in-transit enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'transitEncryptionMode' is set to 'DISABLED'.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Memorystore for Redis
8.3.2.27Checks if Google Cloud Search instances have encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption settings are not properly configured.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Search
8.3.2.28Check if Google Cloud Elasticsearch (part of Google Cloud's managed services) has node-to-node encryption enabled. The rule should be NON_COMPLIANT if node-to-node encryption is not enabled for the Elasticsearch deployment.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Elasticsearch
8.3.2.29Checks if the TCP/UDP Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure the Load Balancer is set up for SSL or HTTPS traffic. This rule is only applicable to TCP/UDP Load Balancers. This rule does not check Application Load Balancers.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Load Balancing
8.3.2.30Checks whether your Cloud Load Balancer SSL policies are configured with a custom policy. The rule is only applicable if there are SSL listeners for the Cloud Load Balancer.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Load Balancing
8.3.2.31Checks if your Google Cloud Platform Load Balancer SSL policies use a predefined policy. The rule is NON_COMPLIANT if the Google Cloud Load Balancer HTTPS/SSL listener's policy does not equal the value of the parameter 'predefinedPolicyName'.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Load Balancing
8.3.2.32Checks if your Google Cloud Load Balancer is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured with SSL or HTTPS.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Load Balancing
8.3.2.33Checks if Google Cloud Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or the security configuration does not satisfy the specified rule parameters.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Dataproc
8.3.2.34Checks if attached Google Persistent Disks are encrypted and optionally are encrypted with a specified Customer Managed Encryption Key (CMEK). The rule is NON_COMPLIANT if attached Persistent Disks are unencrypted or are encrypted with a CMEK not in the supplied parameters.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Storage and Compute Engine
8.3.2.35Checks if Google Cloud Pub/Sub topics are encrypted at rest with Google-managed encryption. The rule is NON_COMPLIANT for a Pub/Sub topic if 'Encryption' is not configured.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Pub/Sub
8.3.2.36Checks if a Google Cloud Pub/Sub topic enforces encryption in transit using HTTPS (TLS) when communicating with subscribers. The rule is NON_COMPLIANT if plain text communication is enabled for connections to the topic.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Pub/Sub
8.3.2.37Checks if storage encryption is enabled for your Google Cloud Spanner instances. The rule is NON_COMPLIANT if storage encryption is not enabled.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Spanner
8.3.2.38Checks if a Cloud SQL instance in GCP has backups encrypted. The rule is NON_COMPLIANT if a Cloud SQL instance does not have backups encrypted.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Cloud SQL
8.3.2.39Checks if Google Cloud OpenSearch domains have encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption at rest options are not enabled.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud OpenSearch
8.3.2.40Checks whether connections to Google Cloud Search domains are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Search domain 'EnforceHTTPS' is not 'true' or is 'true' and 'TLSecurityPolicy' is not in 'securityPolicies'.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Search
8.3.2.41Check if Google Cloud Search nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the search service.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Search
8.3.2.42Checks if a Google Cloud SQL instance is encrypted at rest. The rule is NON_COMPLIANT if a Google Cloud SQL instance is not encrypted at rest.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Cloud SQL
8.3.2.43Checks if Google Cloud SQL database snapshots are encrypted. The rule is NON_COMPLIANT if the Google Cloud SQL database snapshots are not encrypted.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud SQL
8.3.2.44Checks if storage encryption is enabled for your Google Cloud SQL instances. The rule is NON_COMPLIANT if storage encryption is not enabled.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud SQL
8.3.2.45Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or if a dataset does not have audit logging enabled.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google BigQuery
8.3.2.46Checks if Google BigQuery datasets are using a specified Google Cloud Key Management Service (Cloud KMS) key for encryption. The rule is COMPLIANT if encryption is enabled and the dataset is encrypted with the key provided. The rule is NON_COMPLIANT if the dataset is not encrypted or encrypted with another key.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google BigQuery
8.3.2.47Checks if Google BigQuery requires TLS/SSL encryption for connections. The rule is NON_COMPLIANT if any Google BigQuery service does not enforce TLS/SSL encryption for client connections.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google BigQuery
8.3.2.48Checks if your Google Cloud Storage bucket has default object encryption enabled or if the bucket's IAM policies explicitly deny write access without using encryption such as Google-managed encryption keys. The rule is NON_COMPLIANT if your Google Cloud Storage bucket is not encrypted by default.3
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Storage
8.3.2.49Checks if Google Cloud Storage (GCS) buckets have policies that require requests to use SSL/TLS. The rule is NON_COMPLIANT if any GCS bucket has policies allowing HTTP requests.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Storage
8.3.2.50Checks if the Google Cloud Storage buckets are encrypted with Google Cloud KMS. The rule is NON_COMPLIANT if the Cloud Storage bucket is not encrypted with a Google Cloud KMS key.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Storage
8.3.2.51Checks if Google Cloud Key Management Service (GCP KMS) key is configured for a Google Cloud AI Platform endpoint configuration. The rule is NON_COMPLIANT if 'kmsKeyName' is not specified for the Google Cloud AI Platform endpoint configuration.2
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud AI Platform
8.3.2.52Checks if a Google Cloud Key Management Service (GCP KMS) key is configured for a Google AI Platform Notebook instance. The rule is NON_COMPLIANT if 'kmsKeyName' is not specified for the AI Platform Notebook instance.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google AI Platform Notebooks
8.3.2.53Checks if all secrets in Google Cloud Secret Manager are encrypted using Google-managed encryption keys or a customer-managed key created in Google Cloud Key Management Service (KMS). The rule is COMPLIANT if a secret is encrypted using a customer-managed key. This rule is NON_COMPLIANT if a secret is encrypted using Google-managed encryption keys.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.2.54Checks if Pub/Sub topics are encrypted with Google Cloud Key Management Service (Google Cloud KMS). The rule is NON_COMPLIANT if a Pub/Sub topic is not encrypted with Google Cloud KMS. Optionally, specify the key resource names, the key aliases, or the key IDs for the rule to check.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Pub/Sub
8.3.4: Strong authentication for users and administrators is established and managed.2226
8.3.4.1Checks if a GCP project is part of an Organization. The rule is NON_COMPLIANT if a GCP project is not attached to a GCP Organization or the Organization ID does not match rule parameter OrganizationId.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Cloud Resource Manager
8.3.4.2Checks if a Backup Vault in GCP has an attached IAM policy which prevents deletion of recovery points. The rule is NON_COMPLIANT if the Backup Vault does not have IAM policies or has policies without a suitable 'Deny' statement (statement with the permissions backup.deleteRecoveryPoint, backup.updateRecoveryPointLifecycle, and backup.putBackupVaultAccessPolicy).0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Cloud Backup
8.3.4.3Checks if a Google Compute Engine (GCE) instance has a Google Cloud Identity and Access Management (IAM) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.4Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the Pod security context is set to 'false'.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Kubernetes Engine
8.3.4.5Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.6Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.3
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.7Checks if IAM policies are not inline policies. The rule is NON_COMPLIANT if a Google Cloud IAM user, IAM role, or IAM group has any inline policy associated with it.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.8Checks in each Google Cloud Identity and Access Management (IAM) resource if a policy resource name (policy ARN equivalent) specified in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy resource name is attached to the IAM resource.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.9Checks whether the IAM policy is attached to a Google Cloud IAM user, a group with one or more IAM users, or a service account (role) with one or more trusted identities.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.10Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer-managed IAM policy statement includes 'role': 'roles/owner' or grants 'allUser' permissions over 'allResources'.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.11Checks if Google Cloud IAM roles that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer managed IAM role allows full access to at least 1 Google Cloud service.3
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.12Checks if all specified IAM policies are attached to the Google Cloud IAM Service Account. The rule is NON_COMPLIANT if a policy is not attached to the Service Account.2
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.13Checks if none of your Google Cloud IAM users have policies directly attached. IAM users must inherit permissions from IAM groups or roles. The rule is NON_COMPLIANT if there is at least one policy attached to the IAM user.2
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.4.14Checks if a Google Cloud Spanner instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud Spanner instance does not have IAM database authentication enabled.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Spanner
8.3.4.15Checks if Google Cloud's Elasticsearch Service (managed by Elastic) domains have fine-grained access control enabled. The rule is NON_COMPLIANT if fine-grained access control is not enabled for the Elasticsearch domain.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Elasticsearch Service
8.3.4.16Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud SQL
8.3.4.17Checks if a Google Cloud SQL instance has Google Cloud Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud SQL
8.3.4.18Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.3
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Storage
8.3.4.19Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket policy does not allow another Google Cloud project to perform any storage.objects.get and storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.3
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Storage
8.3.4.20Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, IAM roles, service accounts, IP addresses, or VPNs that you provide. The rule is COMPLIANT if a bucket policy is not present.3
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Storage
8.3.4.21Verifies that your Google Cloud Storage bucket policies do not permit inter-project permissions beyond the specified control Cloud Storage bucket policy.2
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Storage
8.3.4.22Checks if the Google Cloud Security Operations team can access your Google Cloud account. The rule is NON_COMPLIANT if Cloud Armor is enabled but the role for Security Operations team access is not configured.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Cloud Armor
8.3.5: Strong authentication for users and administrators is established and managed.43
8.3.5.1Checks if active IAM service account keys are rotated (changed) within the number of days specified in keyRotationPeriod. The rule is NON_COMPLIANT if service account keys are not rotated within the specified time period. The default value is 90 days.3
Attributes
- Section
8.3.5: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.5.2Checks if Google Cloud Secret Manager secret has rotation enabled and verifies the rotation frequency against the maximum allowed frequency specified. The rule is NON_COMPLIANT if the secret is not scheduled for rotation or if the rotation frequency exceeds the given maximum allowed frequency.0
Attributes
- Section
8.3.5: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.5.3Checks if Google Cloud Secret Manager secrets are rotated successfully according to the rotation schedule. Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.0
Attributes
- Section
8.3.5: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.5.4Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.0
Attributes
- Section
8.3.5: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.6: Strong authentication for users and administrators is established and managed.10
8.3.6.1Checks if the account password policy for Google Cloud Identity users meets the specified requirements indicated in the parameters. The rule is NON_COMPLIANT if the account password policy does not meet the specified requirements.0
Attributes
- Section
8.3.6: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Identity
8.3.7: Strong authentication for users and administrators is established and managed.42
8.3.7.1Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge (default 90 days). The rule is NON_COMPLIANT if access keys are not rotated within the specified time period.2
Attributes
- Section
8.3.7: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.7.2Checks if Google Cloud Secret Manager secret has rotation enabled. The rule also checks an optional maxAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation or if the rotation frequency exceeds the specified maxAllowedRotationFrequency.0
Attributes
- Section
8.3.7: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.7.3Checks if Google Cloud Secret Manager secrets rotated successfully according to the rotation schedule. Google Cloud Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.0
Attributes
- Section
8.3.7: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.7.4Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.0
Attributes
- Section
8.3.7: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.9: Strong authentication for users and administrators is established and managed.42
8.3.9.1Checks if active IAM service account keys are rotated (changed) within the number of days specified in maxKeyAge. The rule is NON_COMPLIANT if service account keys are not rotated within the specified time period. The default value is 90 days.2
Attributes
- Section
8.3.9: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.9.2Checks if Google Cloud Secret Manager secret has rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the specified maximumAllowedRotationFrequency parameter.0
Attributes
- Section
8.3.9: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.9.3Checks if GCP Secret Manager secrets are rotated successfully according to the rotation schedule. Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.0
Attributes
- Section
8.3.9: Strong authentication for users and administrators is established and managed.
- Service
GCP Secret Manager
8.3.9.4Checks if Google Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.0
Attributes
- Section
8.3.9: Strong authentication for users and administrators is established and managed.
