From 027a5705cb8ec76768b5e9912265f08ae39f3fa4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= Date: Fri, 21 Feb 2025 11:49:20 +0100 Subject: [PATCH] feat(gcp): add PCI DSS 4.0 (#7010) --- dashboard/compliance/pci_4_0_gcp.py | 23 + prowler/compliance/gcp/pci_4.0_gcp.json | 22315 ++++++++++++++++ .../compliance/generic/generic_table.py | 2 +- 3 files changed, 22339 insertions(+), 1 deletion(-) create mode 100644 dashboard/compliance/pci_4_0_gcp.py create mode 100644 prowler/compliance/gcp/pci_4.0_gcp.json diff --git a/dashboard/compliance/pci_4_0_gcp.py b/dashboard/compliance/pci_4_0_gcp.py new file mode 100644 index 0000000000..c81617efc2 --- /dev/null +++ b/dashboard/compliance/pci_4_0_gcp.py @@ -0,0 +1,23 @@ +import warnings + +from dashboard.common_methods import get_section_containers_format3 + +warnings.filterwarnings("ignore") + + +def get_table(data): + aux = data[ + [ + "REQUIREMENTS_ID", + "REQUIREMENTS_ATTRIBUTES_SECTION", + "REQUIREMENTS_DESCRIPTION", + "CHECKID", + "STATUS", + "REGION", + "ACCOUNTID", + "RESOURCEID", + ] + ] + return get_section_containers_format3( + aux, "REQUIREMENTS_ATTRIBUTES_SECTION", "REQUIREMENTS_ID" + ) diff --git a/prowler/compliance/gcp/pci_4.0_gcp.json b/prowler/compliance/gcp/pci_4.0_gcp.json new file mode 100644 index 0000000000..aeda437abc --- /dev/null +++ b/prowler/compliance/gcp/pci_4.0_gcp.json @@ -0,0 +1,22315 @@ +{ + "Framework": "PCI", + "Version": "4.0", + "Provider": "GCP", + "Description": "The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard. It's administered by the PCI Security Standards Council, which was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc. PCI DSS applies to entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD). This includes, but isn't limited to, merchants, processors, acquirers, issuers, and service providers. The PCI DSS is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.", + "Requirements": [ + { + "Id": "1.2.5.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP(S) Load Balancers. The rule is NON_COMPLIANT if one or more HTTP(S) Load Balancers do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP(S) Load Balancers have forwarding to an HTTP backend instead of redirection.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.2.5.2", + "Description": "Checks if Google Cloud CDN is using deprecated SSL protocols for HTTPS communication between CDN edge locations and custom origins. This rule is NON_COMPLIANT for a Google Cloud CDN configuration if any 'OriginSslProtocols' includes 'SSLv3'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.2.5.3", + "Description": "Checks if Google Cloud CDN configurations are using a minimum security policy and cipher suite of TLSv1.2 or greater for viewer connections. This rule is NON_COMPLIANT for a Cloud CDN configuration if the minimumTlsVersion is below TLSv1.2.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.2.5.4", + "Description": "Checks if Google Cloud CDN is using a custom SSL certificate and is configured to use SNI for serving HTTPS requests. The rule is NON_COMPLIANT if a custom SSL certificate is associated but the SSL support method uses a dedicated IP address.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.2.5.5", + "Description": "Checks if Google Cloud CDN configurations are encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'originProtocol' is 'HTTP_ONLY' or if 'originProtocol' is 'MATCH_VIEWER' and 'viewerProtocol' is 'ALLOW_ALL'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.2.5.6", + "Description": "Checks if your Google Cloud CDN configurations enforce HTTPS. The rule is NON_COMPLIANT if the value of `enableOnRedirect` is set to 'true' for the backend service, which indicates that HTTPS is allowed without any restrictions.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.2.5.7", + "Description": "Check if Google Cloud's Managed Service for Elasticsearch nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the cluster.", + "Name": "Google Cloud Managed Service for Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Managed Service for Elasticsearch" + } + ] + }, + { + "Id": "1.2.5.8", + "Description": "Checks whether your Google Cloud HTTP(S) Load Balancer SSL proxy is using a custom SSL policy. The rule is only applicable if there are SSL proxies for the Google Cloud HTTP(S) Load Balancer.", + "Name": "Google Cloud HTTP(S) Load Balancer", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud HTTP(S) Load Balancer" + } + ] + }, + { + "Id": "1.2.5.9", + "Description": "Checks if your Google Cloud Platform HTTPS Load Balancer SSL proxy uses a predefined policy. The rule is NON_COMPLIANT if the HTTPS SSL proxy listener's policy does not equal the value of the parameter 'predefinedPolicyName'.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.2.5.10", + "Description": "Checks if your Google Cloud HTTP(S) Load Balancer is configured with SSL or HTTPS. The rule is NON_COMPLIANT if a listener is not configured with SSL or HTTPS.", + "Name": "Google Cloud HTTP(S) Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud HTTP(S) Load Balancing" + } + ] + }, + { + "Id": "1.2.5.11", + "Description": "Checks if Google Cloud Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or the security configuration does not satisfy the specified rule parameters.", + "Name": "Google Cloud Dataproc", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Dataproc" + } + ] + }, + { + "Id": "1.2.5.12", + "Description": "Checks whether connections to Google Cloud Elasticsearch (GCP equivalent of OpenSearch) are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Elasticsearch domain 'EnforceHttps' is not 'true' or is 'true' and 'TlsSecurityPolicy' is not in 'tlsPolicies'.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "1.2.5.13", + "Description": "Check if Google Cloud's Elasticsearch Service (part of Google Cloud operations suite) nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the cluster.", + "Name": "Google Cloud Elasticsearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Elasticsearch Service" + } + ] + }, + { + "Id": "1.2.5.14", + "Description": "Checks if Google BigQuery datasets require TLS/SSL encryption to connect to SQL clients. The rule is NON_COMPLIANT if any BigQuery dataset has the parameter require_ssl not set to true.", + "Name": "BigQuery", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "1.2.5.15", + "Description": "Checks if Cloud Storage buckets have IAM policies that require requests to use HTTPS. The rule is NON_COMPLIANT if any Cloud Storage bucket has policies allowing HTTP requests.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.2.5.16", + "Description": "Checks if a Cloud Storage bucket created with Google Cloud Storage uses the 'gs' protocol for endpoint connection. The rule is NON_COMPLIANT if the bucket protocol for endpoint connection supports 'gs'.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.2.5.17", + "Description": "Checks if Google Cloud firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.2.8.1", + "Description": "Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter backendServiceType. The rule returns NON_COMPLIANT if the API does not match the backend type configured in the rule parameter.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.2.8.2", + "Description": "Checks if a Google Cloud Endpoints service uses an SSL certificate. The rule is NON_COMPLIANT if the Google Cloud Endpoints service does not have an associated SSL certificate.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.2.8.3", + "Description": "Checks if Google Cloud APIs (specifically Google Cloud Endpoints or API Gateway) are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud API if it is not associated with a security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.2.8.4", + "Description": "Checks if Google Cloud CDN distributions are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN distribution is not associated with a Cloud Armor security policy.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.2.8.5", + "Description": "Checks if the certificate associated with a Google Cloud CDN service is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN service uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.2.8.6", + "Description": "Checks if the Cloud Source Repositories URL contains sign-in credentials. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.", + "Name": "Cloud Source Repositories", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Cloud Source Repositories" + } + ] + }, + { + "Id": "1.2.8.7", + "Description": "Checks if Google Cloud Database Migration Service (Google Cloud DMS) replication instances are public. The rule is NON_COMPLIANT if the 'public' field is set to true.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "1.2.8.8", + "Description": "Checks if Google Cloud Firestore backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore backups are public.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "1.2.8.9", + "Description": "Checks if the Google Cloud VPN authorization rules authorize connection access for all clients. The rule is NON_COMPLIANT if 'AccessAll' is present and set to true.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "1.2.8.10", + "Description": "Checks if the status of Google Cloud's Config Connector compliance is COMPLIANT or NON_COMPLIANT after the resource configuration execution on the instance. The rule is compliant if the field status is COMPLIANT.", + "Name": "Google Cloud Config Connector", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Config Connector" + } + ] + }, + { + "Id": "1.2.8.11", + "Description": "Checks if Google Cloud Platform (GCP) VPC Network Peering has 'AutoAcceptSharedAttachments' enabled. The rule is NON_COMPLIANT for a VPC Network Peering if 'AutoAcceptSharedAttachments' is set to 'enable'.", + "Name": "Google Cloud VPC Network Peering", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud VPC Network Peering" + } + ] + }, + { + "Id": "1.2.8.12", + "Description": "Checks if the Google Kubernetes Engine (GKE) endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "1.2.8.13", + "Description": "Checks if Google Cloud Elasticsearch (part of Google Cloud's operations tools) clusters are configured within a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch cluster endpoint is accessible publicly.", + "Name": "Google Cloud Elasticsearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Elasticsearch Service" + } + ] + }, + { + "Id": "1.2.8.14", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers have backend services configured with SSL certificates from Google-managed SSL certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service configured without a Google-managed SSL certificate or is configured with a certificate different from a Google-managed SSL certificate.", + "Name": "Google Cloud HTTP(S) Load Balancer", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud HTTP(S) Load Balancer" + } + ] + }, + { + "Id": "1.2.8.15", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure that your Load Balancer is configured with an SSL or HTTPS proxy. This rule is applicable to External HTTPS Load Balancers only. This rule does not check Internal Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.2.8.16", + "Description": "Checks if a Google Cloud Platform account has public access settings enabled for a Google Dataproc cluster. The rule is NON_COMPLIANT if PublicAccessPrevention is false, or if true, firewall rules allowing access on ports other than Port 22 are configured.", + "Name": "Google Dataproc", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Dataproc" + } + ] + }, + { + "Id": "1.2.8.17", + "Description": "Google Cloud Platform (GCP) does not have a direct equivalent of this rule, but a similar approach can be achieved by configuring firewall rules to restrict incoming SSH (port 22) access, thus effectively disabling incoming SSH connections similarly to the INCOMING_SSH_DISABLED rule in other systems. The service involved is Google Cloud Firewall.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.2.8.18", + "Description": "Checks if Cloud NAT gateways are attached to an authorized Google Cloud Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if Cloud NAT gateways are attached to an unauthorized VPC.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.2.8.19", + "Description": "Checks if the Cloud Function IAM policy attached to the Cloud Function resource prohibits public access. If the IAM policy allows public access, it is NON_COMPLIANT.", + "Name": "Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Cloud Functions" + } + ] + }, + { + "Id": "1.2.8.20", + "Description": "Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.", + "Name": "Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Cloud Functions" + } + ] + }, + { + "Id": "1.2.8.21", + "Description": "Checks if firewall rules for SSH (port 22) and RDP (port 3389) ingress traffic in Google Cloud Platform are unrestricted. The rule is NON_COMPLIANT if a firewall rule allows any source IP for these ports.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.2.8.22", + "Description": "Checks if a GCP Firewall Rule is configured with a user-defined action for fragmented packets. The rule is NON_COMPLIANT if the specified action for fragmented packets does not match the user-defined action.", + "Name": "Google Cloud Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.2.8.23", + "Description": "Check if GCP's VPC Service Controls security policies are associated with stateful or stateless rules. This rule is NON_COMPLIANT if no stateful or stateless rules are associated with the VPC Service Controls policy; else COMPLIANT if any one of the rule types exists.", + "Name": "VPC Service Controls", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "VPC Service Controls" + } + ] + }, + { + "Id": "1.2.8.24", + "Description": "Checks if a Google Cloud Platform (GCP) Firewall Rule contains rules. The rule is NON_COMPLIANT if there are no rules in a Firewall Rule.", + "Name": "Google Cloud Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.2.8.25", + "Description": "Checks if there are public routes in the Google Cloud Platform (GCP) VPC subnet route table that point to a Cloud Router or NAT Gateway. The rule is NON_COMPLIANT if a route to an Internet Gateway (IGW) has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.2.8.26", + "Description": "Checks if Google Cloud Search instances are in a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Cloud Search instance endpoint is public.", + "Name": "Google Cloud Search", + "Checks": [ + "compute_instance_public_ip" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "1.2.8.27", + "Description": "Checks if there are any Google Cloud SQL instance firewall rules that are not the default firewall rules. The rule is NON_COMPLIANT if there are any firewall rules that are not the default firewall rules.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.2.8.28", + "Description": "Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'IPConfiguration.requireSSL' field is false and 'IPConfiguration.ipv4Enabled' is true in the instance configuration.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.2.8.29", + "Description": "Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset access configuration allows public access.", + "Name": "BigQuery", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "1.2.8.30", + "Description": "Checks if Google Cloud Storage access points have block public access settings enabled. The rule is NON_COMPLIANT if block public access settings are not enabled for Cloud Storage access points.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.2.8.31", + "Description": "Checks if the required public access prevention settings are configured at the project level. The rule is only NON_COMPLIANT when the fields set below do not match the corresponding fields in the project settings.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.2.8.32", + "Description": "Checks if the required public access prevention settings are configured at the project level in Google Cloud Platform. The rule is NON_COMPLIANT if the configuration does not match the specified settings or defaults.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudsql_instance_public_access", + "compute_instance_public_ip" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.2.8.33", + "Description": "Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and the bucket-level settings allow public access.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.2.8.34", + "Description": "Checks if your Google Cloud Storage buckets do not allow public read access. The rule examines the bucket IAM policies, uniform bucket-level access settings, and object-level permissions.