- Service
Google Secret Manager
8.3.10.1: Strong authentication for users and administrators is established and managed.42
8.3.10.1.1Checks if active IAM service account keys are rotated within the number of days specified in maxAccessKeyAge. The rule is NON_COMPLIANT if service account keys are not rotated within the specified time period. The default value is 90 days.2
Attributes
- Section
8.3.10.1: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.10.1.2Checks if Google Cloud Secret Manager secret has rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret does not have a scheduled rotation. The rule is also NON_COMPLIANT if the rotation frequency exceeds the maximumAllowedRotationFrequency parameter.0
Attributes
- Section
8.3.10.1: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.10.1.3Checks if Google Cloud Secret Manager secrets rotated successfully according to the rotation schedule. Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.0
Attributes
- Section
8.3.10.1: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.10.1.4Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.0
Attributes
- Section
8.3.10.1: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud Secret Manager
8.3.11: Strong authentication for users and administrators is established and managed.50
8.3.11.1Checks if running Google Compute Engine (GCE) instances are launched using Google Cloud key pairs. The rule is NON_COMPLIANT if a running GCE instance is launched with a key pair.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Google Compute Engine
8.3.11.2Checks whether IAM groups in Google Cloud Platform have at least one IAM user associated with them.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Identity and Access Management (IAM)
8.3.11.3Checks whether the IAM policy is attached to a Google Cloud IAM user, a group of IAM users, or a service account with one or more trusted entities.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.11.4Checks if the root user access key is available. The rule is COMPLIANT if the user access key does not exist. Otherwise, NON_COMPLIANT.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Google Cloud IAM
8.3.11.5Checks whether IAM users are members of at least one IAM group in Google Cloud Platform (GCP). This can be achieved using Cloud IAM to manage roles and permissions associated with groups and users.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Cloud IAM
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.50
8.4.1.1Checks if the Google Cloud Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one IAM user.0
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Google Cloud Identity and Access Management (IAM)
8.4.1.2Checks if Google Cloud multi-factor authentication (MFA) is enabled for all Google Cloud Identity and Access Management (IAM) users that use a console password. The rule is COMPLIANT if MFA is enabled.0
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Google Cloud IAM
8.4.1.3Checks if your GCP account is enabled to use multi-factor authentication (MFA) for signing in with the root service account. The rule is NON_COMPLIANT if any virtual MFA devices are allowed for root service account sign-ins.0
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Identity and Access Management (IAM)
8.4.1.4Verifies if the Google Cloud Platform (GCP) service account used has multi-factor authentication (MFA) enabled for enhanced security. The evaluation returns NON_COMPLIANT if the service account does not have MFA set up.0
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Identity and Access Management (IAM)
8.4.1.5Checks if Object Versioning is enabled in Google Cloud Storage buckets. The rule is NON_COMPLIANT if Object Versioning is not enabled.0
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Google Cloud Storage
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.50
8.4.2.1Checks if the Google Cloud Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one IAM user.0
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Google Cloud IAM
8.4.2.2Checks if Google Cloud Platform (GCP) multi-factor authentication (MFA) is enabled for all Google Identity users that use a console password. The rule is COMPLIANT if MFA is enabled.0
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Identity and Access Management (IAM)
8.4.2.3Checks if your GCP account is enabled to use multi-factor authentication (MFA) for Google Cloud Platform accounts. The rule is NON_COMPLIANT if any accounts can sign in without a valid MFA setup.0
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Identity and Access Management (IAM)
8.4.2.4Checks if the root user of your GCP account requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the Google Cloud Platform (GCP) root account user does not have multi-factor authentication (MFA) enabled.0
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Identity and Access Management (IAM)
8.4.2.5Checks if Object Versioning is enabled in Google Cloud Storage (GCS) buckets. The rule is NON_COMPLIANT if Object Versioning is not enabled.0
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Google Cloud Storage
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.50
8.4.3.1Checks if Google Cloud IAM users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one IAM user.0
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Google Cloud IAM
8.4.3.2Checks if Google Cloud Platform (GCP) multi-factor authentication (MFA) is enabled for all Google Cloud Identity users. The rule is COMPLIANT if MFA is enabled.0
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Google Cloud Identity
8.4.3.3Checks if your Google Cloud Platform (GCP) account is enabled to use multi-factor authentication (MFA) for the root user. The rule is NON_COMPLIANT if any virtual MFA devices are allowed for signing in with the administrator account.0
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Identity and Access Management (IAM)
8.4.3.4Checks if the root user of your GCP account requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the Google Cloud Identity root account user does not have multi-factor authentication (MFA) enabled.0
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Google Cloud Identity
8.4.3.5Checks if Object Versioning is enabled on Google Cloud Storage (GCS) buckets and requires additional security measures for delete operations. The rule is NON_COMPLIANT if Object Versioning is not enabled.0
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Google Cloud Storage
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.52
8.6.3.1Checks if active IAM service account keys are rotated (changed) within the number of days specified in maxAccessKeyAge. The rule is NON_COMPLIANT if service account keys are not rotated within the specified time period. The default value is 90 days.2
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Google Cloud IAM
8.6.3.2Verifies if the organization’s Google Cloud Identity password policy adheres to specified requirements for users. The rule is NON_COMPLIANT if the password policy does not comply with these requirements.0
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Google Cloud Identity
8.6.3.3Checks if Google Cloud Secret Manager secret has rotation enabled. The rule also checks an optional maxRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the specified maxRotationFrequency parameter.0
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Google Cloud Secret Manager
8.6.3.4Checks if Google Cloud Secret Manager secrets are rotated successfully according to the rotation schedule. Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.0
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Google Cloud Secret Manager
8.6.3.5Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.0
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Google Cloud Secret Manager
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.3145
10.2.1.1Checks if Google Cloud API Gateway has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' is not present in API configuration.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud API Gateway
10.2.1.2Checks if all methods in Google Cloud Endpoints or Apigee API Gateway have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if log level is neither ERROR nor INFO.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints / Apigee API Gateway
10.2.1.3Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Google Cloud Trace is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.4Checks if a Google Cloud Platform (GCP) API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or 'logLevel' is neither ERROR nor ALL.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud API Gateway
10.2.1.5Checks if Google Cloud HTTP(S) Load Balancers are configured with a user defined Desync mitigation mode. The rule is NON_COMPLIANT if the HTTP(S) Load Balancer Desync mitigation mode does not match with user defined Desync mitigation mode.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.6Checks if Google Cloud CDN has logging configured to send access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.2
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud CDN
10.2.1.7Checks if at least one Google Cloud Audit Log is logging Cloud Storage data access events for all Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs that record Cloud Storage data access events.4
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.8In Google Cloud Platform (GCP), the equivalent of AWS CloudTrail is Cloud Audit Logs, which track all actions in Google Cloud services. The rule identifier might be different, but it serves a similar purpose of monitoring and logging account activity.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Audit Logs
10.2.1.9Checks if a Google Cloud Build trigger has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Build
10.2.1.10Checks if logging is enabled with a valid severity level for Google Cloud SQL database audit logs. The rule is NON_COMPLIANT if logging is not enabled or database logging has a severity level that is not valid.4
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.11Checks if a Google Cloud Firestore or Google Cloud Datastore instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Firestore or Datastore instance does not have logging enabled for audit logs.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firestore / Google Cloud Datastore
10.2.1.12Checks if Google Cloud VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'logging.enabled' is set to false.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPN
10.2.1.13Checks if logging is configured for active Google Kubernetes Engine (GKE) Pod specifications. This rule is NON_COMPLIANT if an active GKE Pod does not have the logging configuration defined or if the logging configuration is null in at least one container definition.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.14Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.15Checks if Google Cloud Platform App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'serviceAccountManaged' is false.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Logging
10.2.1.16Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if 1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.17Checks if Google Cloud Pub/Sub topics have Cloud Audit Logs enabled. The rule is NON_COMPLIANT if a topic does not have audit logging enabled.2
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.18Checks if a Google Cloud Pub/Sub service has audit logging enabled. The rule is NON_COMPLIANT if the service does not have audit logging enabled.2
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.19This rule checks whether Cloud Trail is enabled in multiple regions within GCP. The equivalent service in GCP is Cloud Audit Logs, which provides a similar audit trail capability across multiple regions.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Audit Logs
10.2.1.20Checks if a Google Cloud Spanner instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have logging enabled for audit logs.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Spanner
10.2.1.21Checks if GCP VPC Service Controls have logging enabled. The rule is NON_COMPLIANT if the logging configuration for the service perimeter is not set. You can specify which logging type you want the rule to check.4
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC Service Controls
10.2.1.22Checks if Google Cloud SQL for MySQL instances are configured to export logs to Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log export configured.4
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.23Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.4
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.24Checks if Google BigQuery is configured to log audit logs to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
BigQuery
10.2.1.25Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the dataset is not encrypted at rest or if it does not have audit logging enabled.2
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.26Checks if DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud DNS
10.2.1.27Checks if logging is enabled for your Google Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.3
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.28Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Workflows
10.2.1.29Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.3
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.1.30Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the expected configuration.2
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.31Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.3750
10.2.1.1.1Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' is not present in the API configuration.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.1.2Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logging level is neither ERROR nor INFO.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.1.3Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Trace
10.2.1.1.4Checks if a Google Cloud Platform (GCP) Cloud Run service has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or 'log level' is neither ERROR nor ALL.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Run
10.2.1.1.5Checks if Google Cloud Load Balancers (GCLB) are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if GCLB Desync mitigation mode does not match with user-defined Desync mitigation mode.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.1.6Checks if Google Cloud CDN (Content Delivery Network) is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging configured.2
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud CDN
10.2.1.1.7Checks if at least one Google Cloud Audit Log is logging Google Cloud Storage (GCS) data access events for all GCS buckets. The rule is NON_COMPLIANT if there are no logs recording GCS data access events.4
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.1.8Verifies if Google Cloud Monitoring alerts have an action configured for ACTIVE, INACTIVE, or NO_DATA states. Optionally checks if any actions correspond to a specific notification channel. The rule is considered NON_COMPLIANT if there is no action specified for the alert or optional parameter.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Monitoring
10.2.1.1.9Checks if a resource type has a Google Cloud Monitoring alert policy for the named metric. For resource types, you can specify Compute Engine instances, Cloud Storage buckets, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the named metric has a resource ID and an alert policy in Google Cloud Monitoring.3
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Monitoring
10.2.1.1.10In GCP, the equivalence for ensuring logging is enabled is the 'Cloud Audit Logs' which serves a similar purpose as AWS CloudTrail. The rule can be compared to checking if 'Audit Logging' is enabled for the relevant services to track activity.3
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Logging
10.2.1.1.11Checks if a Google Cloud Build configuration has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Build
10.2.1.1.12Checks if logging is enabled with a valid severity level for Cloud SQL database events in Google Cloud. The rule is NON_COMPLIANT if logging is not enabled or if the logging severity level for Cloud SQL events is not valid.4
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.1.13Checks if a Google Cloud Firestore database has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore database does not have Stackdriver logging enabled for audit logs.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firestore
10.2.1.1.14Checks if Google Cloud VPN has logging enabled for connections. The rule is NON_COMPLIANT if 'loggingEnabled' is set to false.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPN
10.2.1.1.15Checks if Stackdriver Monitoring is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if Stackdriver Monitoring is not enabled.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Compute Engine
10.2.1.1.16Checks if logging is configured for active Cloud Run services. This rule is NON_COMPLIANT if an active Cloud Run service does not have logging enabled or the logging configuration is missing in at least one revision.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Run
10.2.1.1.17Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine
10.2.1.1.18Checks if Google Cloud App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud App Engine
10.2.1.1.19Checks if the Google Cloud Load Balancing has logging enabled. The rule is NON_COMPLIANT if the logging is not enabled or if the log bucket is not set to the specified Cloud Storage bucket name.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.1.20Checks if Google Cloud Pub/Sub subscriptions have audit logging enabled. The rule is NON_COMPLIANT if a subscription does not have audit logging enabled.2
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.1.21Checks if a Google Cloud Pub/Sub service has Stackdriver logging enabled. The rule is NON_COMPLIANT if the service does not have logging enabled.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.1.22In Google Cloud Platform (GCP), the equivalent service to AWS CloudTrail for logging and monitoring API calls is Google Cloud Audit Logs. This service provides details of actions taken by users in your GCP project across multiple regions.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Audit Logs
10.2.1.1.23Checks if a Google Cloud SQL instance has audit logging enabled for its database operations. The rule is NON_COMPLIANT if a Cloud SQL instance does not have audit logging enabled.4
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.1.24Checks if Google Cloud Firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the firewall rules. You can specify which logging type you want the rule to check.2
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firewall
10.2.1.1.25Checks if Google Cloud SQL MySQL instances are configured to enable logging for Audit logs. The rule is NON_COMPLIANT if Cloud SQL MySQL instances do not have audit log publishing configured.3
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.1.26Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types (such as general, slow query, or error logs) are not enabled.4
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.1.27Checks if Google BigQuery audit logs are being exported to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.1.28Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if the dataset does not have audit logging enabled.2
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.1.29Checks if DNS query logging is enabled for your Google Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS managed zones.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud DNS
10.2.1.1.30Checks if logging is enabled for your Google Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.3
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.1.31Checks if Google Cloud Security Command Center (SCC) is enabled for a Google Cloud Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Security Command Center
10.2.1.1.32Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic for the subscriptions. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.1.33Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Workflows
10.2.1.1.34Checks if Google Cloud VPC flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.3
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.1.1.35Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the expected value.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.1.36Checks if Google Cloud Monitoring logging for Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'loggingEnabled' field is set to false.3
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.1.37Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.3144
10.2.1.2.1Checks if Google Cloud Endpoints have access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' configuration is not present in the Endpoints settings.2
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.2.2Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logLevel is neither ERROR nor INFO.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.2.3Checks if Google Cloud Trace (formerly known as Stackdriver Trace) tracing is enabled on Google Cloud API Gateway services. The rule is COMPLIANT if Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud API Gateway
10.2.1.2.4Checks if a Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled or 'logLevel' is set to neither ERROR nor ALL.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud API Gateway
10.2.1.2.5Checks if Google Cloud Load Balancers are configured with a user-defined session affinity setting. The rule is NON_COMPLIANT if the session affinity setting does not match the user-defined value.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.2.6Checks if Google Cloud CDN (Content Delivery Network) is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.2
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud CDN
10.2.1.2.7Checks if at least one Google Cloud Audit Log is logging Cloud Storage data events for all buckets. The rule is NON_COMPLIANT if there are no logs recording Cloud Storage data events.4
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Logging
10.2.1.2.8GCP's equivalent rule is to ensure that Cloud Audit Logs are enabled for tracking API calls and other activities on resources, similar to AWS CloudTrail.4
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Logging
10.2.1.2.9Checks if a Google Cloud Build trigger has at least one logging option enabled. The rule is NON_COMPLIANT if all logging options are set to 'DISABLED'.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Build
10.2.1.2.10Checks if logging is enabled with a valid severity level for Google Cloud Database Migration Service (Cloud DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Database Migration Service
10.2.1.2.11Checks if a Google Cloud Firestore (with MongoDB compatibility) instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have logging enabled for audit logs.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firestore
10.2.1.2.12Checks if Google Cloud VPN has logging enabled. The rule is NON_COMPLIANT if 'logging' is set to false.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPN
10.2.1.2.13Checks if logging configuration is set on active GKE Pod specifications. This rule is NON_COMPLIANT if an active GKE Pod does not have a logging configuration defined or the logging configuration is null in at least one container defined in the Pod spec.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.2.14Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.2.15Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google App Engine
10.2.1.2.16Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging settings are not enabled or the log bucket is not equal to the specified Cloud Storage bucket name.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.2.17Checks if Google Cloud Pub/Sub has audit logging enabled. The rule is NON_COMPLIANT if a Pub/Sub topic does not have audit logging enabled.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.2.18Checks if a Google Cloud Pub/Sub topic has logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.2.19Google Cloud Platform equivalent service for AWS CloudTrail is Google Cloud Audit Logs, which provides similar logging of activities in the cloud environment. The corresponding rule in GCP would ensure that audit logs are enabled in multiple regions.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Audit Logs
10.2.1.2.20Checks if a Google Cloud SQL instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.4
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.2.21Checks if Google Cloud Platform VPC Service Controls have logging enabled. The rule is NON_COMPLIANT if a logging type (such as 'Data Access' logs) is not configured. You can specify which logging type you want the rule to check.4
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC Service Controls
10.2.1.2.22Checks if Google Cloud SQL instances for MySQL are configured to export logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log export configured.4
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.2.23Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.4
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.2.24Checks if Google BigQuery datasets are logging audits to a specific location in Google Cloud Storage. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.2
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
BigQuery
10.2.1.2.25Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if audit logging is not enabled for the dataset.2
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
BigQuery
10.2.1.2.26Checks if DNS query logging is enabled for your Google Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS managed zones.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud DNS
10.2.1.2.27Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.2
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Storage
10.2.1.2.28Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Workflows
10.2.1.2.29Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.3
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.1.2.30Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.2.31Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy, if it does not have logging enabled.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.3137
10.2.1.3.1Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLog' settings are not present in the OpenAPI configuration for the API.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.3.2Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logLevel is neither ERROR nor INFO.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.3.3Checks if Google Cloud Trace is enabled for Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.3.4Checks if a Google Cloud Firestore or Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is not set to ERROR or ALL.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Logging / Google Cloud API Gateway
10.2.1.3.5Checks if Google Cloud Load Balancers are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if the Load Balancer Desync mitigation mode does not match the user-defined Desync mitigation mode.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.3.6Checks if Google Cloud CDN is configured to log requests to Google Cloud Storage. The rule is NON_COMPLIANT if a Cloud CDN resource does not have logging enabled.2
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud CDN
10.2.1.3.7Checks if at least one Google Cloud Audit Log is logging data events for all Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs recording data events.4
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.3.8The equivalence in GCP for the AWS rule 'CLOUD_TRAIL_ENABLED' is 'Cloud Audit Logs' which ensures that logging is enabled for tracking actions in the GCP environment.3
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Logging
10.2.1.3.9Checks if a Google Cloud Build trigger has log streaming enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Build
10.2.1.3.10Checks if logging is enabled with a valid severity level for Google Cloud Database Migration Service replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Database Migration Service
10.2.1.3.11Checks if a Google Cloud Firestore or Google Cloud Datastore instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Firestore or Datastore instance does not have Stackdriver logging enabled for audit logs.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firestore / Google Cloud Datastore
10.2.1.3.12Checks if Google Cloud IAP (Identity-Aware Proxy) has client connection logging enabled. The rule is NON_COMPLIANT if 'IapSettings.clientConnectionLogEnabled' is set to false.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Identity-Aware Proxy
10.2.1.3.13Checks if logging is enabled on active Google Kubernetes Engine (GKE) workloads. This rule is NON_COMPLIANT if an active GKE workload does not have logging enabled through the Stackdriver Logging or if the logging configuration is null in at least one container definition.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.3.14Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.3.15Checks if Google Cloud Platform App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud App Engine
10.2.1.3.16Checks if the Cloud Load Balancing has logging enabled. The rule is NON_COMPLIANT if the logBucket is not set or the logBucket does not match the required bucket name.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Load Balancing
10.2.1.3.17Checks if Google Cloud Pub/Sub has Cloud Audit Logs enabled. The rule is NON_COMPLIANT if a Pub/Sub topic does not have audit logging enabled.2
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.3.18Checks if a Google Cloud Pub/Sub topic has Cloud Logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.3.19In Google Cloud Platform (GCP), the equivalent service to AWS CloudTrail for logging and monitoring API activity is Google Cloud Audit Logs. To ensure comprehensive auditing, it is essential to enable Audit Logs that span multiple regions.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Audit Logs
10.2.1.3.20Checks if a Google Cloud Spanner instance has Stackdriver Logging export enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have Stackdriver Logging export enabled for audit logs.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Spanner
10.2.1.3.21Checks if Google Cloud Platform (GCP) VPC (Virtual Private Cloud) firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the specified firewall rules.4
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
VPC Firewall Rules
10.2.1.3.22Checks if Cloud SQL for MySQL instances are configured to enable 'Cloud SQL Insights' for monitoring and logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have Cloud SQL Insights enabled.4
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.3.23Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.4
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.3.24Checks if Google BigQuery audit logs are being exported to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.3.25Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or if a dataset does not have audit logging enabled.2
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.3.26Checks if Cloud DNS query logging is enabled for your Google Cloud Platform public hosted zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud Platform public hosted zones.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud DNS
10.2.1.3.27Checks if logging is enabled for your Cloud Storage buckets (equivalent to S3). The rule is NON_COMPLIANT if logging is not enabled.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Storage
10.2.1.3.28Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Workflows
10.2.1.3.29Checks if Google Cloud Virtual Private Cloud (VPC) flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.3
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.1.3.30Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the expected value.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.3.31Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy, if it does not have logging enabled.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.3142
10.2.1.4.1Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' are not configured in the service's endpoint configuration.2
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.4.2Checks if all methods in Google Cloud Endpoints configurations have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logging level is neither ERROR nor INFO.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.4.3Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Trace
10.2.1.4.4Checks if a Google Cloud Endpoints API has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or 'logLevel' is neither ERROR nor ALL.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.4.5Checks if Google Cloud Load Balancers (GCLB) are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if GCLB Desync mitigation mode does not match with the user-defined Desync mitigation mode.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.4.6Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.2
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud CDN
10.2.1.4.7Checks if at least one Google Cloud Audit Log (Cloud Logging) trail is logging Google Cloud Storage (GCS) data events for all GCS buckets. The rule is NON_COMPLIANT if there are no trails recording GCS data events.3
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage (GCS)
10.2.1.4.8Google Cloud Platform (GCP) equivalent of enabling audit logs is through enabling Cloud Audit Logs, which is analogous to enabling AWS CloudTrail. The rule identifier in GCP can differ from other identifiers but essentially serves the same function.2
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Audit Logs
10.2.1.4.9Checks if a Google Cloud Build trigger has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Build
10.2.1.4.10Checks if logging is enabled with a valid severity level for Google Cloud SQL replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.2
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.4.11Checks if a Google Cloud Firestore instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Stackdriver logging enabled for audit logs.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firestore
10.2.1.4.12Checks if Google Cloud VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'logConfig.enabled' is set to false.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPN
10.2.1.4.13Checks if logging configuration is set on active GKE Pod specifications. This rule is NON_COMPLIANT if an active GKE Pod does not have logging configured or if the logging configuration is null in at least one container definition.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.4.14Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.4.15Checks if Google Cloud Platform App Engine environments are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud App Engine
10.2.1.4.16Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the 'logging' is disabled or the 'logBucket' is not equal to the specified Cloud Storage bucket name.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.4.17Checks if Google Cloud Pub/Sub subscriptions have logging enabled. The rule is NON_COMPLIANT if a subscription does not have logging enabled.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.4.18Checks if a Google Cloud Pub/Sub topic has audit logging enabled. The rule is NON_COMPLIANT if the topic does not have audit logging enabled.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.4.19The rule MULTI_REGION_CLOUD_TRAIL_ENABLED in AWS corresponds to Google Cloud's equivalent service which ensures that logging is performed across multiple regions to have a more robust audit trail, similar to Cloud Audit Logs in Google Cloud Platform. This ensures that all operations are tracked across geographically distributed resources.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Audit Logs
10.2.1.4.20Checks if a Google Cloud SQL database instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.4
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.4.21Checks if Google Cloud Platform (GCP) VPC firewalls have logging enabled. The rule is NON_COMPLIANT if 'logConfig' is not set. You can specify which logging configurations you want the rule to check.4
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC Firewall
10.2.1.4.22Checks if Google Cloud SQL for MySQL instances are configured to export logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log export configured.4
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.4.23Checks if respective logs of Google Cloud SQL (GCP equivalent of Amazon RDS) are enabled. The rule is NON_COMPLIANT if any log types are not enabled.4
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.4.24Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
BigQuery
10.2.1.4.25Checks if Google BigQuery datasets have the specified security settings. The rule is NON_COMPLIANT if the dataset is not encrypted, or if it is not using the specified encryption key, or if audit logging is not enabled for the dataset.2
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.4.26Checks if DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud DNS
10.2.1.4.27Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.2
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Storage
10.2.1.4.28Checks if Google Cloud Workflows have logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Workflows
10.2.1.4.29Checks if Google Cloud VPC Flow Logs are found and enabled for all Google Cloud VPC networks. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.3
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.1.4.30Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the value of the parameter.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.4.31Checks if logging is enabled for Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.3141
10.2.1.5.1Checks if Google Cloud Endpoints have access logging enabled. The rule is NON_COMPLIANT if 'logs' configuration is not present in the Endpoints settings.2
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.5.2Checks if all methods in Google Cloud Endpoints or API Gateway have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is neither ERROR nor INFO.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints / Google Cloud API Gateway
10.2.1.5.3Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.5.4Checks if a Google Cloud API Gateway API has logging enabled. The rule is NON_COMPLIANT if logging is not enabled or if the log level is not set to 'ERROR' or 'ALL'.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud API Gateway
10.2.1.5.5Checks if Google Cloud HTTP(S) Load Balancers are configured with a user-defined desynchronization (Desync) mitigation mode. The rule is NON_COMPLIANT if the HTTP(S) Load Balancer Desync mitigation mode does not match the user-defined Desync mitigation mode.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.5.6Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN is not configured for logging.2
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud CDN
10.2.1.5.7Checks if at least one Google Cloud audit log is logging Google Cloud Storage (GCS) data events for all GCS buckets. The rule is NON_COMPLIANT if there are no audit logs recording GCS data events.4
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.5.8Google Cloud Platform equivalent for AWS CloudTrail is Google Cloud Audit Logs, which provides similar logging and auditing capabilities for tracking API requests and changes in your Google Cloud resources.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Audit Logs
10.2.1.5.9Checks if a Google Cloud Build trigger has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Build
10.2.1.5.10Checks if logging is enabled with a valid severity level for GCP Database Migration Service (DMS) replication task events of a target Cloud SQL database. The rule is NON_COMPLIANT if logging is not enabled or if the replication task logging of a target database has a severity level that is not valid.2
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Database Migration Service
10.2.1.5.11Checks if a Google Cloud Firestore instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have logging enabled for audit logs.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firestore
10.2.1.5.12Checks if Google Cloud VPN has connection logging enabled. The rule is NON_COMPLIANT if 'loggingEnabled' is set to false in the VPN configuration.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPN
10.2.1.5.13Checks if logging is configured for active Google Cloud Run services. This rule is NON_COMPLIANT if a Cloud Run service does not have the logging configuration set or if the logging configuration is null in at least one revision.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Run
10.2.1.5.14Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine
10.2.1.5.15Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the log routing settings do not include exporting to Cloud Logging.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google App Engine
10.2.1.5.16Checks if the Google Cloud Load Balancer has access logs enabled. The rule is NON_COMPLIANT if the 'logging.enabled' is false or 'logging.bucket' is not equal to the specified Cloud Storage bucket name.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.5.17Checks if Google Cloud Pub/Sub (GCP equivalent of Amazon MQ) has logging enabled. The rule is NON_COMPLIANT if a Pub/Sub topic does not have logging enabled.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.5.18Checks if a Google Cloud Pub/Sub service has Stackdriver logging enabled. The rule is NON_COMPLIANT if the Pub/Sub service does not have logging enabled.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.5.19The GCP equivalent for enabling a multi-region logging service to track and audit activities is by using Cloud Audit Logs in combination with Google Cloud Logging. This allows users to enable logging across multiple regions for better compliance and tracking of resources.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Audit Logs
10.2.1.5.20Checks if a Google Cloud SQL instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.4
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.5.21Checks if Google Cloud Platform (GCP) VPC Service Controls have logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.4
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
VPC Service Controls
10.2.1.5.22Checks if Google Cloud SQL for MySQL instances are configured to enable the Cloud SQL Insights feature for audit log data analysis. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log publishing configured.3
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.5.23Checks if the respective logs of Cloud SQL for PostgreSQL and MySQL are enabled in Google Cloud Platform (GCP). The rule is NON_COMPLIANT if any log types (such as general log, slow query log, error log) are not enabled.4
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.5.24Checks if Google BigQuery datasets have audit logging enabled and if the configured logging destination matches the specified location. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the logging destination does not match the provided criteria.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.5.25Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if the dataset does not have auditing enabled.2
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.5.26Checks if DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud DNS
10.2.1.5.27Checks if logging is enabled for your Google Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.3
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.5.28Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Workflows
10.2.1.5.29Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.3
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.1.5.30Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the specified value.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.5.31Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.3137