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.2.8.35", + "Description": "Checks if your Google Cloud Storage buckets do not allow public write access by evaluating the Bucket IAM policies, Uniform bucket-level access, and the bucket ACL settings.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.2.8.36", + "Description": "Checks if a Google Cloud AI Notebook instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.", + "Name": "Google Cloud AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud AI Platform Notebooks" + } + ] + }, + { + "Id": "1.2.8.37", + "Description": "Checks if direct internet access is disabled for a Google AI Platform (formerly AI Platform Notebooks) instance. The rule is NON_COMPLIANT if an AI Platform notebook instance is internet-enabled.", + "Name": "Google AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google AI Platform" + } + ] + }, + { + "Id": "1.2.8.38", + "Description": "Checks if a Private Google Access Point is created for each Google Virtual Private Cloud (Google VPC). The rule is NON_COMPLIANT if a Google VPC doesn't have a Private Google Access Point created for the service.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.2.8.39", + "Description": "Checks if there are unused VPC Firewalls (equivalent to network ACLs). The rule is COMPLIANT if each VPC Firewall rule is associated with a subnet. The rule is NON_COMPLIANT if a VPC Firewall rule is not associated with a subnet.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.2.8.40", + "Description": "Checks if Private Google Access is enabled for the VPC in GCP. The rule is NON_COMPLIANT if Private Google Access is not enabled for the VPC, as it is necessary for Google services to communicate with private IPs.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.2.8.41", + "Description": "Checks if Google Cloud firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.", + "Name": "Google Cloud Compute Engine", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "1.2.8.42", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.2.8.43", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.2.8.44", + "Description": "Checks whether a Google Cloud Armor Security Policy contains any rules. This rule is NON_COMPLIANT if a Security Policy does not contain any rules.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.2.8.45", + "Description": "Checks if Google Cloud Armor security policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Google Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.2.8.46", + "Description": "Checks whether Google Cloud Armor security policy contains rules with conditions. This rule is COMPLIANT if at least one rule within the security policy contains conditions and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.2.8.47", + "Description": "Checks if a Google Cloud Armor Security Policy contains any security rules. The rule is NON_COMPLIANT if there are no security rules present within a Security Policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.1.1", + "Description": "Checks if a Google Cloud API Gateway API configuration is using Google Cloud Armor for security. The rule is NON_COMPLIANT if Google Cloud Armor is not used or if the utilized security policies do not match the specified rule parameters.", + "Name": "Google Cloud API Gateway / Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud API Gateway / Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.1.2", + "Description": "Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.3.1.3", + "Description": "Checks if an API Gateway configuration has an SSL certificate associated with it. The rule is NON_COMPLIANT if the API Gateway does not have an associated SSL certificate.", + "Name": "API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "API Gateway" + } + ] + }, + { + "Id": "1.3.1.4", + "Description": "Checks if Google Cloud Endpoints APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud Endpoints API if it is not associated with a security policy.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.3.1.5", + "Description": "Checks if Google Cloud CDN (Content Delivery Network) is associated with either Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN is not associated with a Google Cloud Armor security policy.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.3.1.6", + "Description": "Checks if the SSL certificate associated with a Google Cloud CDN service is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN service uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.3.1.7", + "Description": "Checks if the Google Cloud Source Repositories URL contains sign-in credentials or not. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.", + "Name": "Google Cloud Source Repositories", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Source Repositories" + } + ] + }, + { + "Id": "1.3.1.8", + "Description": "Checks if Google Cloud Database Migration Service (GCP DMS) connection profiles are public. The rule is NON_COMPLIANT if the 'public' field is set to true.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "1.3.1.9", + "Description": "Checks if Google Cloud Firestore (Firestore) exports are public. The rule is NON_COMPLIANT if any Firestore exports are public.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "1.3.1.10", + "Description": "Checks if the Google Cloud VPN authorization policy allows connection access for all clients. The rule is NON_COMPLIANT if 'AccessAll' is present and set to true.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "1.3.1.11", + "Description": "Checks if the status of the Google Cloud Configuration Management compliance is COMPLIANT or NON_COMPLIANT after the configuration execution on the VM instance. The rule is compliant if the field status is COMPLIANT. For more information about configurations, see What is a configuration?", + "Name": "Google Cloud Configuration Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Configuration Management" + } + ] + }, + { + "Id": "1.3.1.12", + "Description": "Checks if Google Cloud Platform (GCP) VPC Network Peering has 'AutoAcceptSharedAttachments' enabled. The rule is NON_COMPLIANT for a VPC Network Peering if 'AutoAcceptSharedAttachments' is set to 'enable'.", + "Name": "Google Cloud Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "1.3.1.13", + "Description": "Checks if the Google Kubernetes Engine (GKE) endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "1.3.1.14", + "Description": "Checks if Google Cloud Memorystore for Redis instances are configured with a custom VPC network. The rule is NON_COMPLIANT for a Memorystore instance if it is using the default VPC network.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "1.3.1.15", + "Description": "Checks if Google Cloud Elasticsearch Service (part of Google Cloud's managed services) instances are within a Virtual Private Cloud (VPC) network. The rule is NON_COMPLIANT if an Elasticsearch Service instance endpoint is public.", + "Name": "Google Cloud Elasticsearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Elasticsearch Service" + } + ] + }, + { + "Id": "1.3.1.16", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers are configured to use certificates from Google Cloud Managed Certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 listener that is configured without a Google-managed certificate or is configured with a certificate different from Google-managed certificates.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.3.1.17", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, a frontend configuration with SSL should be set on your Classic Load Balancer. This rule is only applicable to Classic Load Balancers in GCP and does not apply to HTTP(S) Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.3.1.18", + "Description": "Checks if a Google Cloud account with Dataproc has block public access settings enabled. The rule is NON_COMPLIANT if BlockPublicHttps is false, or if true, there are firewall rules that allow traffic on ports other than Port 22 from the internet.", + "Name": "Dataproc", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Dataproc" + } + ] + }, + { + "Id": "1.3.1.19", + "Description": "The rule identifier 'INCOMING_SSH_DISABLED' indicates that incoming SSH connections are disabled, whereas the rule name 'restricted-ssh' implies a policy to restrict SSH access. In GCP, this can be achieved by using a firewall rule that denies incoming traffic on port 22 (the default SSH port).", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.3.1.20", + "Description": "In Google Cloud Platform, the equivalent of EC2 instances in a VPC is Compute Engine instances within a Virtual Private Cloud (VPC). The rule identifier for VPC configuration in GCP can vary, but the service utilized is primarily Google Compute Engine.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "1.3.1.21", + "Description": "Checks if Cloud NAT is configured for an authorized Google Cloud Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if Cloud NAT is configured for an unauthorized VPC.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.3.1.22", + "Description": "Checks if the Google Cloud Function IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access, it is NON_COMPLIANT.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "1.3.1.23", + "Description": "Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.", + "Name": "Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Cloud Functions" + } + ] + }, + { + "Id": "1.3.1.24", + "Description": "Checks if firewall rules for SSH (port 22) and RDP (port 3389) ingress traffic in Google Cloud Platform (GCP) allow unrestricted access. The rule is NON_COMPLIANT if a firewall rule allows ingress traffic from any source IP (0.0.0.0/0) for ports 22 or 3389.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.3.1.25", + "Description": "Checks if a Google Cloud VPC firewall rule is configured with a user-defined action for fragmented packets. The rule is NON_COMPLIANT if the action for fragmented packets does not match the user-defined default action.", + "Name": "Google Cloud VPC Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC Firewall" + } + ] + }, + { + "Id": "1.3.1.26", + "Description": "Check Google Cloud Armor security policy is associated with backend services, as this rule is NON_COMPLIANT if no backend services are associated with the Google Cloud Armor policy, otherwise COMPLIANT if any backend service exists.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.1.27", + "Description": "In GCP, checks if a Google Cloud Armor Security Policy contains any rules. The policy is CONFORMANT if there are rules defined within the Google Cloud Armor Security Policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.1.28", + "Description": "Checks if there are public routes in the route table to a Cloud Router or Forwarding Rule. The rule is NON_COMPLIANT if a route to an Internet Gateway has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.3.1.29", + "Description": "Checks if Google Cloud Search domains are in a Google Cloud Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Cloud Search domain endpoint is public.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "1.3.1.30", + "Description": "Checks if there are any Google Cloud SQL database instances that are using non-default network tags. The rule is NON_COMPLIANT if there are any Cloud SQL instances with network tags that are not the default ones.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_ssl_connections", + "cloudsql_instance_private_ip_assignment" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.3.1.31", + "Description": "Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration.requireSsl' field is false and the 'ipConfiguration.enabled' field is true in the instance configuration.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.3.1.32", + "Description": "Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the 'access' field in the dataset configuration item includes any entities with 'role' set to 'READER' or 'WRITER' for 'allAuthenticatedUsers' or 'allUsers'.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "1.3.1.33", + "Description": "Checks if Google BigQuery has VPC Service Controls enabled. The rule is NON_COMPLIANT if VPC Service Controls are not enabled or if the configuration.vpcServiceControls field is 'false'.", + "Name": "Google BigQuery", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "1.3.1.34", + "Description": "Checks if Google Cloud Storage (GCS) bucket access control settings have public access prevention enabled. The rule is NON_COMPLIANT if public access prevention settings are not enabled for GCS buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.1.35", + "Description": "Verifies if the necessary public access prevention settings are configured at the organization level in Google Cloud Platform. Compliance is marked as NON_COMPLIANT when the specified settings do not align with the organization's configuration items.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_account_access_approval_enabled", + "cloudstorage_bucket_public_access", + "bigquery_dataset_public_access", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.1.36", + "Description": "Checks if the required identity and access management (IAM) policies are configured at the organization level. The rule is NON_COMPLIANT if the IAM policies do not match one or more settings from parameters (or default).", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "1.3.1.37", + "Description": "Checks if Google Cloud Storage (GCS) buckets are publicly accessible. The rule is NON_COMPLIANT if a GCS bucket is not listed in the excludedPublicBuckets parameter and the bucket's IAM settings allow public access.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.1.38", + "Description": "Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Uniform Bucket-Level Access settings, the bucket policy, and the bucket access control list (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.1.39", + "Description": "Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform bucket-level access settings, bucket IAM policies, and object-level access control lists (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.1.40", + "Description": "Checks if a Google Cloud AI Platform Notebook instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.", + "Name": "Google Cloud AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud AI Platform" + } + ] + }, + { + "Id": "1.3.1.41", + "Description": "Checks if direct internet access is disabled for a Google AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.", + "Name": "Google AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google AI Platform" + } + ] + }, + { + "Id": "1.3.1.42", + "Description": "Checks if a Private Service Connection for the service provided in the rule parameter is created for each Google Cloud Virtual Private Cloud (GCP VPC). The rule is NON_COMPLIANT if a GCP VPC doesn't have a Private Service Connection created for the service.", + "Name": "Google Cloud Private Service Access", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Private Service Access" + } + ] + }, + { + "Id": "1.3.1.43", + "Description": "Checks if there are unused firewall rules. The rule is COMPLIANT if each firewall rule is associated with a network. The rule is NON_COMPLIANT if a firewall rule is not associated with a network.", + "Name": "Google Cloud VPC Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC Firewall" + } + ] + }, + { + "Id": "1.3.1.44", + "Description": "Checks if DNS resolution from the accepting/requesting VPC to private IP is enabled. The result is NON_COMPLIANT if DNS resolution from the accepting/requesting VPC to private IP is not enabled. This is equivalent to checking VPC Private DNS settings in GCP.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.3.1.45", + "Description": "Checks if firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.", + "Name": "Google Cloud VPC Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC Firewall" + } + ] + }, + { + "Id": "1.3.1.46", + "Description": "Checks if both Cloud VPN tunnels in Google Cloud Platform are in operational status (UP). The rule is NON_COMPLIANT if one or both tunnels are not operational (DOWN).", + "Name": "Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Cloud VPN" + } + ] + }, + { + "Id": "1.3.1.47", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if there are no rules present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.1.48", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.1.49", + "Description": "Checks whether a Google Cloud Armor Security Policy contains any rules. This rule is NON_COMPLIANT if a Security Policy does not contain any rules.