10.2.1.6.1Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' settings are not present in the Endpoints configuration.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.6.2Checks if all methods in Google Cloud API Gateway have logging enabled. The rule is NON_COMPLIANT if logging is not enabled or if logging level is neither ERROR nor INFO.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud API Gateway
10.2.1.6.3Checks if Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.6.4Checks if a Google Cloud Platform (GCP) Cloud Run service has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither ERROR nor ALL.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Run
10.2.1.6.5Checks if HTTPS load balancers in Google Cloud Platform (GCP) are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if the HTTPS load balancer's Desync mitigation mode does not match the user-defined Desync mitigation mode.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud HTTP(S) Load Balancing
10.2.1.6.6Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.2
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud CDN
10.2.1.6.7Checks if at least one Google Cloud Audit Log is configured to log data access events for all Google Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs recording data access events for Cloud Storage.4
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.6.8Google Cloud Logging must be enabled for operational logging similar to AWS CloudTrail.2
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Logging
10.2.1.6.9Checks if a Google Cloud Build project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Build
10.2.1.6.10Checks if logging is enabled with a valid severity level for Google Cloud Database Migration Service (DMS) migration jobs. The rule is NON_COMPLIANT if logging is not enabled or migration job logging has a severity level that is not valid.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Database Migration Service
10.2.1.6.11Checks if a Google Cloud Firestore instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Stackdriver logging enabled for audit logs.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firestore
10.2.1.6.12Checks if Google Cloud VPN has logging enabled for the tunnel. The rule is NON_COMPLIANT if 'tunnel.logging' is set to false.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPN
10.2.1.6.13Checks if logging is enabled in GCP Cloud Run services. This rule is NON_COMPLIANT if any active Cloud Run service does not have the logging configuration set or the logging setting is null.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Run
10.2.1.6.14Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.6.15Checks if Google Cloud App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the logging configuration is set to false.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud App Engine
10.2.1.6.16Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging is not enabled or if the log bucket is not equal to the specified GCS bucket.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.6.17Checks if Google Cloud Pub/Sub topics have logging enabled. The rule is NON_COMPLIANT if a topic does not have logging enabled.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.6.18Checks if a Google Cloud Pub/Sub topic has Logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.6.19In GCP, the equivalent service for AWS CloudTrail is Google Cloud Audit Logging, which provides similar functionality for logging and monitoring activities across your GCP projects. However, there is no direct equivalent to a multi-region setup in Google Cloud as it operates on a region-specific basis, but logs can be configured to be exported to different storage locations for centralized management.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Audit Logging
10.2.1.6.20Checks if a Google Cloud SQL (PostgreSQL or MySQL) instance has Stackdriver (now Cloud Operations) logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.4
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.6.21Checks if Google Cloud Platform (GCP) Virtual Private Cloud (VPC) firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the specified firewall rule.4
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.1.6.22Checks if Google Cloud SQL for MySQL instances are configured to enable audit logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit logging enabled.3
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.6.23Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.4
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.6.24Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.6.25Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or if it is encrypted with a different key, or if the dataset does not have access logging enabled.2
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.6.26Checks if DNS query logging is enabled for your Google Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS managed zones.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud DNS
10.2.1.6.27Checks if Cloud Storage bucket logging is enabled. The rule is NON_COMPLIANT if logging is not enabled.2
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.6.28Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Workflows
10.2.1.6.29Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.3
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.1.6.30Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the specified logging configuration.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.6.31Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.3140
10.2.1.7.1Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogSettings' is not present in the service configuration.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.7.2Checks if all methods in Google Cloud Endpoints configurations have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is neither ERROR nor INFO.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.1.7.3Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Trace
10.2.1.7.4Checks if a Google Cloud Platform (GCP) serverless API (e.g., Cloud Endpoints or API Gateway) has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or the log level is not set to ERROR or ALL.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Endpoints/API Gateway
10.2.1.7.5Checks if Google Cloud Load Balancers are configured with a user defined Desync mitigation mode. The rule is NON_COMPLIANT if the Load Balancer's Desync mitigation mode does not match with the user defined Desync mitigation mode.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.7.6Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN is not configured to log requests.2
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud CDN
10.2.1.7.7Checks if at least one Google Cloud Audit Log is logging Google Cloud Storage (GCS) data events for all GCS buckets. The rule is NON_COMPLIANT if there are no audit logs that record GCS data events.4
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.1.7.8In GCP, the equivalent to enabling AWS CloudTrail would be using Cloud Audit Logs for logging administrative activities on your Google Cloud resources.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Audit Logs
10.2.1.7.9Checks if a Google Cloud Build configuration has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Build
10.2.1.7.10Verifies whether logging is enabled with a valid severity level for Cloud SQL database replication task events in GCP. The rule is NON_COMPLIANT if logging is not enabled or the logging severity level for replication tasks in the target Cloud SQL database is invalid.3
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.7.11Checks if a Google Cloud Firestore instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have logging enabled for audit logs.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firestore
10.2.1.7.12Checks if Google Cloud Platform (GCP) VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'logging' is set to false.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPN
10.2.1.7.13Checks if logging is configured for active Cloud Run services. This rule is NON_COMPLIANT if an active Cloud Run service does not have logging enabled or the log configuration is null in at least one revision.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Run
10.2.1.7.14Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.1.7.15Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of `enableStackdriverLogging` is false.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google App Engine
10.2.1.7.16Checks if the Google Cloud Load Balancing has logging enabled. The rule is NON_COMPLIANT if the logging is disabled or the log bucket does not match the specified Cloud Storage bucket name.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.1.7.17Checks if Google Cloud Pub/Sub topics have audit logging enabled. The rule is NON_COMPLIANT if a topic does not have audit logging enabled.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.7.18Checks if a Google Cloud Pub/Sub topic has logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.1.7.19The equivalence in GCP for enabling Cloud Audit Logs across multiple regions is to configure 'Cloud Audit Logs' to ensure that logs are captured for activities across multiple regions.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Audit Logs
10.2.1.7.20Checks if a Google Cloud SQL instance has Cloud Logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Cloud Logging enabled for audit logs.4
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.7.21Checks if GCP Firewall Rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the firewall rules. You can specify which logging type you want the rule to check.3
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firewall
10.2.1.7.22Checks if Cloud SQL for MySQL instances are configured to publish audit logs to Stackdriver Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log publishing configured.2
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud SQL
10.2.1.7.23Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.4
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.1.7.24Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.7.25Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or is encrypted with another key, or if a dataset does not have audit logging enabled.2
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.1.7.26Checks if DNS query logging is enabled for your Google Cloud Platform Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud Platform Cloud DNS public managed zones.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud DNS
10.2.1.7.27Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.2
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Storage
10.2.1.7.28Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Workflows
10.2.1.7.29Checks if Google Cloud Virtual Private Cloud (Google Cloud VPC) flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.3
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.1.7.30Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the expected value.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.1.7.31Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.3143
10.2.2.1Checks if Google Cloud Endpoints configurations have access logging enabled. The rule is NON_COMPLIANT if 'accessLog' settings are not present in the API configuration.2
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.2.2Verifies whether all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is neither ERROR nor INFO.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Endpoints
10.2.2.3Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints APIs. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Trace
10.2.2.4Checks if a Google Cloud Endpoints API has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or the log level is neither ERROR nor ALL.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Endpoints
10.2.2.5Checks if Google Cloud HTTP(S) Load Balancers are configured with the user-defined settings for connection draining. The rule is NON_COMPLIANT if the connection draining settings do not match the user-defined parameters.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.2.6Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.2
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud CDN
10.2.2.7Checks if at least one Google Cloud Audit Log is enabled for Google Cloud Storage (GCS) data access events across all GCS buckets. The rule is NON_COMPLIANT if there are no audit logs recording GCS data events.4
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.2.8GCP equivalent of enabling Cloud Audit Logs for project-level auditing.3
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Logging
10.2.2.9Checks if a Google Cloud Build (GCB) trigger has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present logging configurations is set to 'DISABLED'.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Build
10.2.2.10Verifies if logging is enabled with a valid severity level for Google Cloud Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or if the replication task logging of a target database has an invalid severity level.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Database Migration Service (DMS)
10.2.2.11Checks if a Google Cloud Firestore (with MongoDB compatibility) instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Stackdriver logging enabled for audit logs.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Firestore
10.2.2.12Checks if Google Cloud VPN has logging enabled for the connection. The rule is NON_COMPLIANT if 'LogConfig.enabled' is set to false.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPN
10.2.2.13Checks if log configuration is set on active Cloud Run services. This rule is NON_COMPLIANT if an active Cloud Run service does not have the logging configuration defined or the logging setting is null in at least one revision.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Cloud Run
10.2.2.14Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Kubernetes Engine (GKE)
10.2.2.15Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'logSeverity' is not set or 'logSeverity' is configured incorrectly.4
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google App Engine
10.2.2.16Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the loggingConfig.enable is false or loggingConfig.logBucket is not equal to the specified logBucketName.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Load Balancing
10.2.2.17Checks if Google Cloud Pub/Sub topic message logging is enabled. The rule is NON_COMPLIANT if a topic does not have logging enabled.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.2.18Checks if a Google Cloud Pub/Sub service has Logging enabled for audit purposes. The rule is NON_COMPLIANT if the service does not have audit logging enabled.2
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Pub/Sub
10.2.2.19The Google Cloud Platform (GCP) equivalent for enabling multi-region logging is using Google Cloud Logging with the configuration to ensure that logs are retained across multiple regions, similar to AWS CloudTrail's multi-region capability.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Logging
10.2.2.20Checks if a Google Cloud Spanner instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have Stackdriver logging enabled for audit logs.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Spanner
10.2.2.21Checks if Google Cloud Platform (GCP) VPC firewall rules have logging enabled. The rule is NON_COMPLIANT if the logging for a specific action (such as 'allowed' or 'denied') is not configured. You can specify which logging type you want the rule to check.4
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.2.22Checks if Google Cloud SQL for MySQL instances are configured to publish logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log publishing configured.3
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.2.23Checks if the respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.4
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud SQL
10.2.2.24Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google BigQuery
10.2.2.25Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if a dataset does not have audit logging enabled.2
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
BigQuery
10.2.2.26Checks if Cloud DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud DNS
10.2.2.27Checks if logging is enabled for your Google Cloud Storage (GCS) buckets. The rule is NON_COMPLIANT if logging is not enabled.3
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Storage
10.2.2.28Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Workflows
10.2.2.29Checks if Google Cloud VPC flow logs are found and enabled for all Google Cloud VPC networks. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC network.3
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud VPC
10.2.2.30Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the expected value.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.2.2.31Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Google Cloud Armor
10.3.1: Audit logs are protected from destruction and unauthorized modifications.3139
10.3.1.1Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' is not present in the Endpoints configuration.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Endpoints
10.3.1.2Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logging level is neither ERROR nor INFO.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Endpoints
10.3.1.3Checks if Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Endpoints
10.3.1.4Checks if a Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or the logging level is neither ERROR nor ALL.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud API Gateway
10.3.1.5Checks if Google Cloud Load Balancers are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if Load Balancer Desync mitigation mode does not match with user-defined Desync mitigation mode.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Load Balancing
10.3.1.6Checks if Google Cloud CDN (Content Delivery Network) is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.2
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud CDN
10.3.1.7Checks if at least one Google Cloud Audit Log is logging Google Cloud Storage (GCS) data events for all GCS buckets. The rule is NON_COMPLIANT if there are no audit logs recording GCS data events.4
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.1.8Equivalent rule in GCP for CLOUD_TRAIL_ENABLED is to ensure that 'Cloud Audit Logging' is enabled for projects, as it provides similar audit logging capabilities.3
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Cloud Audit Logging
10.3.1.9Checks if a Google Cloud Build trigger has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Build
10.3.1.10Checks if logging is enabled with a valid severity level for GCP Cloud SQL database instances. The rule is NON_COMPLIANT if logging is not enabled or Cloud SQL instance logging has a severity level that is not valid.4
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Cloud SQL
10.3.1.11Checks if a Google Cloud Firestore instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have logging enabled for audit logs.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Firestore
10.3.1.12Checks if Google Cloud Platform (GCP) VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'loggingEnabled' is set to false.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud VPN
10.3.1.13Checks if Logging Configuration is set on active Cloud Run services. This rule is NON_COMPLIANT if an active Cloud Run service does not have Logging Configuration defined or the value for Logging Configuration is null in at least one revision.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Cloud Run
10.3.1.14Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Kubernetes Engine (GKE)
10.3.1.15Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the services are not set to enable logging.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google App Engine
10.3.1.16Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging configuration is disabled or the log bucket does not match the specified Cloud Storage bucket name.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Load Balancing
10.3.1.17Checks if Google Cloud Pub/Sub has audit logging enabled. The rule is NON_COMPLIANT if a Pub/Sub topic does not have audit logging enabled.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Pub/Sub
10.3.1.18Checks if a Cloud Pub/Sub topic has Stackdriver Logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Cloud Pub/Sub
10.3.1.19The GCP equivalent for enabling multi-region logging is to utilize Google Cloud's Stackdriver Logging in a multi-region configuration. This enhances the visibility and tracking of logs across different regions, similar to AWS CloudTrail's functionality for multi-region tracking.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Logging (formerly Stackdriver Logging)
10.3.1.20Checks if a Google Cloud Spanner instance has Stackdriver Logging enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have Stackdriver Logging enabled for audit logs.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Spanner
10.3.1.21Checks if Google Cloud Firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the firewall rules. You can specify which logging type (e.g., 'log all', 'log denied') you want the rule to check.2
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud VPC Firewall
10.3.1.22Checks if Google Cloud SQL for MySQL instances are configured to export audit logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log exporting configured.4
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud SQL
10.3.1.23Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types (such as general log, slow query log, or error log) are not enabled.4
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud SQL
10.3.1.24Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google BigQuery
10.3.1.25Checks if Google Cloud BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if a dataset does not have audit logging enabled.2
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
BigQuery
10.3.1.26Checks if Cloud DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud DNS
10.3.1.27Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.2
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Cloud Storage