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.1.50", + "Description": "Checks if Google Cloud Armor security policies contain any security rules. The rule is NON_COMPLIANT if there are no rules present within a Google Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.1.51", + "Description": "Verifies if a Google Cloud Platform WAF (Web Application Firewall) regional rule contains conditions. The rule is considered COMPLIANT if it includes at least one condition and NON_COMPLIANT if it does not.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.1.52", + "Description": "Checks if a Google Cloud Armor Security Policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within a Security Policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.2.1", + "Description": "Checks if a Google Cloud API is using Google Cloud Armor security policy. The rule is NON_COMPLIANT if a Google Cloud Armor security policy is not used or if the used security policy does not match what is listed in the rule parameter.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.2.2", + "Description": "Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.3.2.3", + "Description": "Checks if an API Gateway in GCP uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway does not have an associated SSL certificate.", + "Name": "API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "API Gateway" + } + ] + }, + { + "Id": "1.3.2.4", + "Description": "Checks if Google Cloud Platform (GCP) App Engine services are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a GCP App Engine service if it is not associated with a Cloud Armor security policy.", + "Name": "App Engine", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "App Engine" + } + ] + }, + { + "Id": "1.3.2.5", + "Description": "Checks if Google Cloud CDN instances are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN instance is not associated with a Cloud Armor security policy.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.3.2.6", + "Description": "Checks if the certificate associated with a Google Cloud CDN is the default Google-managed SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.3.2.7", + "Description": "Checks if the Cloud Source Repositories URL contains sign-in credentials or not. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.", + "Name": "Cloud Source Repositories", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Cloud Source Repositories" + } + ] + }, + { + "Id": "1.3.2.8", + "Description": "Checks if Google Cloud Database Migration Service replication instances are public. The rule is NON_COMPLIANT if the PubliclyAccessible field is set to true.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "1.3.2.9", + "Description": "Checks if Google Cloud Firestore manual backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore manual backups are public.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "1.3.2.10", + "Description": "Checks if the Google Cloud VPN authorization rules allow connection access for all clients. The rule is NON_COMPLIANT if 'AccessAll' is present and set to true.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "1.3.2.11", + "Description": "Checks if the status of the Google Cloud Deployment Manager deployment is DEPLOYED or NOT_DEPLOYED after execution on the instance. The rule is compliant if the field status is DEPLOYED. For more information about deployments, see What is a deployment?", + "Name": "Google Cloud Deployment Manager", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Deployment Manager" + } + ] + }, + { + "Id": "1.3.2.12", + "Description": "Checks if Google Cloud Platform (GCP) Cloud Interconnect or Cloud VPN setups have 'AutoAcceptSharedAttachments' enabled. The rule is NON_COMPLIANT for a Cloud Interconnect or VPN if 'AutoAcceptSharedAttachments' is set to 'enable'.", + "Name": "Cloud Interconnect / Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Cloud Interconnect / Cloud VPN" + } + ] + }, + { + "Id": "1.3.2.13", + "Description": "Checks if the Google Kubernetes Engine (GKE) endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "1.3.2.14", + "Description": "Checks if Google Cloud Memorystore for Redis instances are configured with a custom VPC network. The rule is NON_COMPLIANT for a Redis instance if it is using the default VPC network.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "1.3.2.15", + "Description": "Checks if Google Cloud's Google Cloud Search is configured within a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Google Cloud Search service endpoint is publicly accessible.", + "Name": "Google Cloud Search", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "1.3.2.16", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers have backend services configured with valid SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a valid SSL certificate or is configured with a certificate that is not from Google Cloud Certificate Manager.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.3.2.17", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS listener with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers and does not check other services.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.3.2.18", + "Description": "Checks if a Google Cloud project has firewall rules that block public access settings enabled. The rule is NON_COMPLIANT if allowTcp is true for any rule with a port other than 22 or if there are any ingress rules that allow access from all IP addresses (0.0.0.0/0).", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.3.2.19", + "Description": "In Google Cloud Platform (GCP), the equivalent of the rule identifier 'INCOMING_SSH_DISABLED' and rule name 'restricted-ssh' could be represented through firewall rules that deny incoming SSH traffic. This can be accomplished by setting up an ingress rule that specifically denies traffic on port 22 for SSH access, effectively restricting SSH access to instances.", + "Name": "Compute Engine", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "1.3.2.20", + "Description": "This rule identifies Google Cloud Platform (GCP) virtual machine instances that are located within a Virtual Private Cloud (VPC) network. The equivalent rule identifier for this purpose is 'INSTANCES_IN_VPC', matching the functionality of the 'ec2-instances-in-vpc' rule from AWS.", + "Name": "Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "1.3.2.21", + "Description": "Checks if Cloud NAT gateways are associated with an authorized Google Cloud VPC. The rule is NON_COMPLIANT if Cloud NAT gateways are associated with an unauthorized VPC.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.3.2.22", + "Description": "Checks if the Google Cloud Functions IAM policy attached to the Cloud Function prohibits public access. If the Cloud Function IAM policy allows public access, it is NON_COMPLIANT.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "1.3.2.23", + "Description": "Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.", + "Name": "Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Cloud Functions" + } + ] + }, + { + "Id": "1.3.2.24", + "Description": "Checks if Google Cloud Firewall rules for SSH (port 22) and RDP (port 3389) ingress traffic are unrestricted. The rule is NON_COMPLIANT if a firewall rule allows ingress traffic from all IP addresses (0.0.0.0/0) for these ports.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.3.2.25", + "Description": "Checks if a Google Cloud VPC firewall policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match with the user-defined default action.", + "Name": "Google Cloud VPC Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC Firewall" + } + ] + }, + { + "Id": "1.3.2.26", + "Description": "Check if GCP Firewall Rules are associated with stateful or stateless rules. The rule is NON_COMPLIANT if no associated stateful or stateless rules exist with the Firewall Rules, otherwise COMPLIANT if any rule exists.", + "Name": "Google Cloud Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.3.2.27", + "Description": "Verifies if a Google Cloud Platform (GCP) Firewall Rule contains firewall rules. The rule is NON_COMPLIANT if there are no rules in a GCP Firewall Rule.", + "Name": "Google Cloud Firewall", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.3.2.28", + "Description": "Checks if there are public routes in the route table to a Cloud VPN or Cloud Router. The rule is NON_COMPLIANT if a route has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.", + "Name": "Google Cloud Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "1.3.2.29", + "Description": "Checks if Google Cloud Search service instances are within a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Search service endpoint is public.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "1.3.2.30", + "Description": "Checks if there are any Google Cloud SQL database users that are not the default users. The rule is NON_COMPLIANT if there are any database users that are not the default users.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_user_options_flag", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.3.2.31", + "Description": "Checks if the Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'authorizedNetworks' field allows public IP addresses in the instance configuration.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.3.2.32", + "Description": "Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset access configuration includes any entries that allow public access.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "1.3.2.33", + "Description": "Checks if Google BigQuery dataset has 'authorizedNetworks' enabled. The rule is NON_COMPLIANT if 'authorizedNetworks' is not enabled or if the configuration.authorizedNetworks field is 'false'.", + "Name": "BigQuery", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "1.3.2.34", + "Description": "Checks if Google Cloud Storage (GCS) buckets have uniform bucket-level access (similar to S3 block public access) enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.2.35", + "Description": "Verifies if the required public access prevention settings are configured at the project level in Google Cloud Platform. The rule is considered NON_COMPLIANT when the public access settings do not match the specified criteria.", + "Name": "Google Cloud Storage (GCS)", + "Checks": [ + "cloudstorage_bucket_public_access", + "bigquery_dataset_public_access", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage (GCS)" + } + ] + }, + { + "Id": "1.3.2.36", + "Description": "Verifies if the required public access prevention settings are configured at the project or organization level in Google Cloud Platform. The rule is NON_COMPLIANT if the configuration does not align with the specified settings or defaults.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "iam_account_access_approval_enabled", + "cloudsql_instance_public_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.2.37", + "Description": "Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a storage bucket is not listed in the excludedPublicBuckets parameter and the bucket-level permissions allow public access.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.2.38", + "Description": "Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Uniform Bucket-Level Access settings, the bucket policy, and the bucket access control list (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.2.39", + "Description": "Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform Bucket-Level Access settings, bucket policies, and access control lists (ACLs).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.3.2.40", + "Description": "Checks if a Google AI Platform Notebook instance is launched within a VPC network or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet is not included in the list of approved subnets.", + "Name": "Google AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google AI Platform" + } + ] + }, + { + "Id": "1.3.2.41", + "Description": "Checks if direct internet access is disabled for a Google AI Platform (formerly known as AI Platform Notebooks) instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.", + "Name": "Google AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google AI Platform" + } + ] + }, + { + "Id": "1.3.2.42", + "Description": "Checks if a Private Service Connection for the service provided in the rule parameter is created for each Google Virtual Private Cloud (GCP VPC). The rule is NON_COMPLIANT if a GCP VPC doesn't have a Private Service Connection created for the service.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.3.2.43", + "Description": "Checks if there are unused Firewall Rules. The rule is COMPLIANT if each Firewall Rule is associated with a VPC network. The rule is NON_COMPLIANT if a Firewall Rule is not associated with a VPC network.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.3.2.44", + "Description": "Checks if DNS resolution from accepter/requester VPC to private IP is enabled. The rule is NON_COMPLIANT if DNS resolution from accepter/requester VPC to private IP is not enabled in Google Cloud Platform (GCP).", + "Name": "VPC Networking", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "VPC Networking" + } + ] + }, + { + "Id": "1.3.2.45", + "Description": "Checks if firewall rules in GCP allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.", + "Name": "Google Cloud Firewalls", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Firewalls" + } + ] + }, + { + "Id": "1.3.2.46", + "Description": "Checks if both Cloud VPN tunnels in Google Cloud are in ESTABLISHED state. The rule is NON_COMPLIANT if one or both tunnels are in DOWN state.", + "Name": "Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Cloud VPN" + } + ] + }, + { + "Id": "1.3.2.47", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.2.48", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Google Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.2.49", + "Description": "Checks whether a Google Cloud Armor security policy contains any security rules. This rule is NON_COMPLIANT if a security policy does not contain any security rules.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.2.50", + "Description": "Checks if Cloud Armor Security Policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor Security Policy.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "1.3.2.51", + "Description": "Checks whether Google Cloud Armor security policy rules contain conditions. This rule is COMPLIANT if the security policy rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.3.2.52", + "Description": "Verifies if a Google Cloud Armor security policy contains any security rules. The policy is considered NON_COMPLIANT if there are no security rules present within it.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.4.1.1", + "Description": "Checks if a Google Cloud API Gateway API deployment is using Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Google Cloud Armor policy is not used or if the used policy does not match what is specified in the rule parameter.", + "Name": "Google Cloud API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "1.4.1.2", + "Description": "Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter endpoint_configuration_type. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.4.1.3", + "Description": "Checks if Google Cloud Memorystore instances are configured with a custom subnet. The rule is NON_COMPLIANT for a Memorystore instance if it is using the default subnet.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "1.4.1.4", + "Description": "The rule identifier (INSTANCES_IN_VPC) for Google Cloud Platform corresponds to the equivalent resource of Google Compute Engine instances within a Virtual Private Cloud (VPC), similar to EC2 instances in Amazon Web Services VPC. In GCP, this would involve the configuration of firewall rules and network settings within a VPC for Google Compute Engine instances.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "1.4.1.5", + "Description": "Checks if Cloud NAT is configured for a Google Cloud VPC network. The rule is NON_COMPLIANT if Cloud NAT is not configured for an authorized VPC network.