10.3.1.28Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Workflows
10.3.1.29Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.3
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud VPC
10.3.1.30Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the value of the parameter.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Armor
10.3.1.31Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Armor
10.3.2: Audit logs are protected from destruction and unauthorized modifications.2645
10.3.2.1Checks if a GCP Backup resource (using Cloud Storage or native backup services) has an attached IAM policy that prevents deletion of backups. The rule is NON_COMPLIANT if the Backup resource does not have IAM policies or has policies without a suitable 'Deny' statement (for permissions like storage.objects.delete or any equivalent for protecting backup data).0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
GCP Backup Services / Cloud Storage
10.3.2.2Checks that there is at least one Google Cloud Audit Logging service enabled with security best practices. This rule is COMPLIANT if there is at least one audit log that meets all necessary security configurations.4
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Logging
10.3.2.3Checks if Google Cloud Logging Log Buckets are encrypted with a customer-managed encryption key (CMEK) or a specified key. The rule is NON_COMPLIANT if a Log Bucket is not encrypted with a CMEK or is encrypted with a key not supplied in the rule parameter.4
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Logging
10.3.2.4Checks if Google Cloud Audit Logs is configured to use Customer-managed encryption keys (CMEK). The rule is COMPLIANT if the encryption key is defined in the Cloud KMS service.4
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Security
10.3.2.5Checks if Google Cloud Audit Logs has log integrity (signed digest) enabled. Google Cloud recommends that integrity validation must be enabled for all audit logs. The rule is NON_COMPLIANT if the validation is not enabled.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Audit Logs
10.3.2.6Checks if Google Cloud Database Migration Service (GCP DMS) migration jobs are publicly accessible. The rule is NON_COMPLIANT if the 'publiclyAccessible' field is set to true.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Database Migration Service
10.3.2.7Checks if Google Cloud Firestore database backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore database backups are public.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Firestore
10.3.2.8Checks if Google Cloud Persistent Disk snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots are shared with 'allUsers', meaning Google Cloud snapshots are public.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.2.9Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the PodSpec is set to 'false'.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Kubernetes Engine (GKE)
10.3.2.10Checks if Google Cloud Filestore access instances are configured to enforce a root directory. The rule is NON_COMPLIANT if the root path is set to '/' (default root directory of the file system).0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Filestore
10.3.2.11Checks if Google Cloud Filestore access control configurations are set up to enforce an identity by ensuring that user permissions are properly defined. The rule is NON_COMPLIANT if permissions are not defined or if provided parameters do not match access control requirements.3
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Filestore
10.3.2.12Checks if a Google Cloud account has VPC firewall rules configured to block public access. The rule is NON_COMPLIANT if there are firewall rules allowing ingress traffic from 0.0.0.0/0 on ports other than port 22.2
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud VPC Firewall Rules
10.3.2.13Checks if the Google Cloud Function IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Cloud Functions
10.3.2.14Checks if a Google Cloud SQL for PostgreSQL or MySQL manual database snapshot is public. The rule is NON_COMPLIANT if any existing and new Cloud SQL database snapshot is public.2
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud SQL
10.3.2.15Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration.requireSsl' field is false.4
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud SQL
10.3.2.16Checks if Google Cloud SQL backups are public. The rule is NON_COMPLIANT if any existing and new Google Cloud SQL backups are public.3
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud SQL
10.3.2.17Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset has 'access' permissions with 'role' set to 'roles/viewer' for 'allUsers'.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google BigQuery
10.3.2.18Checks if Google Cloud Storage buckets have uniform bucket-level access enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for Cloud Storage buckets.3
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.2.19Verifies if the required public access prevention settings are configured at the project level. The compliance rule is considered NON_COMPLIANT when the specified fields do not align with the configuration settings in the Google Cloud resource.3
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.2.20Checks if the required IAM policies or organization policies are configured at the project or organization level. The rule is NON_COMPLIANT if the configuration item does not align with the expected policies for public access.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud IAM
10.3.2.21Checks if Google Cloud Storage (GCS) buckets are publicly accessible. The rule is NON_COMPLIANT if a GCS bucket is not listed in the excludedPublicBuckets parameter and the uniform bucket-level access is disabled (allowing public access).2
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.2.22Checks if Object Versioning is enabled in Google Cloud Storage (GCS) buckets. The rule is NON_COMPLIANT if Object Versioning is not enabled.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.2.23Checks if your Google Cloud Storage buckets do not allow public access. The rule checks the Uniform Resource Identifier (URI) access control settings, IAM policies, and the bucket ACL.2
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.2.24Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform bucket-level access settings, bucket policy, and bucket access control list (ACL).2
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.2.25Checks if direct internet access is disabled for a Google AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google AI Platform Notebooks
10.3.2.26Checks if Google Cloud Documents (specifically, Cloud Storage buckets or Pub/Sub topics) owned by the account are public. The rule is NON_COMPLIANT if Cloud Storage buckets or Pub/Sub topics with the owner 'Self' are publicly accessible.3
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Cloud Storage / Pub/Sub
10.3.3: Audit logs are protected from destruction and unauthorized modifications.2416
10.3.3.1Checks if Google Cloud SQL instances are protected by a backup plan. The rule is NON_COMPLIANT if the Google Cloud SQL instance is not protected by a backup plan.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud SQL
10.3.3.2Checks if a backup policy has a backup rule that meets the required frequency and retention duration. The rule is NON_COMPLIANT if recovery snapshots are not created at least as frequently as the specified schedule or expire before the designated retention period.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Backup and DR
10.3.3.3Verifies that a backup or snapshot's retention policy for a Google Cloud Platform (GCP) resource, such as a Cloud Storage bucket or Compute Engine snapshot, meets the specified minimum retention period. If a backup's retention point is less than the required retention period, the rule is considered NON_COMPLIANT.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Cloud Storage / Compute Engine Snapshots
10.3.3.4Checks that there is at least one Google Cloud Audit Log enabled with security best practices. This rule is COMPLIANT if there is at least one log that meets all of the following security configurations.4
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Logging
10.3.3.5Checks if Google Cloud Logging Log Buckets are encrypted with Google Cloud KMS keys. The rule is NON_COMPLIANT if a Log Bucket is not encrypted with a KMS key or is encrypted with a KMS key not supplied in the rule parameter.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Logging
10.3.3.6Checks if Google Cloud Audit Logging is configured to use Google Cloud Key Management Service (Cloud KMS) for encryption. The rule is COMPLIANT if the KmsKeyId is defined.2
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Audit Logging
10.3.3.7Checks if Google Cloud Audit Logs allows for log ingestion integrity verification. Google Cloud recommends that log integrity check should be enabled for all audit logs. The rule is NON_COMPLIANT if integrity verification is not enabled.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Audit Logs
10.3.3.8Checks if Cloud SQL instances have automated backups enabled. Optionally, the rule checks the backup retention period and the backup window.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Cloud SQL
10.3.3.9Checks whether Google Cloud Firestore collections are included in Google Cloud Backup plans. The rule is NON_COMPLIANT if Google Cloud Firestore collections are not present in any Google Cloud Backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Backup
10.3.3.10Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore collections. The rule is NON_COMPLIANT if PITR is not enabled for Firestore collections.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Firestore
10.3.3.11Checks if Google Cloud Firestore collections are protected by a backup plan. The rule is NON_COMPLIANT if the Firestore collection is not covered by a backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Firestore
10.3.3.12Check if Google Cloud Persistent Disk snapshots are included in Google Cloud Backup plans. The rule is NON_COMPLIANT if Google Cloud Persistent Disk snapshots are not included in backup plans.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Backup
10.3.3.13Checks if Google Persistent Disks are protected by a backup plan. The rule is NON_COMPLIANT if the Google Persistent Disk is not covered by a backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.3.14Checks if Google Compute Engine (GCE) instances are protected by a backup plan. The rule is NON_COMPLIANT if the Google Compute Engine instance is not covered by a backup plan.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Compute Engine
10.3.3.15Checks if Google Cloud Filestore instances are included in the backup plans of Google Cloud Backup. The rule is NON_COMPLIANT if Filestore instances are not included in the backup plans.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Backup
10.3.3.16Checks if Google Cloud Filestore instances are protected by a backup plan. The rule is NON_COMPLIANT if the Filestore instance is not covered by a backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Filestore
10.3.3.17Check if the Google Cloud Memorystore for Redis instances have automatic backup turned on. The rule is NON_COMPLIANT if the Redis instance backup frequency is less than the specified retention period. For example: If the parameter is 15 days, then the rule is non-compliant if the backup frequency is set to less than 15 days.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Memorystore
10.3.3.18Checks if Google Cloud Filestore instances are protected by a backup plan. The rule is NON_COMPLIANT if the Google Cloud Filestore instance is not covered by a backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Filestore
10.3.3.19Checks if a Google Cloud SQL instance retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud SQL
10.3.3.20Checks if Google Cloud SQL databases are present in Google Cloud Backup plans. The rule is NON_COMPLIANT if Google Cloud SQL databases are not included in any Google Cloud Backup plan.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud SQL
10.3.3.21Checks if Google Cloud SQL instances are protected by a backup plan. The rule is NON_COMPLIANT if the Google Cloud SQL Database instance is not covered by a backup plan.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud SQL
10.3.3.22Checks that Google Cloud BigQuery automated snapshots are enabled for datasets. The rule is NON_COMPLIANT if the value for snapshot retention period is greater than MaxRetentionPeriod or less than MinRetentionPeriod or the value is 0.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud BigQuery
10.3.3.23Checks if GCS (Google Cloud Storage) buckets are publicly accessible. The rule is NON_COMPLIANT if a GCS bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.2
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.3.24Checks if Google Cloud Storage (GCS) buckets are protected by a backup plan. The rule is NON_COMPLIANT if the GCS bucket is not covered by a backup plan.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.4: Audit logs are protected from destruction and unauthorized modifications.912
10.3.4.1Checks if a Google Cloud CDN (Content Delivery Network) distribution with Google Cloud Storage as the origin has an authorized service account configured. The rule is NON_COMPLIANT if the CDN distribution is backed by Google Cloud Storage and the origin service account is not configured correctly, or the origin is not a Google Cloud Storage bucket.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud CDN
10.3.4.2Checks if a Google Cloud CDN service with a Google Cloud Storage origin has signed URLs enabled. The rule is NON_COMPLIANT for Cloud CDN services with Google Cloud Storage origins that don't have signed URLs enabled.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud CDN
10.3.4.3Checks that there is at least one Google Cloud Audit Log configured with security best practices. This rule is COMPLIANT if there is at least one log that meets all of the following standards.3
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Logging
10.3.4.4Checks if Google Cloud Logging (formerly Stackdriver Logging) Logs are encrypted with Google-managed or customer-managed encryption keys. The rule is NON_COMPLIANT if a Log Bucket is not encrypted with a KMS key or is encrypted with a KMS key not specified in the rule parameter.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Logging
10.3.4.5Checks if Google Cloud Audit Logs is configured to use Customer-managed encryption keys (Cmek) for logs. The rule is COMPLIANT if the kmsKeyName is defined.4
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Audit Logs
10.3.4.6Checks if Google Cloud Audit Logs have integrity checking enabled. Google Cloud recommends that integrity checking must be enabled for all logs. The rule is NON_COMPLIANT if the integrity checking is not enabled.2
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Logging
10.3.4.7Checks if the Cloud Storage bucket has Object Versioning enabled, by default. The rule is NON_COMPLIANT if Object Versioning is not enabled.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.3.4.8Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and the bucket-level settings are public.2
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage (GCS)
10.3.4.9Checks if versioning is enabled for your Google Cloud Storage buckets. Optionally, the rule checks if Object Versioning with minimum retention policies is configured for your buckets.1
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Google Cloud Storage
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.61
10.4.1.1Checks if Google Cloud Trace tracing is enabled on Google Cloud API Gateway. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud API Gateway
10.4.1.2Checks if a resource type has a Cloud Monitoring alerting policy for the specified metric. For resource types, you can specify Google Compute Engine instances, Google Kubernetes Engine clusters, Cloud SQL instances, or Google Cloud Storage buckets. The rule is COMPLIANT if the specified metric has a resource ID and a corresponding alerting policy.1
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Monitoring
10.4.1.3Checks if Stackdriver Monitoring (now known as Cloud Monitoring) is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.0
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Cloud Monitoring
10.4.1.4Checks if Google Cloud Security Command Center (SCC) is enabled for a Google Cloud Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.0
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Security Command Center
10.4.1.5Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Cloud Pub/Sub
10.4.1.6Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'visible' field is set to false.0
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Armor
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.73
10.4.1.1.1Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Trace
10.4.1.1.2Checks if a resource type has a Google Cloud Monitoring alerting policy for the specified metric. For resource types, you can specify Google Cloud Storage buckets, Compute Engine instances, Cloud SQL instances, or persistent disks. The rule is COMPLIANT if the specified metric has a resource ID and an associated alerting policy.1
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Cloud Monitoring
10.4.1.1.3Checks if Google Cloud Audit Logs are configured to export logs to Google Cloud Storage. The audit configuration is NON_COMPLIANT if the export destination for logs is empty.1
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Logging
10.4.1.1.4Checks if Stackdriver Monitoring is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.0
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Compute Engine
10.4.1.1.5Checks if Google Cloud Security Command Center (SCC) is enabled for a GCP project. The rule is NON_COMPLIANT if Google Cloud SCC is not enabled.0
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Security Command Center
10.4.1.1.6Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Pub/Sub
10.4.1.1.7Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'monitoringConfig.enabled' field is set to false.1
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Armor
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.73
10.4.2.1Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Endpoints
10.4.2.2Checks if Google Cloud Monitoring (formerly Stackdriver Monitoring) alert policies have an action configured for the 'ALERTING', 'NO_DATA', or 'CLOSED' state. Optionally checks if any actions match a named notification channel. The rule is NON_COMPLIANT if there is no action specified for the alert policy or optional parameter.0
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Monitoring
10.4.2.3Checks if a resource type has a Cloud Monitoring alert policy for the specified metric. For resource types, you can specify Google Compute Engine instances, Google Cloud Storage buckets, or Google SQL instances. The rule is COMPLIANT if the named metric has a resource ID and a Cloud Monitoring alert policy.2
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Cloud Monitoring
10.4.2.4Checks if Stackdriver monitoring (now known as Google Cloud Operations suite) is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.0
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Operations
10.4.2.5Checks if Google Cloud Security Command Center (SCC) is enabled for a GCP Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.0
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Security Command Center
10.4.2.6Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Pub/Sub
10.4.2.7Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'monitoringEnabled' field is set to false.1
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Armor
10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity.10
10.4.3.1Checks if Google Cloud Monitoring alerting policies have a notification channel configured for the 'Triggered', 'Pending', or 'OK' state. Optionally checks if any notification channels match a specified resource name. The rule is NON_COMPLIANT if there is no notification channel specified for the alerting policy or optional parameter.0
Attributes
- Section
10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Google Cloud Monitoring
10.5.1: Audit log history is retained and available for analysis.138
10.5.1.1Verifies if a Google Cloud Platform (GCP) backup plan has a backup policy that meets the required frequency and retention period. The policy is deemed NON_COMPLIANT if recovery points are not created as often as the specified frequency or if they expire before the specified retention period.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Backup and DR
10.5.1.2Checks if a backup retention policy in Google Cloud Storage or Google Cloud Backup expires no earlier than after the specified period. The rule is NON_COMPLIANT if the backup has a retention policy that is less than the required retention period.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Backup
10.5.1.3Checks that there is at least one Google Cloud Audit log configuration defined with security best practices. This rule is COMPLIANT if there is at least one log configuration that meets all of the following: logging is enabled for all services and appropriate IAM policies are applied.4
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Logging
10.5.1.4Checks if a Google Cloud Logging Log Bucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.1
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Logging
10.5.1.5Checks if a Google Cloud Firestore backup retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the specified value.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Firestore
10.5.1.6Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore databases. The rule is NON_COMPLIANT if PITR is not enabled for Firestore databases.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Firestore
10.5.1.7Checks if Persistent Disks are attached to Google Compute Engine instances. Optionally checks if Persistent Disks are set to be deleted when their associated instance is terminated.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Compute Engine