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.4.1.6", + "Description": "Checks if there are public routes in the route table to a Cloud Router or VPN Gateway (equivalent to an Internet Gateway in AWS). The rule is NON_COMPLIANT if there is a route to a Cloud Router or VPN Gateway with a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.", + "Name": "Google Cloud VPC Networking", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC Networking" + } + ] + }, + { + "Id": "1.4.1.7", + "Description": "Checks if BigQuery has 'VPC Service Controls' enabled. The rule is NON_COMPLIANT if 'VPC Service Controls' are not enabled or if the configuration.vpcServiceControls field is 'false'.", + "Name": "BigQuery", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "1.4.1.8", + "Description": "Checks if a Google AI Platform Notebooks instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.", + "Name": "Google AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google AI Platform Notebooks" + } + ] + }, + { + "Id": "1.4.1.9", + "Description": "Checks if DNS resolution from requester VPC to private IP is enabled in Google Cloud Platform. The rule is NON_COMPLIANT if DNS resolution is not enabled.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.4.1.10", + "Description": "Checks if both Cloud VPN tunnels in Google Cloud Platform are in 'ACTIVE' status. The rule is NON_COMPLIANT if one or both tunnels are in 'DOWN' or 'DISABLED' status.", + "Name": "Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud VPN" + } + ] + }, + { + "Id": "1.4.2.1", + "Description": "Checks if a Google Cloud Endpoints API is using Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Google Cloud Armor security policy is not used or if the used Google Cloud Armor policy does not match what is specified in the rule parameter.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.4.2.2", + "Description": "Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.4.2.3", + "Description": "Verifies if a Google Cloud Endpoints service has an associated SSL certificate. The rule is NON_COMPLIANT if the Google Cloud Endpoints service does not have a valid SSL certificate configured for its API.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.4.2.4", + "Description": "Checks if Google Cloud Endpoints APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud Endpoints API if it is not associated with a Cloud Armor security policy.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.4.2.5", + "Description": "Checks if Google Cloud CDN (Content Delivery Network) is associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Google Cloud CDN is not associated with a Google Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.4.2.6", + "Description": "Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.4.2.7", + "Description": "Checks if the Cloud Source Repositories URL contains sign-in credentials or not. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.", + "Name": "Cloud Source Repositories", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud Source Repositories" + } + ] + }, + { + "Id": "1.4.2.8", + "Description": "Checks if Google Cloud SQL instances are publicly accessible. The rule is NON_COMPLIANT if the 'Authorized networks' field is set to allow public IP addresses.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.4.2.9", + "Description": "Checks if Google Cloud Firestore manual backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore manual backups are public.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "1.4.2.10", + "Description": "Checks if the GCP VPN authorization rules authorize connection access for all clients. The rule is NON_COMPLIANT if 'AccessAll' is present and set to true.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "1.4.2.11", + "Description": "Checks if the status of the GCP Compute Engine instance's maintenance and compliance with the desired state (as configured with Instance Template and Managed Instance Groups) is 'HEALTHY' or 'UNHEALTHY' after the operation execution on the instance. The rule is compliant if the health status is 'HEALTHY'. For more information about instance groups, see Instance Groups and Autoscaling in GCP.", + "Name": "Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "1.4.2.12", + "Description": "Checks if Google Cloud Platform (GCP) Cloud Interconnect connections have 'AutoAcceptSharedAttachments' enabled. The rule is NON_COMPLIANT for a Cloud Interconnect connection if 'AutoAcceptSharedAttachments' is set to 'enable'.", + "Name": "Cloud Interconnect", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud Interconnect" + } + ] + }, + { + "Id": "1.4.2.13", + "Description": "Checks if the Google Kubernetes Engine (GKE) cluster endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "1.4.2.14", + "Description": "Checks if Google Cloud's Elasticsearch (via Google Cloud Marketplace or third-party offering) is deployed within a Virtual Private Cloud (VPC) network. The rule is NON_COMPLIANT if the Elasticsearch domain endpoint is public.", + "Name": "Google Cloud Virtual Private Cloud (VPC)", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Virtual Private Cloud (VPC)" + } + ] + }, + { + "Id": "1.4.2.15", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers have backends configured to use SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend that is configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud Certificate Manager certificate.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.4.2.16", + "Description": "Checks if the External HTTPS Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure an HTTPS or SSL proxy listener is configured with your External Load Balancer. This rule is specifically applicable to External HTTPS Load Balancers and does not check Internal Load Balancers or TCP/UDP Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.4.2.17", + "Description": "Checks if a Google Cloud account has block public access settings enabled for Google Dataproc. The rule is NON_COMPLIANT if BlockPublicAccess is false, or if true, firewall rules allow traffic on ports other than Port 22.", + "Name": "Google Dataproc", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Dataproc" + } + ] + }, + { + "Id": "1.4.2.18", + "Description": "The rule identifier INCOMING_SSH_DISABLED indicates a policy to disable incoming SSH access, while the rule name restricted-ssh refers to the specific rule implemented within a firewall to restrict SSH connections. In Google Cloud Platform (GCP), this is achieved using 'Firewall Rules' to manage network access, specifically by configuring a firewall rule to deny incoming traffic on port 22, which is the default port for SSH.", + "Name": "GCP Firewall Rules", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "GCP Firewall Rules" + } + ] + }, + { + "Id": "1.4.2.19", + "Description": "Checks if internet access configurations are associated with an authorized Virtual Private Cloud (VPC) in Google Cloud Platform (GCP). The rule is NON_COMPLIANT if internet access configurations are linked to an unauthorized VPC.", + "Name": "Google VPC", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed", + "compute_instance_public_ip", + "compute_network_default_in_use" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google VPC" + } + ] + }, + { + "Id": "1.4.2.20", + "Description": "Checks if the Google Cloud Functions IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "1.4.2.21", + "Description": "Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.", + "Name": "Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud Functions" + } + ] + }, + { + "Id": "1.4.2.22", + "Description": "Checks if the default ports for SSH (22) and RDP (3389) ingress traffic in Google Cloud Platform (GCP) firewall rules are unrestricted. The rule is NON_COMPLIANT if a firewall rule allows ingress from any source IP address on these ports.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.4.2.23", + "Description": "Checks if a Google Cloud VPC Firewall rule is configured with a user-defined default action for fragmented packets. The rule is NON_COMPLIANT if the default action for fragmented packets does not match the user-defined default action.", + "Name": "Google Cloud VPC Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC Firewall" + } + ] + }, + { + "Id": "1.4.2.24", + "Description": "Check if Google Cloud Platform (GCP) Firewall Policy has associated rules. This rule is NON_COMPLIANT if no ingress or egress rules are associated with the Firewall Policy; otherwise, it is COMPLIANT if any rule exists.", + "Name": "GCP Firewall Policy", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "GCP Firewall Policy" + } + ] + }, + { + "Id": "1.4.2.25", + "Description": "Verifies whether a Serverless VPC Access connector has associated Serverless services. The connector is NON_COMPLIANT if there are no services linked to it.", + "Name": "Google Cloud Serverless VPC Access", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Serverless VPC Access" + } + ] + }, + { + "Id": "1.4.2.26", + "Description": "Checks if there are public routes in the VPC route table to an Internet Gateway. The rule is NON_COMPLIANT if a route to an IGW has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.4.2.27", + "Description": "Checks if Google Cloud's Elasticsearch Service (or a similar managed service) domains are in a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch Service domain endpoint is public.", + "Name": "Google Cloud Elasticsearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Elasticsearch Service" + } + ] + }, + { + "Id": "1.4.2.28", + "Description": "Checks if there are any Google Cloud SQL instances that are not using the default network and firewall settings. The rule is NON_COMPLIANT if there are any Cloud SQL instances not configured with the default settings.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_ssl_connections", + "cloudsql_instance_private_ip_assignment" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.4.2.29", + "Description": "Checks if Cloud SQL instances in Google Cloud Platform (GCP) are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration' field has 'requireSsl' set to false or 'authorizedNetworks' is empty, indicating the instance is accessible from public IPs.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "1.4.2.30", + "Description": "Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset's access controls allow public access.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "1.4.2.31", + "Description": "Checks if Google BigQuery reservation has 'enableCapacityCommitment' enabled. The rule is NON_COMPLIANT if 'enableCapacityCommitment' is not enabled or if the configuration.enableCapacityCommitment field is 'false'.", + "Name": "Google BigQuery", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "1.4.2.32", + "Description": "Checks if Google Cloud Storage (GCS) buckets have uniform access controls enabled. The rule is NON_COMPLIANT if uniform access controls are not enabled for GCS buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.4.2.33", + "Description": "Checks if the required IAM policies for public access are configured properly at the project level. The rule is only NON_COMPLIANT when the IAM roles and permissions do not match the required configurations as specified.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.4.2.34", + "Description": "Verifies that the necessary public access prevention configurations are established at the organization level. The rule is NON_COMPLIANT if the settings do not align with the specified parameters or default configurations.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.4.2.35", + "Description": "Checks if Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "1.4.2.36", + "Description": "Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the 'Uniform Bucket-Level Access' settings, the bucket IAM policies, and the bucket access control lists (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.4.2.37", + "Description": "Checks if your Google Cloud Storage buckets do not allow public write access. The rule verifies the Uniform Bucket-Level Access settings, bucket IAM policies, and ACLs.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.4.2.38", + "Description": "Checks if a Google AI Platform Notebook instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.", + "Name": "Google AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google AI Platform" + } + ] + }, + { + "Id": "1.4.2.39", + "Description": "Checks if direct internet access is disabled for a Google Cloud AI Platform Notebooks instance. The rule is NON_COMPLIANT if an AI Platform Notebooks instance is internet-enabled.", + "Name": "Google Cloud AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud AI Platform Notebooks" + } + ] + }, + { + "Id": "1.4.2.40", + "Description": "Checks if a Private Service Connection for the service provided in the rule parameter is created for each Google Cloud Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if a Google Cloud VPC doesn't have a Private Service Connection created for the service.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.4.2.41", + "Description": "Checks if there are unused Firewall Rules. The rule is COMPLIANT if each Firewall Rule is associated with a target resource. The rule is NON_COMPLIANT if a Firewall Rule is not associated with any target resource.", + "Name": "Google Cloud VPC Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC Firewall" + } + ] + }, + { + "Id": "1.4.2.42", + "Description": "Checks if DNS resolution from accepted/requester VPC to private IP is enabled in Google Cloud Platform. The rule is NON_COMPLIANT if DNS resolution from accepter/requester VPC to private IP is not enabled.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.4.2.43", + "Description": "Checks if firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.", + "Name": "Google Cloud Firewall Rules", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Firewall Rules" + } + ] + }, + { + "Id": "1.4.2.44", + "Description": "Checks if both Cloud VPN tunnels provided by Google Cloud Platform (GCP) are in 'RUNNING' state. The rule is NON_COMPLIANT if one or both tunnels are in 'FAILED' state.", + "Name": "Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud VPN" + } + ] + }, + { + "Id": "1.4.2.45", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.4.2.46", + "Description": "Checks if a Google Cloud Armor security policy has any rules configured. The policy is NON_COMPLIANT if no rules are present within the Google Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.4.2.47", + "Description": "Checks whether a Cloud Armor security policy contains any security rules. This rule is NON_COMPLIANT if a security policy does not contain any security rule.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "1.4.2.48", + "Description": "Checks if Cloud Armor security policy rule groups contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor security policy rule group.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "1.4.2.49", + "Description": "Checks whether Google Cloud Armor security policy contains rules with conditions. This policy is COMPLIANT if the security policy contains at least one rule with conditions and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.4.2.50", + "Description": "Checks if a Google Cloud Armor security policy contains any rules or rule groups. The policy is considered NON_COMPLIANT if there are no rules or rule groups present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.4.3.1", + "Description": "Checks if a Google Cloud VPC firewall policy is configured with a user-defined ruleset for fragmented packets. The rule is NON_COMPLIANT if the default action for fragmented packets does not match the user-defined default action.", + "Name": "Google Cloud VPC Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.3: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC Firewall" + } + ] + }, + { + "Id": "1.4.3.2", + "Description": "Checks if a Google Cloud Platform (GCP) firewall policy is configured with a user-defined default action for traffic. This rule is NON_COMPLIANT if the default action for traffic does not match the user-defined action.", + "Name": "Google Cloud Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.3: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.4.3.3", + "Description": "Check if GCP Firewall Rule is associated with at least one target (such as instance tags or IP ranges). This rule is NON_COMPLIANT if no targets are associated with the Firewall Rule, else COMPLIANT if at least one target exists.", + "Name": "Google Cloud Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.3: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.4.4.1", + "Description": "Checks if a Google Cloud API Gateway API is using Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud Armor security policy is not used or if the used security policy does not match what is listed in the rule parameter.", + "Name": "Google Cloud API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "1.4.4.2", + "Description": "Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter endpointConfigurationType. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.4.4.3", + "Description": "Checks if Google Cloud Memorystore instances are configured with a custom VPC subnet. The rule is NON_COMPLIANT for a Memorystore instance if it is using the default VPC subnet.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "1.4.4.4", + "Description": "The rule identifier for instances in VPC in GCP is different from its rule name, similar to AWS's INSTANCES_IN_VPC and ec2-instances-in-vpc.", + "Name": "Cloud Compute", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud Compute" + } + ] + }, + { + "Id": "1.4.4.5", + "Description": "Checks if Cloud Routers with internet access are associated with an authorized Virtual Private Cloud (VPC) Network. The rule is NON_COMPLIANT if Cloud Routers with internet access are associated with an unauthorized VPC Network.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.4.4.6", + "Description": "Checks if there are public routes in the route table to a Cloud Internet Engine (CIE). The rule is NON_COMPLIANT if a route to a CIE has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.4.4.7", + "Description": "Checks if Google BigQuery has 'VPC Service Controls' enabled. The rule is NON_COMPLIANT if 'VPC Service Controls' are not enabled for the BigQuery instance or if the configuration.vpcServiceControls field is 'false'.", + "Name": "Google BigQuery", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "1.4.4.8", + "Description": "Checks if a Google AI Platform Notebook instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.", + "Name": "Google AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google AI Platform" + } + ] + }, + { + "Id": "1.4.4.9", + "Description": "Checks if DNS resolution from accepter/requester VPC to private IP is enabled. The rule is NON_COMPLIANT if DNS resolution from accepter/requester VPC to private IP is not enabled in Google Cloud Platform (GCP).", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.4.4.10", + "Description": "Checks if both Cloud VPN tunnels in Google Cloud Platform (GCP) are in 'ACTIVE' status. The rule is NON_COMPLIANT if one or both tunnels are in 'DOWN' status.", + "Name": "Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled.", + "Service": "Cloud VPN" + } + ] + }, + { + "Id": "1.4.5.1", + "Description": "Checks if Google Cloud Compute Instance Templates are set to assign public IP addresses to Network Interfaces. The rule is NON_COMPLIANT if the default version of a Compute Instance Template has at least 1 Network Interface with 'accessConfig' set to 'true' for assigning a public IP.", + "Name": "Google Cloud Compute", + "Checks": [ + "compute_instance_public_ip", + "compute_instance_ip_forwarding_is_enabled", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "1.4.5: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Cloud Compute" + } + ] + }, + { + "Id": "1.4.5.2", + "Description": "Checks if Google Kubernetes Engine (GKE) Pods are configured to share a host's process namespace with their containers. The rule is NON_COMPLIANT if the HostPID parameter is set to 'true'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.5: Network connections between trusted and untrusted networks are controlled.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "1.5.1.1", + "Description": "Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter endpointConfigurationType. The rule returns NON_COMPLIANT if the API does not match the endpoint type configured in the rule parameter.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "1.5.1.2", + "Description": "Checks if an API Gateway stage uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway stage does not have an associated SSL certificate.", + "Name": "API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "API Gateway" + } + ] + }, + { + "Id": "1.5.1.3", + "Description": "Checks if Google Cloud APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud API if it is not associated with a Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.5.1.4", + "Description": "Verifies if Google Cloud CDN is associated with Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN is not associated with a Cloud Armor policy.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.5.1.5", + "Description": "Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "1.5.1.6", + "Description": "Checks if the Cloud Source Repositories URL contains sign-in credentials. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.", + "Name": "Cloud Source Repositories", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Cloud Source Repositories" + } + ] + }, + { + "Id": "1.5.1.7", + "Description": "Checks if Google Cloud Database Migration Service (Cloud DMS) private services are exposed to the public. The rule is NON_COMPLIANT if the equivalent public access setting is enabled.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "1.5.1.8", + "Description": "Checks if Google Cloud Firestore or Google Cloud Spanner backups are public. The rule is NON_COMPLIANT if any Firestore or Spanner backups are public.", + "Name": "Google Cloud Firestore / Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Firestore / Google Cloud Spanner" + } + ] + }, + { + "Id": "1.5.1.9", + "Description": "Checks if the Google Cloud Platform (GCP) Identity-Aware Proxy (IAP) settings allow access for all users. The rule is NON_COMPLIANT if 'accessLevel' is set to 'allUsers'.", + "Name": "Identity-Aware Proxy (IAP)", + "Checks": [ + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Identity-Aware Proxy (IAP)" + } + ] + }, + { + "Id": "1.5.1.10", + "Description": "Checks if the status of the Google Cloud Config Sync association compliance is COMPLIANT or NON_COMPLIANT after the association execution on the instance. The rule is compliant if the field status is COMPLIANT. For more information about associations in GCP, see Config Sync documentation.", + "Name": "Google Cloud Config Sync", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Config Sync" + } + ] + }, + { + "Id": "1.5.1.11", + "Description": "Checks if Google Cloud Platform (GCP) Cloud VPN has 'AutoTunnel' enabled. The rule is NON_COMPLIANT for a Cloud VPN if 'AutoTunnel' is set to 'enable'.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "1.5.1.12", + "Description": "Checks if the Google Kubernetes Engine (GKE) cluster endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "1.5.1.13", + "Description": "Checks if Google Cloud Elasticsearch clusters (via Google Cloud Marketplace or a self-managed deployment) are within a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch cluster endpoint is public.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "1.5.1.14", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured with SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without an SSL certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud certificate.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.5.1.15", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, an HTTPS load balancer should be configured. This rule is specifically applicable to Google Cloud Load Balancers and not to any other load balancing options.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "1.5.1.16", + "Description": "Checks if an account with Google Cloud Dataproc has block public access settings enabled. The rule is NON_COMPLIANT if the blockPublicAccess configuration is false or if true, ports other than Port 22 are listed in the allowedFirewallRules.", + "Name": "Google Cloud Dataproc", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Dataproc" + } + ] + }, + { + "Id": "1.5.1.17", + "Description": "In Google Cloud Platform (GCP), the equivalence for the incoming SSH policy that disables incoming SSH traffic can be achieved using Firewall Rules. Specifically, you would create a firewall rule that denies TCP traffic on port 22 (the default SSH port) to restrict SSH access for instances.", + "Name": "Compute Engine Firewall Rules", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Compute Engine Firewall Rules" + } + ] + }, + { + "Id": "1.5.1.18", + "Description": "Checks if Cloud Routers are attached to an authorized Google Cloud VPC network. The rule is NON_COMPLIANT if Cloud Routers are attached to an unauthorized VPC network.", + "Name": "Google Cloud VPC", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.5.1.19", + "Description": "Checks if the Cloud Functions IAM policy attached to the Cloud Function prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "1.5.1.20", + "Description": "Checks if a Google Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "1.5.1.21", + "Description": "Checks if default ports for SSH (22) and RDP (3389) ingress traffic for Google Cloud Platform firewall rules is unrestricted. The rule is NON_COMPLIANT if a firewall rule allows ingress traffic from any source IP address on ports 22 or 3389.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.5.1.22", + "Description": "Checks if a GCP Firewall Rule is configured with a user-defined default action for fragmented packets. The rule is NON_COMPLIANT if the default action for fragmented packets does not match the user-defined action.", + "Name": "Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "1.5.1.23", + "Description": "Check if Google Cloud Firewall policy is associated with stateful or stateless rules. This rule is NON_COMPLIANT if no stateful or stateless rules are associated with the Firewall policy, else COMPLIANT if any one of the rule types exists.", + "Name": "Google Cloud Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.5.1.24", + "Description": "Checks if a GCP Firewall Rule contains rules. The rule is NON_COMPLIANT if there are no rules in a Firewall Rule.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.5.1.25", + "Description": "Checks if there are public routes in the route table to a Cloud Router (GCP equivalent). The rule is NON_COMPLIANT if a route to a Cloud Router has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.", + "Name": "Google Cloud Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "1.5.1.26", + "Description": "Checks if Google Cloud's Elasticsearch (managed) instances are in a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch instance endpoint is public.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "1.5.1.27", + "Description": "Checks if there are any Google Cloud SQL database instances that do not use the default Cloud SQL settings. The rule is NON_COMPLIANT if there are any database instances not configured with the default settings.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_user_options_flag", + "cloudsql_instance_automated_backups", + "cloudsql_instance_public_access", + "cloudsql_instance_mysql_skip_show_database_flag" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.5.1.28", + "Description": "Checks if the Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration' field's 'authorizedNetworks' array is not empty, indicating that the instance has been configured to allow connections from public IP addresses.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "1.5.1.29", + "Description": "Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the `access` field contains an entry with `specialGroup` set to 'allUsers'.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "1.5.1.30", + "Description": "Checks if Google Cloud Storage (GCS) buckets have uniform bucket-level access enabled to block public access settings. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.5.1.31", + "Description": "Verifies if the necessary IAM permissions are properly configured at the project level in GCP. The rule is marked as NON_COMPLIANT when the assigned roles do not align with the expected IAM policy configurations.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_account_access_approval_enabled", + "iam_no_service_roles_at_project_level", + "iam_sa_no_administrative_privileges", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "1.5.1.32", + "Description": "Checks if the required public access settings are configured at the project level. The rule is NON_COMPLIANT if the IAM policy does not restrict public access appropriately based on the specified parameters or defaults.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.5.1.33", + "Description": "Checks if Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.5.1.34", + "Description": "Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Bucket Policy Only settings, uniform bucket-level access, and the bucket access control list (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.5.1.35", + "Description": "Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform bucket-level access settings, the bucket IAM policies, and the bucket access control list (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "1.5.1.36", + "Description": "Checks if a Google Cloud AI Platform Notebooks instance is launched within a Virtual Private Cloud (VPC) network or within a list of approved subnets. The rule is NON_COMPLIANT if an AI Platform Notebooks instance is not launched within a VPC or if its subnet ID is not included in the parameter list.", + "Name": "Google Cloud AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud AI Platform Notebooks" + } + ] + }, + { + "Id": "1.5.1.37", + "Description": "Checks if direct internet access is disabled for a Google Cloud Vertex AI Workbench instance. The rule is NON_COMPLIANT if the Vertex AI Workbench instance is internet-enabled.", + "Name": "Google Cloud Vertex AI Workbench", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Vertex AI Workbench" + } + ] + }, + { + "Id": "1.5.1.38", + "Description": "Checks if a Private Service Access connection is created for each Google Cloud Virtual Private Cloud (GCP VPC). The rule is NON_COMPLIANT if a GCP VPC doesn't have a Private Service Access connection created for the service.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.5.1.39", + "Description": "Checks if there are unused firewall rules in Google Cloud Platform (GCP). The rule is COMPLIANT if each firewall rule is associated with a VPC network. The rule is NON_COMPLIANT if a firewall rule is not associated with a VPC network.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "1.5.1.40", + "Description": "Checks if Google Cloud firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "1.5.1.41", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is considered NON_COMPLIANT if there are no rules present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.5.1.42", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.5.1.43", + "Description": "Checks whether a GCP Web Application Firewall (WAF) contains any firewall rules. This rule is NON_COMPLIANT if a WAF does not contain any firewall rule.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.5.1.44", + "Description": "Checks if Cloud Armor security policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor security policy.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "1.5.1.45", + "Description": "Checks whether the Google Cloud Armor security policy contains rules with match conditions. This rule is COMPLIANT if the security policy contains at least one match condition and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "1.5.1.46", + "Description": "Checks if a GCP Cloud Armor security policy contains any security rules. The policy is NON_COMPLIANT if there are no security rules present within a Cloud Armor security policy.", + "Name": "GCP Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.", + "Service": "GCP Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.1.1", + "Description": "Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' is not present in the API configuration.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.1.2", + "Description": "Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logging level is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.1.3", + "Description": "Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Trace", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Trace" + } + ] + }, + { + "Id": "10.2.1.1.4", + "Description": "Checks if a Google Cloud Platform (GCP) Cloud Run service has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or 'log level' is neither ERROR nor ALL.", + "Name": "Cloud Run", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Run" + } + ] + }, + { + "Id": "10.2.1.1.5", + "Description": "Checks if Google Cloud Load Balancers (GCLB) are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if GCLB Desync mitigation mode does not match with user-defined Desync mitigation mode.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.1.6", + "Description": "Checks if Google Cloud CDN (Content Delivery Network) is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging configured.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.2.1.1.7", + "Description": "Checks if at least one Google Cloud Audit Log is logging Google Cloud Storage (GCS) data access events for all GCS buckets. The rule is NON_COMPLIANT if there are no logs recording GCS data access events.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.1.8", + "Description": "Verifies if Google Cloud Monitoring alerts have an action configured for ACTIVE, INACTIVE, or NO_DATA states. Optionally checks if any actions correspond to a specific notification channel. The rule is considered NON_COMPLIANT if there is no action specified for the alert or optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "10.2.1.1.9", + "Description": "Checks if a resource type has a Google Cloud Monitoring alert policy for the named metric. For resource types, you can specify Compute Engine instances, Cloud Storage buckets, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the named metric has a resource ID and an alert policy in Google Cloud Monitoring.", + "Name": "Google Cloud Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "10.2.1.1.10", + "Description": "In GCP, the equivalence for ensuring logging is enabled is the 'Cloud Audit Logs' which serves a similar purpose as AWS CloudTrail. The rule can be compared to checking if 'Audit Logging' is enabled for the relevant services to track activity.", + "Name": "Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "compute_loadbalancer_logging_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Logging" + } + ] + }, + { + "Id": "10.2.1.1.11", + "Description": "Checks if a Google Cloud Build configuration has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.2.1.1.12", + "Description": "Checks if logging is enabled with a valid severity level for Cloud SQL database events in Google Cloud. The rule is NON_COMPLIANT if logging is not enabled or if the logging severity level for Cloud SQL events is not valid.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_connections_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.1.13", + "Description": "Checks if a Google Cloud Firestore database has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore database does not have Stackdriver logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.2.1.1.14", + "Description": "Checks if Google Cloud VPN has logging enabled for connections. The rule is NON_COMPLIANT if 'loggingEnabled' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "10.2.1.1.15", + "Description": "Checks if Stackdriver Monitoring is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if Stackdriver Monitoring is not enabled.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "10.2.1.1.16", + "Description": "Checks if logging is configured for active Cloud Run services. This rule is NON_COMPLIANT if an active Cloud Run service does not have logging enabled or the logging configuration is missing in at least one revision.", + "Name": "Cloud Run", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Run" + } + ] + }, + { + "Id": "10.2.1.1.17", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine" + } + ] + }, + { + "Id": "10.2.1.1.18", + "Description": "Checks if Google Cloud App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.", + "Name": "Google Cloud App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud App Engine" + } + ] + }, + { + "Id": "10.2.1.1.19", + "Description": "Checks if the Google Cloud Load Balancing has logging enabled. The rule is NON_COMPLIANT if the logging is not enabled or if the log bucket is not set to the specified Cloud Storage bucket name.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.1.20", + "Description": "Checks if Google Cloud Pub/Sub subscriptions have audit logging enabled. The rule is NON_COMPLIANT if a subscription does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.1.21", + "Description": "Checks if a Google Cloud Pub/Sub service has Stackdriver logging enabled. The rule is NON_COMPLIANT if the service does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.1.22", + "Description": "In Google Cloud Platform (GCP), the equivalent service to AWS CloudTrail for logging and monitoring API calls is Google Cloud Audit Logs. This service provides details of actions taken by users in your GCP project across multiple regions.", + "Name": "Google Cloud Audit Logs", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.1.23", + "Description": "Checks if a Google Cloud SQL instance has audit logging enabled for its database operations. The rule is NON_COMPLIANT if a Cloud SQL instance does not have audit logging enabled.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_statement_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.1.24", + "Description": "Checks if Google Cloud Firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the firewall rules. You can specify which logging type you want the rule to check.", + "Name": "Google Cloud Firewall", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "10.2.1.1.25", + "Description": "Checks if Google Cloud SQL MySQL instances are configured to enable logging for Audit logs. The rule is NON_COMPLIANT if Cloud SQL MySQL instances do not have audit log publishing configured.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_connections_flag", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.1.26", + "Description": "Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types (such as general, slow query, or error logs) are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.1.27", + "Description": "Checks if Google BigQuery audit logs are being exported to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "Google BigQuery", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.1.28", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if the dataset does not have audit logging enabled.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.1.29", + "Description": "Checks if DNS query logging is enabled for your Google Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.2.1.1.30", + "Description": "Checks if logging is enabled for your Google Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.1.31", + "Description": "Checks if Google Cloud Security Command Center (SCC) is enabled for a Google Cloud Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "10.2.1.1.32", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic for the subscriptions. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.1.33", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.2.1.1.34", + "Description": "Checks if Google Cloud VPC flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.1.1.35", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the expected value.", + "Name": "Google Cloud Armor", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.1.36", + "Description": "Checks if Google Cloud Monitoring logging for Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'loggingEnabled' field is set to false.", + "Name": "Google Cloud Armor", + "Checks": [ + "iam_audit_logs_enabled", + "compute_loadbalancer_logging_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.1.37", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.2.1", + "Description": "Checks if Google Cloud Endpoints have access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' configuration is not present in the Endpoints settings.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.2.2", + "Description": "Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logLevel is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.2.3", + "Description": "Checks if Google Cloud Trace (formerly known as Stackdriver Trace) tracing is enabled on Google Cloud API Gateway services. The rule is COMPLIANT if Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.2.1.2.4", + "Description": "Checks if a Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled or 'logLevel' is set to neither ERROR nor ALL.", + "Name": "Google Cloud API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.2.1.2.5", + "Description": "Checks if Google Cloud Load Balancers are configured with a user-defined session affinity setting. The rule is NON_COMPLIANT if the session affinity setting does not match the user-defined value.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.2.6", + "Description": "Checks if Google Cloud CDN (Content Delivery Network) is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.2.1.2.7", + "Description": "Checks if at least one Google Cloud Audit Log is logging Cloud Storage data events for all buckets. The rule is NON_COMPLIANT if there are no logs recording Cloud Storage data events.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.2.1.2.8", + "Description": "GCP's equivalent rule is to ensure that Cloud Audit Logs are enabled for tracking API calls and other activities on resources, similar to AWS CloudTrail.", + "Name": "Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "apikeys_api_restrictions_configured", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Logging" + } + ] + }, + { + "Id": "10.2.1.2.9", + "Description": "Checks if a Google Cloud Build trigger has at least one logging option enabled. The rule is NON_COMPLIANT if all logging options are set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.2.1.2.10", + "Description": "Checks if logging is enabled with a valid severity level for Google Cloud Database Migration Service (Cloud DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "10.2.1.2.11", + "Description": "Checks if a Google Cloud Firestore (with MongoDB compatibility) instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.2.1.2.12", + "Description": "Checks if Google Cloud VPN has logging enabled. The rule is NON_COMPLIANT if 'logging' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "10.2.1.2.13", + "Description": "Checks if logging configuration is set on active GKE Pod specifications. This rule is NON_COMPLIANT if an active GKE Pod does not have a logging configuration defined or the logging configuration is null in at least one container defined in the Pod spec.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.2.14", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.2.15", + "Description": "Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.", + "Name": "Google App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google App Engine" + } + ] + }, + { + "Id": "10.2.1.2.16", + "Description": "Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging settings are not enabled or the log bucket is not equal to the specified Cloud Storage bucket name.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.2.17", + "Description": "Checks if Google Cloud Pub/Sub has audit logging enabled. The rule is NON_COMPLIANT if a Pub/Sub topic does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.2.18", + "Description": "Checks if a Google Cloud Pub/Sub topic has logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.2.19", + "Description": "Google Cloud Platform equivalent service for AWS CloudTrail is Google Cloud Audit Logs, which provides similar logging of activities in the cloud environment. The corresponding rule in GCP would ensure that audit logs are enabled in multiple regions.", + "Name": "Google Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.2.20", + "Description": "Checks if a Google Cloud SQL instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_statement_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.2.21", + "Description": "Checks if Google Cloud Platform VPC Service Controls have logging enabled. The rule is NON_COMPLIANT if a logging type (such as 'Data Access' logs) is not configured. You can specify which logging type you want the rule to check.", + "Name": "Google Cloud VPC Service Controls", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC Service Controls" + } + ] + }, + { + "Id": "10.2.1.2.22", + "Description": "Checks if Google Cloud SQL instances for MySQL are configured to export logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log export configured.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.2.23", + "Description": "Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.2.24", + "Description": "Checks if Google BigQuery datasets are logging audits to a specific location in Google Cloud Storage. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "BigQuery", + "Checks": [ + "iam_audit_logs_enabled", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "10.2.1.2.25", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if audit logging is not enabled for the dataset.", + "Name": "BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "10.2.1.2.26", + "Description": "Checks if DNS query logging is enabled for your Google Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.2.1.2.27", + "Description": "Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.2.28", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.2.1.2.29", + "Description": "Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.1.2.30", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.2.31", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy, if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.3.1", + "Description": "Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLog' settings are not present in the OpenAPI configuration for the API.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.3.2", + "Description": "Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logLevel is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.3.3", + "Description": "Checks if Google Cloud Trace is enabled for Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.3.4", + "Description": "Checks if a Google Cloud Firestore or Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is not set to ERROR or ALL.", + "Name": "Google Cloud Logging / Google Cloud API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Logging / Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.2.1.3.5", + "Description": "Checks if Google Cloud Load Balancers are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if the Load Balancer Desync mitigation mode does not match the user-defined Desync mitigation mode.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.3.6", + "Description": "Checks if Google Cloud CDN is configured to log requests to Google Cloud Storage. The rule is NON_COMPLIANT if a Cloud CDN resource does not have logging enabled.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.2.1.3.7", + "Description": "Checks if at least one Google Cloud Audit Log is logging data events for all Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs recording data events.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.3.8", + "Description": "The equivalence in GCP for the AWS rule 'CLOUD_TRAIL_ENABLED' is 'Cloud Audit Logs' which ensures that logging is enabled for tracking actions in the GCP environment.", + "Name": "Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Logging" + } + ] + }, + { + "Id": "10.2.1.3.9", + "Description": "Checks if a Google Cloud Build trigger has log streaming enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.2.1.3.10", + "Description": "Checks if logging is enabled with a valid severity level for Google Cloud Database Migration Service replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "10.2.1.3.11", + "Description": "Checks if a Google Cloud Firestore or Google Cloud Datastore instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Firestore or Datastore instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Google Cloud Firestore / Google Cloud Datastore", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firestore / Google Cloud Datastore" + } + ] + }, + { + "Id": "10.2.1.3.12", + "Description": "Checks if Google Cloud IAP (Identity-Aware Proxy) has client connection logging enabled. The rule is NON_COMPLIANT if 'IapSettings.clientConnectionLogEnabled' is set to false.", + "Name": "Google Cloud Identity-Aware Proxy", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Identity-Aware Proxy" + } + ] + }, + { + "Id": "10.2.1.3.13", + "Description": "Checks if logging is enabled on active Google Kubernetes Engine (GKE) workloads. This rule is NON_COMPLIANT if an active GKE workload does not have logging enabled through the Stackdriver Logging or if the logging configuration is null in at least one container definition.