10.5.1.8Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Container Registry
10.5.1.9Checks if Google Cloud Search domains (using Google Cloud's managed search services) are configured to send logs to Google Cloud Logging. The rule is COMPLIANT if logging is enabled for a Google Cloud Search domain. This rule is NON_COMPLIANT if logging is not configured.2
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Logging
10.5.1.10Checks if Google Cloud Elasticsearch Service (GCP's equivalent to Amazon OpenSearch Service) has audit logging enabled. The rule is NON_COMPLIANT if an Elasticsearch Service domain does not have audit logging enabled.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Elasticsearch Service
10.5.1.11Checks if Google Cloud Elasticsearch clusters are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if logging is not configured.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Logging
10.5.1.12Checks if a lifecycle rule is configured for a Google Cloud Storage bucket. The rule is NON_COMPLIANT if there is no active lifecycle configuration rules or the configuration does not match the specified parameter values.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Storage
10.5.1.13Checks if Google Cloud Storage (GCS) buckets with versioning enabled have lifecycle policies configured. The rule is NON_COMPLIANT if GCS lifecycle policy is not enabled.1
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Google Cloud Storage
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.4257
10.6.3.1Checks if Google Cloud API Gateway has access logging enabled. The rule is NON_COMPLIANT if 'accessLogSettings' is not present in the API Gateway configuration.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud API Gateway
10.6.3.2Checks if all methods in Google Cloud API Gateway configurations have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if loggingLevel is neither ERROR nor INFO.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud API Gateway
10.6.3.3Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Endpoints
10.6.3.4Checks if a Google Cloud Platform (GCP) Cloud Endpoints API has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if 'logLevel' is neither ERROR nor ALL.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Cloud Endpoints
10.6.3.5Checks if Google Cloud HTTP(S) Load Balancers are configured with a user-defined security policy to mitigate desynchronization attacks. The rule is NON_COMPLIANT if the HTTP(S) Load Balancer's security policy does not match the user-defined security policy.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud HTTP(S) Load Balancer
10.6.3.6Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.2
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud CDN
10.6.3.7Checks if at least one Google Cloud Audit Log is logging Cloud Storage data access events for all Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs recording Cloud Storage data access events.4
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Storage
10.6.3.8Checks if Google Cloud Monitoring alerting policies have notification channels configured for the ALERTING, PENDING, or OK state. Optionally checks if any notification channels match a named channel ID. The rule is NON_COMPLIANT if there is no notification channel specified for the alerting policy or optional parameter.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Monitoring
10.6.3.9Checks if a resource type has a Stackdriver Monitoring alerting policy for the specified metric. For resource type, you can specify Google Cloud Storage buckets, Compute Engine instances, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the specified metric has a resource ID and Stackdriver alerting policy.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Stackdriver Monitoring
10.6.3.10This rule checks if Cloud Audit Logs are enabled in GCP, which is equivalent to the AWS rule for ensuring that CloudTrail is enabled. The main service involved is Cloud Logging.3
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Cloud Logging
10.6.3.11Checks if a Google Cloud Build trigger has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Build
10.6.3.12Checks if logging is enabled with a valid severity level for Google Cloud SQL database replication events. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.3
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud SQL
10.6.3.13Checks if a Google Cloud Firestore instance has Cloud Logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Cloud Logging enabled for audit logs.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Firestore
10.6.3.14Checks if GCP Cloud VPN has logging enabled for its tunnels. The rule is NON_COMPLIANT if 'logConfig.loggingEnabled' is set to false.3
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
GCP Cloud VPN
10.6.3.15Checks if 'Stackdriver Monitoring' is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Compute Engine
10.6.3.16Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the Pod security context is set to 'false'.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Kubernetes Engine (GKE)
10.6.3.17Checks if logging configuration is set on active Google Kubernetes Engine (GKE) deployments. This rule is NON_COMPLIANT if an active GKE deployment does not have logging enabled or the logging configuration is null in at least one container definition.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Kubernetes Engine (GKE)
10.6.3.18Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Kubernetes Engine (GKE)
10.6.3.19Checks if Google Cloud Platform App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Logging
10.6.3.20Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging is not enabled or the log bucket does not match the specified bucket name.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Load Balancing
10.6.3.21Verifies if IAM users are part of at least one IAM group in Google Cloud Platform.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Identity and Access Management (IAM)
10.6.3.22Checks if Google Cloud Pub/Sub has logs enabled for audit logging. The rule is NON_COMPLIANT if Pub/Sub does not have audit logging enabled.2
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Pub/Sub
10.6.3.23Checks if a Google Cloud Pub/Sub topic has audit logging enabled. The rule is NON_COMPLIANT if the topic does not have audit logging enabled.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Pub/Sub
10.6.3.24The GCP equivalent for the rule identifier MULTI_REGION_CLOUD_TRAIL_ENABLED in the context of multi-region logging is to ensure that audit logs for services are enabled across multiple regions. This ensures that logs are available for compliance and monitoring across geographic boundaries.2
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Cloud Logging
10.6.3.25Checks if a Google Cloud SQL instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.4
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Cloud SQL
10.6.3.26Checks if Google Cloud Platform (GCP) VPC firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured. You can specify which logging option you want the rule to check.4
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud VPC
10.6.3.27Checks if Google Cloud Search instances have fine-grained access control enabled. The rule is NON_COMPLIANT if Access Control settings are not properly configured for the Cloud Search instance.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Search
10.6.3.28Checks if Google Cloud SQL for MySQL instances are configured to enable Cloud Audit Logs. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log publishing enabled.3
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Cloud SQL
10.6.3.29Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.4
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud SQL
10.6.3.30Checks if Google BigQuery datasets are logging audits to a specific bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google BigQuery
10.6.3.31Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or if it is encrypted with another key, or if dataset audit logging is not enabled.2
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
BigQuery
10.6.3.32Checks if DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud DNS
10.6.3.33Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket policy does not allow another Google Cloud project to perform any storage.objects.get and storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.3
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Storage
10.6.3.34Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.2
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Cloud Storage
10.6.3.35Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.2
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Storage
10.6.3.36Checks if Google Cloud Security Command Center is enabled for a Google Cloud Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Security Command Center
10.6.3.37Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Pub/Sub
10.6.3.38Checks if Google Cloud Workflow has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration does not meet the minimum requirements.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Workflows
10.6.3.39Checks if Google Cloud Virtual Private Cloud (Google Cloud VPC) flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.3
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud VPC
10.6.3.40Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the specified parameter value.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Armor
10.6.3.41Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The policy is NON_COMPLIANT if the 'logConfig.enable' field is set to false.4
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Armor
10.6.3.42Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy, if it does not have logging enabled.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Google Cloud Armor
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.84
10.7.1.1Checks if Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Endpoints
10.7.1.2Checks if your Google Cloud Deployment Manager configurations send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Google Cloud Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager configurations do not send notifications.0
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Deployment Manager
10.7.1.3Checks if Google Cloud Monitoring alerting policies have notifications configured for various states (triggered, pending notification, and resolved). Optionally checks if any notifications match a specified topic. The rule is NON_COMPLIANT if there are no notifications specified for the alerting policy or the optional parameter.0
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Monitoring
10.7.1.4Checks if a resource type has a Cloud Monitoring alert for the named metric. For resource type, you can specify Google Cloud Storage buckets, Compute Engine instances, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the named metric has a resource ID and Cloud Monitoring alert.3
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Cloud Monitoring
10.7.1.5Checks if Stackdriver Monitoring (now Google Cloud Monitoring) is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.0
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Monitoring
10.7.1.6Checks if Google Cloud Security Command Center (SCC) is enabled for a Google Cloud Platform (GCP) project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.0
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Security Command Center
10.7.1.7Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Pub/Sub
10.7.1.8Checks if Google Cloud's monitoring for the Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'enableMetrics' field is set to false.1
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Armor
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.81
10.7.2.1Checks if Google Cloud Trace is enabled for Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Endpoints
10.7.2.2Checks if your Google Cloud Deployment Manager configurations send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Google Cloud Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager configurations do not send notifications.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Deployment Manager
10.7.2.3Checks if Google Cloud Monitoring alert policies have notification channels configured for the ALARM, NO_DATA, or OK state. Optionally checks if any notification channels match a specified resource name. The rule is NON_COMPLIANT if there is no notification channel specified for the alert policy or optional parameter.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Monitoring
10.7.2.4Checks if a resource type has a Cloud Monitoring alert policy for the specified metric. For resource type, you can specify Google Cloud Storage buckets, Compute Engine instances, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the specified metric has a resource ID and a Cloud Monitoring alert policy.1
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Cloud Monitoring
10.7.2.5Checks if Stackdriver Monitoring (now part of Google Cloud Operations Suite) is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Operations Suite
10.7.2.6Checks if Google Cloud Security Command Center is enabled for a GCP Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Security Command Center
10.7.2.7Checks if Google Cloud Pub/Sub logging is enabled for message delivery status. The rule is NON_COMPLIANT if delivery status notifications for messages are not enabled.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Pub/Sub
10.7.2.8Checks if Google Cloud Monitoring security metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'enableMonitoring' field is set to false.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Google Cloud Armor
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.32
11.3.1.1Checks if all of the specified applications are installed on the Google Compute Engine instance. Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to instances running that platform.0
Attributes
- Section
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Google Compute Engine
11.3.1.2Checks if the compliance status of Google Cloud's OS Config patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance. The rule is compliant if the field status is COMPLIANT.0
Attributes
- Section
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
OS Config
11.3.1.3Checks if a private Google Container Registry (GCR) repository has vulnerability scanning enabled. The rule is NON_COMPLIANT if the private GCR repository's scan setting is not set to either scan on push or continuous scanning. For more information on enabling vulnerability scanning, see the Google Cloud documentation for Container Analysis.2
Attributes
- Section
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Google Container Registry
11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.20
11.3.1.1.1Check if specified applications are installed on a Compute Engine instance, with an option to specify minimum versions and platforms.0
Attributes
- Section
11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Google Compute Engine
11.3.1.1.2Checks if the compliance status of Google Cloud OS Config patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the Compute Engine instance. The rule is compliant if the field status is COMPLIANT.0
Attributes
- Section
11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Google Cloud OS Config
11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed.12
11.3.1.2.1Checks if a private Google Container Registry (GCR) repository has vulnerability scanning enabled. The rule is NON_COMPLIANT if the private GCR repository's scan frequency is not set to scan on push or continuous scan. For more information on enabling vulnerability scanning, see Vulnerability scanning in the Google Container Registry documentation.2
Attributes
- Section
11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Google Container Registry (GCR)
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.32
11.3.1.3.1Verifies if the specified applications are installed on a Google Cloud instance, with the option to define the minimum acceptable version and restrict the rule to specific platforms (e.g., Linux, Windows).0
Attributes
- Section
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Google Cloud Compute Engine
11.3.1.3.2Checks if the compliance status of the Google Cloud OS Config patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance. The rule is compliant if the field status is COMPLIANT.0
Attributes
- Section
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Google Cloud OS Config
11.3.1.3.3Checks if a private Google Container Registry (GCR) repository has vulnerability scanning enabled. The rule is NON_COMPLIANT if the private GCR repository's scan frequency is not set to scan on push or continuous scan. For more information on enabling image vulnerability scanning, see Container Analysis API documentation.2
Attributes
- Section
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Google Container Registry
11.5.1: Network intrusions and unexpected file changes are detected and responded to.20
11.5.1.1Checks whether a Google Cloud Load Balancer or Cloud CDN has Google Cloud Armor protection. It also checks if they have security policies associated for Google Cloud Load Balancer and Cloud CDN.0
Attributes
- Section
11.5.1: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Armor
11.5.1.2Checks if Google Cloud Security Command Center (SCC) is enabled in your GCP project. The rule evaluates the SCC results in the specified GCP project. The rule is COMPLIANT when Security Command Center is enabled.0
Attributes
- Section
11.5.1: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Security Command Center
11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.20
11.5.1.1.1Checks whether a Google Cloud Load Balancer or Cloud CDN has Google Cloud Armor protection. It also checks if they have Security Policies associated for Google Cloud Load Balancer and Cloud CDN.0
Attributes
- Section
11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Armor
11.5.1.1.2Checks if Google Cloud Security Command Center (SCC) is enabled in your Google Cloud account and project. If you provide a GCP project for centralization, the rule evaluates the SCC results in the centralized project. The rule is COMPLIANT when SCC is enabled.0
Attributes
- Section
11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Security Command Center
11.5.2: Network intrusions and unexpected file changes are detected and responded to.64
11.5.2.1Checks if your Google Cloud Deployment Manager configurations send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Google Cloud Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager configurations do not send notifications.0
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Deployment Manager
11.5.2.2Checks if Google Cloud Monitoring Uptime Checks have an alerting policy configured for the HEALTHY, UNHEALTHY, or DISABLED state. Optionally checks if any actions match a specific notification channel. The rule is NON_COMPLIANT if there is no action specified for the alerting policy or optional parameter.0
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Monitoring
11.5.2.3Checks whether Google Cloud Monitoring alerts with the given metric name have the specified settings.0
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Monitoring
11.5.2.4Checks if Google Cloud Audit Logs are configured to send logs to Google Cloud Logging. The audit log configuration is NON_COMPLIANT if the log sink is not set up or does not route logs correctly.3
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Logging
11.5.2.5Checks if Google Cloud Storage Object Change Notifications are enabled on a Cloud Storage bucket. The rule is NON_COMPLIANT if Cloud Storage Object Change Notifications are not set on a bucket, or if the notification type or destination do not match the event types and destination fields.1
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Storage
11.5.2.6Checks if Google Cloud Pub/Sub logging is enabled for message delivery status of notifications sent to a topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Google Cloud Pub/Sub
11.6.1: Unauthorized changes on payment pages are detected and responded to.62
11.6.1.1Checks if your Google Cloud Deployment Manager templates send notifications to a Google Cloud Pub/Sub topic. The rule is NON_COMPLIANT if Deployment Manager templates do not send notifications.0
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Google Cloud Deployment Manager
11.6.1.2Checks if Google Cloud Monitoring alert policies have an action configured for the ALERT, NO_DATA, or OK state. Optionally checks if any actions match a specified notification channel. The rule is NON_COMPLIANT if there is no action specified for the alert policy or optional parameter.0
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Google Cloud Monitoring
11.6.1.3Checks whether Google Cloud Monitoring alerting policies with the given metric type have the specified settings.0
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Google Cloud Monitoring
11.6.1.4Checks if Google Cloud Audit Logs are configured to send logs to Cloud Logging. The audit log configuration is NON_COMPLIANT if the corresponding sink is not creating logs in Cloud Logging.2
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Google Cloud Logging
11.6.1.5Checks if Google Cloud Storage (GCS) Notifications are enabled on a GCS bucket. The rule is NON_COMPLIANT if GCS Notifications are not set on a bucket, or if the event type or destination do not match the defined event types and notification destination.0
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Google Cloud Storage
11.6.1.6Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Google Cloud Pub/Sub
12.4.2.1: PCI DSS compliance is managed.10
12.4.2.1.1Checks if Google Cloud Resource Manager shares projects with an organization when integration is enabled with Cloud Identity. The rule is NON_COMPLIANT if the project is shared with individual users rather than the organization.0
Attributes
- Section
12.4.2.1: PCI DSS compliance is managed.
- Service
Google Cloud Resource Manager
12.8.3: Risk to information assets associated with third-party service provider (TPSP) relationships is managed.11
12.8.3.1Checks that the Gemini API (a.k.a. Generative Language API) is disabled since it is out of scope of GCP's PCI DSS conformance.1
Attributes
- Section
12.8.3: Risk to information assets associated with third-party service provider (TPSP) relationships is managed.
- Service
Gemini API
12.8.4: Risk to information assets associated with third-party service provider (TPSP) relationships is managed.11
12.8.4.1Checks that the Gemini API (a.k.a. Generative Language API) is disabled since it is out of scope of GCP's PCI DSS conformance.1
Attributes
- Section
12.8.4: Risk to information assets associated with third-party service provider (TPSP) relationships is managed.
- Service
Gemini API
12.9.1: Third-party service providers (TPSPs) support their customers’ PCI DSS compliance.11
12.9.1.1Checks that the Gemini API (a.k.a. Generative Language API) is disabled since it is out of scope of GCP's PCI DSS conformance.1
Attributes
- Section
12.9.1: Third-party service providers (TPSPs) support their customers’ PCI DSS compliance.
- Service
Gemini API
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.65
12.10.5.1Checks if your Google Cloud Deployment Manager templates send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Google Cloud Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager templates do not send notifications.0
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Google Cloud Deployment Manager
12.10.5.2Checks if Google Cloud Monitoring alerts have an action configured for the ALERT, NO_DATA, or OK state. Optionally checks if any actions match a named notification channel. The rule is NON_COMPLIANT if there is no action specified for the alert or optional parameter.0
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Google Cloud Monitoring
12.10.5.3Checks whether Google Cloud Monitoring alert policies with the given metric type have the specified settings.2
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Google Cloud Monitoring
12.10.5.4Checks if Google Cloud Audit Logs are configured to send logs to Google Cloud Logging. The audit log is NON_COMPLIANT if the log sink is not configured to export logs to Cloud Logging.3
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Google Cloud Audit Logging
12.10.5.5Checks if Google Cloud Storage Notifications are enabled on a Cloud Storage bucket. The rule is NON_COMPLIANT if Cloud Storage Notifications are not set on a bucket, or if the event type or destination do not match the specified eventTypes and destination parameters.0
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Google Cloud Storage
12.10.5.6Checks if Google Cloud Pub/Sub logging is enabled for message delivery status notifications sent to a topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notifications for messages are not enabled.0
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Google Cloud Pub/Sub
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.2226
A1.1.2.1Checks if a backup vault has an attached IAM policy that prevents deletion of backup recovery points. The rule is NON_COMPLIANT if the Backup Vault does not have IAM policies or has policies lacking a suitable 'Deny' statement for deleting backups.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Backup and DR
A1.1.2.2Checks if Google Cloud Database Migration Service (GCP DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the 'public' option is set to true.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Database Migration Service
A1.1.2.3Checks if Google Cloud Firestore snapshots are public. The rule is NON_COMPLIANT if any Google Cloud Firestore snapshots are public.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Firestore
A1.1.2.4Checks if Google Cloud Persistent Disk snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots have permissions that allow public access.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.2.5Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem field in the Pod security context is set to 'false'.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Kubernetes Engine (GKE)
A1.1.2.6Checks if Google Cloud Filestore instances are configured to enforce a root directory. The rule is NON_COMPLIANT if the root directory is set to '/' (default root directory of the file system).0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Filestore
A1.1.2.7Checks if Google Cloud Filestore (GCP equivalent of Amazon EFS) access points are configured to enforce a user identity. The rule is NON_COMPLIANT if 'IAM permissions' are not defined or if parameters are provided and there is no match in the corresponding parameter.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Filestore
A1.1.2.8Checks if a Google Cloud account has VPC firewall rules set to block public access. The rule is NON_COMPLIANT if 'allowIngressFromAll' is true, or if true, ports other than Port 22 are open to ingress traffic from any source.2
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud VPC
A1.1.2.9Checks if the Google Cloud Functions IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Functions
A1.1.2.10Checks if a Google Cloud SQL database instance snapshot is shared publicly. The rule is NON_COMPLIANT if any existing and new Cloud SQL snapshot is shared publicly.2
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud SQL
A1.1.2.11Checks if the Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the `ipConfiguration.requireSsl` field is false and there are any public IP addresses assigned to the instance.4
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud SQL
A1.1.2.12Checks if Google Cloud SQL backups are public. The rule is NON_COMPLIANT if any existing and new Google Cloud SQL backups are public.3
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud SQL
A1.1.2.13Checks if Google BigQuery datasets do not have public access. The rule is NON_COMPLIANT if the dataset's 'access' configuration includes entries that grant 'allUsers' or 'allAuthenticatedUsers' permissions.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google BigQuery
A1.1.2.14Checks if Google Cloud Storage (GCS) bucket access settings have uniform bucket-level access enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.3
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.2.15Verifies if the necessary public access prevention settings are applied at the project level. The rule is considered NON_COMPLIANT only when the specified settings do not align with the corresponding settings in the configuration item.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.2.16Checks if the required public access prevention settings are configured at the project level. The rule is NON_COMPLIANT if the configuration item does not match one or more settings from parameters (or default).0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.2.17Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and the bucket access control settings allow public access.2
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Cloud Storage
A1.1.2.18Checks if Object Versioning is enabled and if Object Versioning is configured to require the 'Object Versioning' actions to be performed with the appropriate IAM policies in Google Cloud Storage (GCS). The rule is NON_COMPLIANT if these configurations are not met.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.2.19Checks if your Google Cloud Storage buckets do not allow public read access. The rule evaluates the Uniform Bucket-Level Access settings, the bucket IAM policies, and ACLs to ensure they are properly configured to prevent public access.2
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.2.20Checks if your Google Cloud Storage (GCS) buckets do not allow public write access. The rule checks the Bucket IAM policies, Uniform bucket-level access settings, and the bucket access control list (ACL).2
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.2.21Checks if direct internet access is disabled for a Google AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google AI Platform Notebooks
A1.1.2.22Checks if Google Cloud Platform (GCP) Deployment Manager configurations owned by the account are public. The rule is NON_COMPLIANT if Deployment Manager configurations with the owner 'Self' are public.2
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Deployment Manager
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.4640
A1.1.3.1Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter endpointConfigurationType. The rule returns NON_COMPLIANT if the REST API does not match the endpoint type configured in the rule parameter.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Endpoints
A1.1.3.2Checks if a Cloud Endpoints API service uses an SSL certificate. The rule is NON_COMPLIANT if the API service does not have an associated SSL certificate.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Cloud Endpoints
A1.1.3.3Checks if Google Cloud App Engine services are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud App Engine service if it is not associated with a security policy.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Armor
A1.1.3.4Checks if Google Cloud CDN distributions are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN distribution is not associated with a Cloud Armor security policy.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud CDN
A1.1.3.5Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud CDN
A1.1.3.6Checks if the Cloud Source Repositories URL contains sign-in credentials or not. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Cloud Source Repositories
A1.1.3.7Checks if Google Cloud Database Migration Service (GCP DMS) migration jobs are public. The rule is NON_COMPLIANT if the PubliclyAccessible field is set to true.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Database Migration Service
A1.1.3.8Checks if Google Cloud Firestore backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore backups are public.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Firestore
A1.1.3.9Checks if the Google Cloud VPN's authorization policies allow connection access for all users. The rule is NON_COMPLIANT if 'AllowAll' is present and set to true.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud VPN
A1.1.3.10Checks if the status of the Google Cloud Resource Manager Policy compliance is COMPLIANT or NON_COMPLIANT after the policy execution on the resource. The rule is compliant if the field status is COMPLIANT. For more information about organizations and policies, see Understanding Organization Policies.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Resource Manager
A1.1.3.11Checks if Google Cloud Platform (GCP) Cloud VPN requires 'auto-accept' for shared attachments to be enabled. The rule is NON_COMPLIANT for a Cloud VPN if 'auto-accept' is set to 'true'.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud VPN
A1.1.3.12Verifies if the Google Kubernetes Engine (GKE) cluster endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Kubernetes Engine (GKE)
A1.1.3.13Checks if Google Cloud Search (a service similar to Amazon OpenSearch) instances are in Google Virtual Private Cloud (Google VPC). The rule is NON_COMPLIANT if a Google Cloud Search instance is publicly accessible.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Search
A1.1.3.14Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured to use SSL certificates from Google Cloud Managed Certificates or Google Cloud IAM Certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service configured without a certificate or is configured with a certificate different from Google Cloud Managed Certificates or IAM certificates.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Load Balancing
A1.1.3.15Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Managed SSL Certificates. To use this rule, use an SSL or HTTPS frontend configuration with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers. This rule does not check other types of load balancers.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Load Balancing
A1.1.3.16Checks if a Google Cloud account has public access settings enabled for its Compute Engine instances. The rule is NON_COMPLIANT if 'blockPublicIp' is false, or if true, any firewall rules allow ingress traffic on ports other than Port 22.4
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Compute Engine
A1.1.3.17In GCP, the equivalent for disabling incoming SSH traffic can be achieved by configuring firewall rules to disallow ingress on port 22, effectively restricting SSH access.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Firewall
A1.1.3.18Checks if the Cloud Router is associated with an authorized Virtual Private Cloud (VPC) in Google Cloud Platform (GCP). The rule is NON_COMPLIANT if the Cloud Router is associated with an unauthorized VPC.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud VPC
A1.1.3.19Checks if the Google Cloud Functions IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Functions
A1.1.3.20Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Cloud Functions
A1.1.3.21Checks if Google Cloud firewall rules allow unrestricted ingress traffic for SSH (port 22) and RDP (port 3389). The rule is NON_COMPLIANT if a firewall rule allows ingress traffic from any source IP range (0.0.0.0/0) for those ports.2
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Firewall
A1.1.3.22Checks if a Google Cloud Platform (GCP) firewall policy is configured with a user-defined 'default action' for fragmented packets. The rule is NON_COMPLIANT if the default action for fragmented packets does not match the user-defined default action.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Firewall
A1.1.3.23Check GCP Firewall Rule is associated with ingress or egress rules. This rule is NON_COMPLIANT if no ingress or egress rules are associated with the Firewall Rule, else COMPLIANT if any one of the rule types exists.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Firewall
A1.1.3.24Checks if a Google Cloud Platform (GCP) Firewall Rule contains rules. The rule is NON_COMPLIANT if there are no rules in a GCP Firewall Rule.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Firewall
A1.1.3.25Checks if there are public routes in the route table to a Cloud Router or Cloud NAT. The rule is NON_COMPLIANT if a route to a Cloud Router or Cloud NAT has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Networking
A1.1.3.26Checks if Google Cloud Elasticsearch (GCE) clusters are within a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch cluster endpoint is public.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Elasticsearch (GCE)
A1.1.3.27Checks if there are any Google Cloud SQL database instances that are not using the default Cloud SQL service account. The rule is NON_COMPLIANT if there are any Cloud SQL instances that are not using the default service account.4
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud SQL
A1.1.3.28Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipAddresses' field contains a public IP address.4
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud SQL
A1.1.3.29Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset's access control configuration allows public access.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
BigQuery
A1.1.3.30Checks if Google Cloud Storage (GCS) buckets have uniform bucket-level access enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.3
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.3.31Checks if the required public access options are configured at the project level in Google Cloud Platform (GCP). The rule is only NON_COMPLIANT when the public access settings do not match the configured settings.4
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.3.32Checks if the required public access prevention settings are configured at the project level in Google Cloud Platform. The rule is NON_COMPLIANT if the configuration does not match one or more settings from parameters (or default).3
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Cloud Storage
A1.1.3.33Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket does not meet the exclusion criteria and has bucket-level permissions that allow public access.3
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.3.34Checks if your Google Cloud Storage buckets do not allow public read access. The rule verifies the Uniform Bucket-Level Access settings, the bucket IAM policies, and the bucket permissions.3
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.3.35Checks if your Google Cloud Storage buckets do not allow public write access by evaluating the Bucket IAM policies and public access prevention settings.2
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Storage
A1.1.3.36Checks if a Google AI Platform Notebooks instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google AI Platform Notebooks
A1.1.3.37Checks if direct internet access is disabled for a Google Cloud AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud AI Platform
A1.1.3.38Checks if Private Service Access for the service specified in the rule parameter is configured for each Google Cloud VPC. The rule is NON_COMPLIANT if a Google Cloud VPC doesn't have a Private Service Access configured for the service.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud VPC
A1.1.3.39Checks if there are unused firewall rules in Google Cloud. The rule is COMPLIANT if each firewall rule is associated with a network. The rule is NON_COMPLIANT if a firewall rule is not associated with a network.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud VPC Firewall Rules
A1.1.3.40Checks if Google Cloud Firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.2
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Firewall
A1.1.3.41Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if there are no rules present within the security policy.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Armor
A1.1.3.42Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Google Cloud Armor security policy.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Armor
A1.1.3.43Verifies if a Google Cloud Armor Security Policy contains any firewall rules or rule groups. The policy is considered NON_COMPLIANT if it does not include any security rules or rule groups.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Armor
A1.1.3.44Checks if Cloud Armor security policy rule groups contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor security policy rule group.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Cloud Armor
A1.1.3.45Checks whether the Google Cloud Armor security policy contains rules with conditions. The rule is COMPLIANT if the security policy contains at least one rule with conditions and NON_COMPLIANT otherwise.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Armor
A1.1.3.46Checks if a GCP Cloud Armor Security Policy contains any rules. The rule is NON_COMPLIANT if there are no security rules present within a Cloud Armor Security Policy.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Google Cloud Armor
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.3645
A1.2.1.1Checks if Google Cloud Endpoints services have access logging enabled. The rule is NON_COMPLIANT if 'accessLogSettings' is not present in the service configuration.2
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Endpoints
A1.2.1.2Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither ERROR nor INFO.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Endpoints
A1.2.1.3Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Endpoints
A1.2.1.4Checks if a Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled or the 'logLevel' is neither ERROR nor ALL.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud API Gateway