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.3.14", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.3.15", + "Description": "Checks if Google Cloud Platform App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.", + "Name": "Google Cloud App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud App Engine" + } + ] + }, + { + "Id": "10.2.1.3.16", + "Description": "Checks if the Cloud Load Balancing has logging enabled. The rule is NON_COMPLIANT if the logBucket is not set or the logBucket does not match the required bucket name.", + "Name": "Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.3.17", + "Description": "Checks if Google Cloud Pub/Sub has Cloud Audit Logs enabled. The rule is NON_COMPLIANT if a Pub/Sub topic does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.3.18", + "Description": "Checks if a Google Cloud Pub/Sub topic has Cloud Logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.3.19", + "Description": "In Google Cloud Platform (GCP), the equivalent service to AWS CloudTrail for logging and monitoring API activity is Google Cloud Audit Logs. To ensure comprehensive auditing, it is essential to enable Audit Logs that span multiple regions.", + "Name": "Google Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.3.20", + "Description": "Checks if a Google Cloud Spanner instance has Stackdriver Logging export enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have Stackdriver Logging export enabled for audit logs.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "10.2.1.3.21", + "Description": "Checks if Google Cloud Platform (GCP) VPC (Virtual Private Cloud) firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the specified firewall rules.", + "Name": "VPC Firewall Rules", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "VPC Firewall Rules" + } + ] + }, + { + "Id": "10.2.1.3.22", + "Description": "Checks if Cloud SQL for MySQL instances are configured to enable 'Cloud SQL Insights' for monitoring and logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have Cloud SQL Insights enabled.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_mysql_skip_show_database_flag", + "cloudsql_instance_ssl_connections", + "cloudsql_instance_postgres_log_connections_flag", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.3.23", + "Description": "Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.3.24", + "Description": "Checks if Google BigQuery audit logs are being exported to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "Google BigQuery", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.3.25", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or if a dataset does not have audit logging enabled.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.3.26", + "Description": "Checks if Cloud DNS query logging is enabled for your Google Cloud Platform public hosted zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud Platform public hosted zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.2.1.3.27", + "Description": "Checks if logging is enabled for your Cloud Storage buckets (equivalent to S3). The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.3.28", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.2.1.3.29", + "Description": "Checks if Google Cloud Virtual Private Cloud (VPC) flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.1.3.30", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the expected value.", + "Name": "Google Cloud Armor", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.3.31", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy, if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.4.1", + "Description": "Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' are not configured in the service's endpoint configuration.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.4.2", + "Description": "Checks if all methods in Google Cloud Endpoints configurations have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logging level is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.4.3", + "Description": "Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Trace", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Trace" + } + ] + }, + { + "Id": "10.2.1.4.4", + "Description": "Checks if a Google Cloud Endpoints API has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or 'logLevel' is neither ERROR nor ALL.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.4.5", + "Description": "Checks if Google Cloud Load Balancers (GCLB) are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if GCLB Desync mitigation mode does not match with the user-defined Desync mitigation mode.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.4.6", + "Description": "Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.2.1.4.7", + "Description": "Checks if at least one Google Cloud Audit Log (Cloud Logging) trail is logging Google Cloud Storage (GCS) data events for all GCS buckets. The rule is NON_COMPLIANT if there are no trails recording GCS data events.", + "Name": "Google Cloud Storage (GCS)", + "Checks": [ + "iam_audit_logs_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage (GCS)" + } + ] + }, + { + "Id": "10.2.1.4.8", + "Description": "Google Cloud Platform (GCP) equivalent of enabling audit logs is through enabling Cloud Audit Logs, which is analogous to enabling AWS CloudTrail. The rule identifier in GCP can differ from other identifiers but essentially serves the same function.", + "Name": "Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.4.9", + "Description": "Checks if a Google Cloud Build trigger has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.2.1.4.10", + "Description": "Checks if logging is enabled with a valid severity level for Google Cloud SQL replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.4.11", + "Description": "Checks if a Google Cloud Firestore instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.2.1.4.12", + "Description": "Checks if Google Cloud VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'logConfig.enabled' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "10.2.1.4.13", + "Description": "Checks if logging configuration is set on active GKE Pod specifications. This rule is NON_COMPLIANT if an active GKE Pod does not have logging configured or if the logging configuration is null in at least one container definition.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.4.14", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.4.15", + "Description": "Checks if Google Cloud Platform App Engine environments are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.", + "Name": "Google Cloud App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud App Engine" + } + ] + }, + { + "Id": "10.2.1.4.16", + "Description": "Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the 'logging' is disabled or the 'logBucket' is not equal to the specified Cloud Storage bucket name.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.4.17", + "Description": "Checks if Google Cloud Pub/Sub subscriptions have logging enabled. The rule is NON_COMPLIANT if a subscription does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.4.18", + "Description": "Checks if a Google Cloud Pub/Sub topic has audit logging enabled. The rule is NON_COMPLIANT if the topic does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.4.19", + "Description": "The rule MULTI_REGION_CLOUD_TRAIL_ENABLED in AWS corresponds to Google Cloud's equivalent service which ensures that logging is performed across multiple regions to have a more robust audit trail, similar to Cloud Audit Logs in Google Cloud Platform. This ensures that all operations are tracked across geographically distributed resources.", + "Name": "Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.4.20", + "Description": "Checks if a Google Cloud SQL database instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.4.21", + "Description": "Checks if Google Cloud Platform (GCP) VPC firewalls have logging enabled. The rule is NON_COMPLIANT if 'logConfig' is not set. You can specify which logging configurations you want the rule to check.", + "Name": "Google Cloud VPC Firewall", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC Firewall" + } + ] + }, + { + "Id": "10.2.1.4.22", + "Description": "Checks if Google Cloud SQL for MySQL instances are configured to export logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log export configured.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.4.23", + "Description": "Checks if respective logs of Google Cloud SQL (GCP equivalent of Amazon RDS) are enabled. The rule is NON_COMPLIANT if any log types are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.4.24", + "Description": "Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "BigQuery", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "10.2.1.4.25", + "Description": "Checks if Google BigQuery datasets have the specified security settings. The rule is NON_COMPLIANT if the dataset is not encrypted, or if it is not using the specified encryption key, or if audit logging is not enabled for the dataset.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.4.26", + "Description": "Checks if DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.2.1.4.27", + "Description": "Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.4.28", + "Description": "Checks if Google Cloud Workflows have logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.2.1.4.29", + "Description": "Checks if Google Cloud VPC Flow Logs are found and enabled for all Google Cloud VPC networks. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.1.4.30", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Google Cloud Armor", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.4.31", + "Description": "Checks if logging is enabled for Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.5.1", + "Description": "Checks if Google Cloud Endpoints have access logging enabled. The rule is NON_COMPLIANT if 'logs' configuration is not present in the Endpoints settings.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.5.2", + "Description": "Checks if all methods in Google Cloud Endpoints or API Gateway have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints / Google Cloud API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints / Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.2.1.5.3", + "Description": "Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.5.4", + "Description": "Checks if a Google Cloud API Gateway API has logging enabled. The rule is NON_COMPLIANT if logging is not enabled or if the log level is not set to 'ERROR' or 'ALL'.", + "Name": "Google Cloud API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.2.1.5.5", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers are configured with a user-defined desynchronization (Desync) mitigation mode. The rule is NON_COMPLIANT if the HTTP(S) Load Balancer Desync mitigation mode does not match the user-defined Desync mitigation mode.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.5.6", + "Description": "Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN is not configured for logging.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.2.1.5.7", + "Description": "Checks if at least one Google Cloud audit log is logging Google Cloud Storage (GCS) data events for all GCS buckets. The rule is NON_COMPLIANT if there are no audit logs recording GCS data events.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.5.8", + "Description": "Google Cloud Platform equivalent for AWS CloudTrail is Google Cloud Audit Logs, which provides similar logging and auditing capabilities for tracking API requests and changes in your Google Cloud resources.", + "Name": "Cloud Audit Logs", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.5.9", + "Description": "Checks if a Google Cloud Build trigger has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.2.1.5.10", + "Description": "Checks if logging is enabled with a valid severity level for GCP Database Migration Service (DMS) replication task events of a target Cloud SQL database. The rule is NON_COMPLIANT if logging is not enabled or if the replication task logging of a target database has a severity level that is not valid.", + "Name": "Google Cloud Database Migration Service", + "Checks": [ + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "10.2.1.5.11", + "Description": "Checks if a Google Cloud Firestore instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.2.1.5.12", + "Description": "Checks if Google Cloud VPN has connection logging enabled. The rule is NON_COMPLIANT if 'loggingEnabled' is set to false in the VPN configuration.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "10.2.1.5.13", + "Description": "Checks if logging is configured for active Google Cloud Run services. This rule is NON_COMPLIANT if a Cloud Run service does not have the logging configuration set or if the logging configuration is null in at least one revision.", + "Name": "Google Cloud Run", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Run" + } + ] + }, + { + "Id": "10.2.1.5.14", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine" + } + ] + }, + { + "Id": "10.2.1.5.15", + "Description": "Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the log routing settings do not include exporting to Cloud Logging.", + "Name": "Google App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google App Engine" + } + ] + }, + { + "Id": "10.2.1.5.16", + "Description": "Checks if the Google Cloud Load Balancer has access logs enabled. The rule is NON_COMPLIANT if the 'logging.enabled' is false or 'logging.bucket' is not equal to the specified Cloud Storage bucket name.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.5.17", + "Description": "Checks if Google Cloud Pub/Sub (GCP equivalent of Amazon MQ) has logging enabled. The rule is NON_COMPLIANT if a Pub/Sub topic does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.5.18", + "Description": "Checks if a Google Cloud Pub/Sub service has Stackdriver logging enabled. The rule is NON_COMPLIANT if the Pub/Sub service does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.5.19", + "Description": "The GCP equivalent for enabling a multi-region logging service to track and audit activities is by using Cloud Audit Logs in combination with Google Cloud Logging. This allows users to enable logging across multiple regions for better compliance and tracking of resources.", + "Name": "Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.5.20", + "Description": "Checks if a Google Cloud SQL instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_statement_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.5.21", + "Description": "Checks if Google Cloud Platform (GCP) VPC Service Controls have logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "VPC Service Controls", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "VPC Service Controls" + } + ] + }, + { + "Id": "10.2.1.5.22", + "Description": "Checks if Google Cloud SQL for MySQL instances are configured to enable the Cloud SQL Insights feature for audit log data analysis. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log publishing configured.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_mysql_skip_show_database_flag", + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.5.23", + "Description": "Checks if the respective logs of Cloud SQL for PostgreSQL and MySQL are enabled in Google Cloud Platform (GCP). The rule is NON_COMPLIANT if any log types (such as general log, slow query log, error log) are not enabled.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.5.24", + "Description": "Checks if Google BigQuery datasets have audit logging enabled and if the configured logging destination matches the specified location. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the logging destination does not match the provided criteria.", + "Name": "Google BigQuery", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.5.25", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if the dataset does not have auditing enabled.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.5.26", + "Description": "Checks if DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.2.1.5.27", + "Description": "Checks if logging is enabled for your Google Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.5.28", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.2.1.5.29", + "Description": "Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.1.5.30", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the specified value.