A1.2.1.5Checks if Google Cloud Load Balancers are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if the Load Balancer's Desync mitigation mode does not match the user-defined Desync mitigation mode.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Load Balancing
A1.2.1.6Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.2
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud CDN
A1.2.1.7Checks if at least one Google Cloud Audit logging configuration is logging read and write events for all Google Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs configured to record Cloud Storage data events.4
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Storage
A1.2.1.8Checks that there is at least one Google Cloud Audit Logging enabled for a project with security best practices. This rule is COMPLIANT if there is at least one audit log configuration that meets all of the following criteria.2
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Logging
A1.2.1.9Checks if Google Cloud Logging Log Buckets are encrypted with any Google Cloud KMS key or a specified Google Cloud KMS key Id. The rule is NON_COMPLIANT if a Log Bucket is not encrypted with a KMS key or is encrypted with a KMS key not supplied in the rule parameter.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Logging
A1.2.1.10In GCP, the equivalent for enabling CloudTrail is enabling Cloud Audit Logs, which tracks API activity for projects and services.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Cloud Audit Logs
A1.2.1.11Checks if Google Cloud Logging is configured to use Cloud Key Management Service (Cloud KMS) encryption. The rule is COMPLIANT if the KmsKeyId is defined.2
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Logging
A1.2.1.12Checks if Google Cloud Audit Logs have integrity validation enabled. Google Cloud recommends that integrity validation should be enabled for all audit logs to ensure their authenticity. The rule is NON_COMPLIANT if the validation is not enabled.2
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Cloud Audit Logging
A1.2.1.13Checks if a Google Cloud Build configuration has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present logging configurations is set to 'DISABLED'.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Build
A1.2.1.14Checks if logging is enabled with a valid severity level for GCP Data Migration Service replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Data Migration Service
A1.2.1.15Checks if a Google Cloud Firestore (NoSQL document database) instance has Cloud Logging export enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Cloud Logging export enabled for audit logs.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Firestore
A1.2.1.16Checks if Google Cloud VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'logging.enabled' is set to false.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud VPN
A1.2.1.17Checks if logging is configured on active Google Cloud Run services. This rule is NON_COMPLIANT if an active service does not have logging enabled or the logging configuration is not set for at least one revision.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Run
A1.2.1.18Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Kubernetes Engine (GKE)
A1.2.1.19Checks if Google Cloud App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud App Engine
A1.2.1.20Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the 'logging' property is false or the 'logBucket' is not equal to the provided bucket name.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Load Balancer
A1.2.1.21Checks if Google Cloud Pub/Sub subscriptions have Cloud Logging enabled. The rule is NON_COMPLIANT if a subscription does not have logging enabled.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Pub/Sub
A1.2.1.22Checks if a Google Cloud Pub/Sub subscription has logging enabled. The rule is NON_COMPLIANT if the subscription does not have logging enabled.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Pub/Sub
A1.2.1.23In GCP, the equivalent of enabling multi-region logging is to ensure that Cloud Logging is set up to collect logs from multiple regions. This ensures that logs are stored and accessible across different geographical locations.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Logging
A1.2.1.24Checks if a Google Cloud Spanner instance has Stackdriver Logging enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have Stackdriver Logging enabled for audit logs.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Spanner
A1.2.1.25Checks if Google Cloud Platform (GCP) firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured. You can specify which logging type you want the rule to check.4
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Firewall
A1.2.1.26Checks if Google Cloud SQL instances for MySQL are configured to log audit logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log publishing configured.4
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud SQL
A1.2.1.27Checks if the respective logs of Cloud SQL for PostgreSQL or MySQL are enabled. The rule is NON_COMPLIANT if any log types (like general logs, slow query logs, or audit logs) are not enabled.4
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Cloud SQL
A1.2.1.28Checks if Google BigQuery datasets have audit logging enabled to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google BigQuery
A1.2.1.29Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if the dataset does not have audit logging enabled.2
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
BigQuery
A1.2.1.30Checks if DNS query logging is enabled for your Google Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS managed zones.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud DNS
A1.2.1.31Checks if Google Cloud Storage (GCS) buckets are publicly accessible. The rule is NON_COMPLIANT if a GCS bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.2
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Storage
A1.2.1.32Checks if logging is enabled for your Cloud Storage buckets in GCP. The rule is NON_COMPLIANT if logging is not enabled.3
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Cloud Storage
A1.2.1.33Checks if Google Cloud Workflow has logging enabled. The rule is NON_COMPLIANT if a Cloud Workflow does not have logging enabled or the logging configuration is not at the minimum level provided.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Workflows
A1.2.1.34Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.3
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud VPC
A1.2.1.35Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the specified value.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Armor
A1.2.1.36Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy, if it does not have logging enabled.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud Armor
A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers.11
A1.2.3.1Checks if you have provided security contact information for your Google Cloud Platform project. The rule is NON_COMPLIANT if security contact information within the project is not provided.1
Attributes
- Section
A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Google Cloud IAM (Identity and Access Management)
A3.2.5.1: PCI DSS scope is documented and validated.20
A3.2.5.1.1Checks if automated sensitive data discovery is enabled for Google Cloud Data Loss Prevention (DLP). The rule is NON_COMPLIANT if automated sensitive data discovery is disabled. The rule is APPLICABLE for administrator accounts and NOT_APPLICABLE for member accounts.0
Attributes
- Section
A3.2.5.1: PCI DSS scope is documented and validated.
- Service
Google Cloud DLP
A3.2.5.1.2Checks if Google Cloud Data Loss Prevention (DLP) is enabled in your project. The rule is NON_COMPLIANT if the 'status' attribute is not set to 'ENABLED'.0
Attributes
- Section
A3.2.5.1: PCI DSS scope is documented and validated.
- Service
Google Cloud Data Loss Prevention (DLP)
A3.2.5.2: PCI DSS scope is documented and validated.20
A3.2.5.1.3Checks if automated sensitive data discovery is enabled for Google Cloud Data Loss Prevention (DLP). The rule is NON_COMPLIANT if automated sensitive data discovery is disabled. The rule is APPLICABLE for administrator accounts and NOT_APPLICABLE for member accounts.0
Attributes
- Section
A3.2.5.2: PCI DSS scope is documented and validated.
- Service
Google Cloud Data Loss Prevention (DLP)
A3.2.5.1.4Checks if Google Cloud Data Loss Prevention (DLP) is enabled in your project. The rule is NON_COMPLIANT if the DLP API is not enabled.0
Attributes
- Section
A3.2.5.2: PCI DSS scope is documented and validated.
- Service
Google Cloud DLP
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.115
A3.3.1.1Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Cloud Trace
A3.3.1.2Checks if your Google Cloud Deployment Manager configurations send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager configurations do not send notifications.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Cloud Deployment Manager
A3.3.1.3Checks if Google Cloud Monitoring alert policies have notification channels configured for the 'ALERTING', 'PENDING', or 'DISABLED' states. Optionally checks if any channels match a specified notification channel ID. The rule is NON_COMPLIANT if there is no notification channel specified for the alert policy or optional parameter.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Cloud Monitoring
A3.3.1.4Checks if a resource type has a Cloud Monitoring alert policy for the specified metric. For resource types, you can specify Persistent Disks, Compute Engine instances, Cloud SQL instances, or Cloud Storage buckets. The rule is COMPLIANT if the specified metric has a resource ID and a Cloud Monitoring alert policy.2
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Cloud Monitoring
A3.3.1.5Checks whether Google Cloud Monitoring alerts with the given metric name have the specified settings.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Cloud Monitoring
A3.3.1.6Checks if Google Cloud Audit Logs are configured to send logs to Google Cloud Logging. The audit logging is NON_COMPLIANT if the log sink is not properly set up or is not sending the audit logs to Google Cloud Logging.3
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Cloud Logging
A3.3.1.7Checks if Stackdriver Monitoring is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if Stackdriver Monitoring is not enabled.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Compute Engine
A3.3.1.8Checks if Google Cloud Storage (GCS) Notifications are enabled on a GCS bucket. The rule is NON_COMPLIANT if GCS Notifications are not set on a bucket, or if the event type or destination do not match specified event types and destination parameters.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Cloud Storage
A3.3.1.9Checks if Google Cloud Security Command Center is enabled for a Google Cloud project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Cloud Security Command Center
A3.3.1.10Checks if Google Cloud Pub/Sub logging is enabled for delivery status of messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Cloud Pub/Sub
A3.3.1.11Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'enableMonitoring' field is set to false.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Google Cloud Armor
A3.4.1: Logical access to the cardholder data environment is controlled and managed.2526
A3.4.1.1Checks if a Cloud Storage bucket has an attached IAM policy which prevents deletion of objects. The rule is NON_COMPLIANT if the Cloud Storage bucket does not have IAM policies or has policies without a suitable 'Deny' statement (statement with storage.objects.delete permission).0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Storage
A3.4.1.2Checks if Google Cloud Database Migration Service (Cloud DMS) connection profiles are public. The rule is NON_COMPLIANT if the 'public' property is set to true.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Cloud Database Migration Service
A3.4.1.3Checks if Google Cloud Firestore database snapshots are public. The rule is NON_COMPLIANT if any Firestore database snapshots are public.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Firestore
A3.4.1.4Checks if Google Cloud Persistent Disk snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots have permissions that allow public access, indicating that Google Cloud Persistent Disk snapshots are public.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Compute Engine
A3.4.1.5Checks if Google Kubernetes Engine (GKE) Containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the securityContext.privileged parameter in the container specification is set to 'false' or the readOnlyRootFilesystem parameter is not set to 'true'.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Kubernetes Engine (GKE)
A3.4.1.6Checks if Google Cloud Filestore instances are configured to enforce a root directory. The rule is NON_COMPLIANT if the root path is accessible without restrictions.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Filestore
A3.4.1.7Checks if Google Cloud Filestore access control is configured to enforce a user identity. The rule is NON_COMPLIANT if 'identity' is not defined or if parameters are provided and there is no match in the corresponding parameter.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Filestore
A3.4.1.8Checks if a Google Cloud account has block public access settings enabled. The rule is NON_COMPLIANT if 'BlockPublicAccess' is false, or if true, firewall rules allowing traffic on ports other than Port 22 are listed in 'AllowedFirewallRules'.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Firewalls
A3.4.1.9Checks if IAM groups in Google Cloud have at least one IAM user assigned.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Identity and Access Management (IAM)
A3.4.1.10Checks if your Google Cloud IAM users have passwords or active access keys that have not been used within the specified number of days you provided. The rule is NON_COMPLIANT if there are inactive accounts not recently used.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud IAM
A3.4.1.11Checks if the Google Cloud Functions IAM policy attached to the Cloud Function prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Functions
A3.4.1.12Checks if a Google Cloud SQL instance snapshot is public. The rule is NON_COMPLIANT if any existing and new Cloud SQL instance snapshots are public.2
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud SQL
A3.4.1.13Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'publicIp' field is enabled in the instance configuration.4
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud SQL
A3.4.1.14Checks if Google Cloud SQL backups are public. The rule is NON_COMPLIANT if any existing and new Google Cloud SQL backups are public.3
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud SQL
A3.4.1.15Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset's defaultAccessEntry has a role of 'READER' granted to 'allUsers'.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
BigQuery
A3.4.1.16Checks if Google Cloud Storage bucket IAM policies have public access prevention settings enabled. The rule is NON_COMPLIANT if public access prevention settings are not enabled for Google Cloud Storage buckets.4
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Storage
A3.4.1.17Verifies that the required public access prevention settings are configured at the project level. The status is considered NON_COMPLIANT when the specified settings do not match the corresponding fields in the project configuration.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Storage
A3.4.1.18Checks if the required public access prevention settings are configured at the project level. The rule is NON_COMPLIANT if the configuration item does not match one or more settings from parameters (or default).0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Storage (GCS)
A3.4.1.19Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and the bucket's permissions settings allow public access.3
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Storage
A3.4.1.20Checks if Object Versioning is enabled and if it requires additional authentication for critical actions in Google Cloud Storage buckets. The rule is NON_COMPLIANT if additional authentication is not required.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Storage
A3.4.1.21Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Uniform Bucket-Level Access settings, the bucket policy, and the bucket access control list (ACL).2
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Storage
A3.4.1.22Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform bucket-level access settings, the bucket IAM policies, and the bucket access control list (ACL).2
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Storage
A3.4.1.23Checks if direct internet access is disabled for a Google Cloud AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud AI Platform Notebooks
A3.4.1.24Checks if Google Cloud Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Secret Manager
A3.4.1.25Checks if Google Cloud Compute Engine instance templates owned by the account are public. The rule is NON_COMPLIANT if instance templates with the owner 'Self' are set to allow public access.3
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Google Cloud Compute Engine
A3.5.1: Suspicious events are identified and responded to.114
A3.5.1.1Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Endpoints
A3.5.1.2Checks if your Google Cloud deployments (using Deployment Manager) send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager deployments do not send notifications.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Deployment Manager
A3.5.1.3Checks if Cloud Monitoring alerts have notification channels configured for ALERTING, PENDING, or NO_DATA states. Optionally checks if any notification channels match a specific resource name (ARN). The rule is NON_COMPLIANT if there is no action specified for the alert or optional parameter.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Cloud Monitoring
A3.5.1.4Checks if a Google Cloud resource type has a Google Cloud Monitoring alert policy for the specified metric. For resource types, you can specify Compute Engine instances, Cloud Storage buckets, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the specified metric has a resource ID and an alert policy.1
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Monitoring
A3.5.1.5Checks whether Google Cloud Monitoring alerts with the given metric name have the specified settings.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Monitoring
A3.5.1.6Checks if Google Cloud Audit Logging is configured to send logs to Cloud Logging. The audit log configuration is NON_COMPLIANT if the log sink is not properly set to export logs.3
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Logging
A3.5.1.7Checks if Stackdriver Monitoring is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if Stackdriver Monitoring is not enabled.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Monitoring
A3.5.1.8Checks if Google Cloud Storage (GCS) notifications are enabled on a GCS bucket. The rule is NON_COMPLIANT if GCS notifications are not set on a bucket, or if the event type or destination do not match the specified event types and destination parameters.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Storage
A3.5.1.9Checks if Google Cloud Security Command Center is enabled for a Google Cloud Project. The rule is NON_COMPLIANT if Security Command Center is not enabled.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Security Command Center
A3.5.1.10Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Pub/Sub
A3.5.1.11Checks if Google Cloud Monitoring (formerly Stackdriver) security metrics collection on Google Cloud Armor rule sets is enabled. The rule is NON_COMPLIANT if the 'enableMonitoring' field is set to false.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Google Cloud Armor