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.5.31", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.6.1", + "Description": "Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' settings are not present in the Endpoints configuration.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.6.2", + "Description": "Checks if all methods in Google Cloud API Gateway have logging enabled. The rule is NON_COMPLIANT if logging is not enabled or if logging level is neither ERROR nor INFO.", + "Name": "Google Cloud API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.2.1.6.3", + "Description": "Checks if Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.6.4", + "Description": "Checks if a Google Cloud Platform (GCP) Cloud Run service has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither ERROR nor ALL.", + "Name": "Cloud Run", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Run" + } + ] + }, + { + "Id": "10.2.1.6.5", + "Description": "Checks if HTTPS load balancers in Google Cloud Platform (GCP) are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if the HTTPS load balancer's Desync mitigation mode does not match the user-defined Desync mitigation mode.", + "Name": "Google Cloud HTTP(S) Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud HTTP(S) Load Balancing" + } + ] + }, + { + "Id": "10.2.1.6.6", + "Description": "Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.2.1.6.7", + "Description": "Checks if at least one Google Cloud Audit Log is configured to log data access events for all Google Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs recording data access events for Cloud Storage.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.6.8", + "Description": "Google Cloud Logging must be enabled for operational logging similar to AWS CloudTrail.", + "Name": "Google Cloud Logging", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.2.1.6.9", + "Description": "Checks if a Google Cloud Build project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Build" + } + ] + }, + { + "Id": "10.2.1.6.10", + "Description": "Checks if logging is enabled with a valid severity level for Google Cloud Database Migration Service (DMS) migration jobs. The rule is NON_COMPLIANT if logging is not enabled or migration job logging has a severity level that is not valid.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "10.2.1.6.11", + "Description": "Checks if a Google Cloud Firestore instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.2.1.6.12", + "Description": "Checks if Google Cloud VPN has logging enabled for the tunnel. The rule is NON_COMPLIANT if 'tunnel.logging' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "10.2.1.6.13", + "Description": "Checks if logging is enabled in GCP Cloud Run services. This rule is NON_COMPLIANT if any active Cloud Run service does not have the logging configuration set or the logging setting is null.", + "Name": "Cloud Run", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Run" + } + ] + }, + { + "Id": "10.2.1.6.14", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.6.15", + "Description": "Checks if Google Cloud App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the logging configuration is set to false.", + "Name": "Google Cloud App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud App Engine" + } + ] + }, + { + "Id": "10.2.1.6.16", + "Description": "Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging is not enabled or if the log bucket is not equal to the specified GCS bucket.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.6.17", + "Description": "Checks if Google Cloud Pub/Sub topics have logging enabled. The rule is NON_COMPLIANT if a topic does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.6.18", + "Description": "Checks if a Google Cloud Pub/Sub topic has Logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.6.19", + "Description": "In GCP, the equivalent service for AWS CloudTrail is Google Cloud Audit Logging, which provides similar functionality for logging and monitoring activities across your GCP projects. However, there is no direct equivalent to a multi-region setup in Google Cloud as it operates on a region-specific basis, but logs can be configured to be exported to different storage locations for centralized management.", + "Name": "Google Cloud Audit Logging", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Audit Logging" + } + ] + }, + { + "Id": "10.2.1.6.20", + "Description": "Checks if a Google Cloud SQL (PostgreSQL or MySQL) instance has Stackdriver (now Cloud Operations) logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.6.21", + "Description": "Checks if Google Cloud Platform (GCP) Virtual Private Cloud (VPC) firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the specified firewall rule.", + "Name": "Google Cloud VPC", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_subnet_flow_logs_enabled", + "compute_network_dns_logging_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.1.6.22", + "Description": "Checks if Google Cloud SQL for MySQL instances are configured to enable audit logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit logging enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.6.23", + "Description": "Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.6.24", + "Description": "Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "Google BigQuery", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.6.25", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or if it is encrypted with a different key, or if the dataset does not have access logging enabled.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.6.26", + "Description": "Checks if DNS query logging is enabled for your Google Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.2.1.6.27", + "Description": "Checks if Cloud Storage bucket logging is enabled. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.6.28", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.2.1.6.29", + "Description": "Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.1.6.30", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the specified logging configuration.", + "Name": "Google Cloud Armor", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.6.31", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.7.1", + "Description": "Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogSettings' is not present in the service configuration.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.7.2", + "Description": "Checks if all methods in Google Cloud Endpoints configurations have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.7.3", + "Description": "Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Trace", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Trace" + } + ] + }, + { + "Id": "10.2.1.7.4", + "Description": "Checks if a Google Cloud Platform (GCP) serverless API (e.g., Cloud Endpoints or API Gateway) has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or the log level is not set to ERROR or ALL.", + "Name": "Cloud Endpoints/API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Endpoints/API Gateway" + } + ] + }, + { + "Id": "10.2.1.7.5", + "Description": "Checks if Google Cloud Load Balancers are configured with a user defined Desync mitigation mode. The rule is NON_COMPLIANT if the Load Balancer's Desync mitigation mode does not match with the user defined Desync mitigation mode.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.7.6", + "Description": "Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN is not configured to log requests.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.2.1.7.7", + "Description": "Checks if at least one Google Cloud Audit Log is logging Google Cloud Storage (GCS) data events for all GCS buckets. The rule is NON_COMPLIANT if there are no audit logs that record GCS data events.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.7.8", + "Description": "In GCP, the equivalent to enabling AWS CloudTrail would be using Cloud Audit Logs for logging administrative activities on your Google Cloud resources.", + "Name": "Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.7.9", + "Description": "Checks if a Google Cloud Build configuration has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.2.1.7.10", + "Description": "Verifies whether logging is enabled with a valid severity level for Cloud SQL database replication task events in GCP. The rule is NON_COMPLIANT if logging is not enabled or the logging severity level for replication tasks in the target Cloud SQL database is invalid.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.7.11", + "Description": "Checks if a Google Cloud Firestore instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.2.1.7.12", + "Description": "Checks if Google Cloud Platform (GCP) VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'logging' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "10.2.1.7.13", + "Description": "Checks if logging is configured for active Cloud Run services. This rule is NON_COMPLIANT if an active Cloud Run service does not have logging enabled or the log configuration is null in at least one revision.", + "Name": "Cloud Run", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Run" + } + ] + }, + { + "Id": "10.2.1.7.14", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.7.15", + "Description": "Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of `enableStackdriverLogging` is false.", + "Name": "Google App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google App Engine" + } + ] + }, + { + "Id": "10.2.1.7.16", + "Description": "Checks if the Google Cloud Load Balancing has logging enabled. The rule is NON_COMPLIANT if the logging is disabled or the log bucket does not match the specified Cloud Storage bucket name.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.7.17", + "Description": "Checks if Google Cloud Pub/Sub topics have audit logging enabled. The rule is NON_COMPLIANT if a topic does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.7.18", + "Description": "Checks if a Google Cloud Pub/Sub topic has logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.7.19", + "Description": "The equivalence in GCP for enabling Cloud Audit Logs across multiple regions is to configure 'Cloud Audit Logs' to ensure that logs are captured for activities across multiple regions.", + "Name": "Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.7.20", + "Description": "Checks if a Google Cloud SQL instance has Cloud Logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Cloud Logging enabled for audit logs.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.7.21", + "Description": "Checks if GCP Firewall Rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the firewall rules. You can specify which logging type you want the rule to check.", + "Name": "Google Cloud Firewall", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_loadbalancer_logging_enabled", + "compute_subnet_flow_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "10.2.1.7.22", + "Description": "Checks if Cloud SQL for MySQL instances are configured to publish audit logs to Stackdriver Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log publishing configured.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_connections_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.7.23", + "Description": "Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.7.24", + "Description": "Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "Google BigQuery", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.7.25", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or is encrypted with another key, or if a dataset does not have audit logging enabled.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.7.26", + "Description": "Checks if DNS query logging is enabled for your Google Cloud Platform Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud Platform Cloud DNS public managed zones.", + "Name": "Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud DNS" + } + ] + }, + { + "Id": "10.2.1.7.27", + "Description": "Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.7.28", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.2.1.7.29", + "Description": "Checks if Google Cloud Virtual Private Cloud (Google Cloud VPC) flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.1.7.30", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the expected value.", + "Name": "Google Cloud Armor", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.7.31", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.1", + "Description": "Checks if Google Cloud API Gateway has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' is not present in API configuration.", + "Name": "Google Cloud API Gateway", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.2.1.2", + "Description": "Checks if all methods in Google Cloud Endpoints or Apigee API Gateway have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if log level is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints / Apigee API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints / Apigee API Gateway" + } + ] + }, + { + "Id": "10.2.1.3", + "Description": "Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Google Cloud Trace is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.1.4", + "Description": "Checks if a Google Cloud Platform (GCP) API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or 'logLevel' is neither ERROR nor ALL.", + "Name": "Google Cloud API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.2.1.5", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers are configured with a user defined Desync mitigation mode. The rule is NON_COMPLIANT if the HTTP(S) Load Balancer Desync mitigation mode does not match with user defined Desync mitigation mode.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.6", + "Description": "Checks if Google Cloud CDN has logging configured to send access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.2.1.7", + "Description": "Checks if at least one Google Cloud Audit Log is logging Cloud Storage data access events for all Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs that record Cloud Storage data access events.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.8", + "Description": "In Google Cloud Platform (GCP), the equivalent of AWS CloudTrail is Cloud Audit Logs, which track all actions in Google Cloud services. The rule identifier might be different, but it serves a similar purpose of monitoring and logging account activity.", + "Name": "Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.9", + "Description": "Checks if a Google Cloud Build trigger has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.2.1.10", + "Description": "Checks if logging is enabled with a valid severity level for Google Cloud SQL database audit logs. The rule is NON_COMPLIANT if logging is not enabled or database logging has a severity level that is not valid.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_connections_flag" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.11", + "Description": "Checks if a Google Cloud Firestore or Google Cloud Datastore instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Firestore or Datastore instance does not have logging enabled for audit logs.", + "Name": "Google Cloud Firestore / Google Cloud Datastore", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firestore / Google Cloud Datastore" + } + ] + }, + { + "Id": "10.2.1.12", + "Description": "Checks if Google Cloud VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'logging.enabled' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "10.2.1.13", + "Description": "Checks if logging is configured for active Google Kubernetes Engine (GKE) Pod specifications. This rule is NON_COMPLIANT if an active GKE Pod does not have the logging configuration defined or if the logging configuration is null in at least one container definition.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.14", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.1.15", + "Description": "Checks if Google Cloud Platform App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'serviceAccountManaged' is false.", + "Name": "Google Cloud Logging", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.2.1.16", + "Description": "Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if ", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.1.17", + "Description": "Checks if Google Cloud Pub/Sub topics have Cloud Audit Logs enabled. The rule is NON_COMPLIANT if a topic does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.18", + "Description": "Checks if a Google Cloud Pub/Sub service has audit logging enabled. The rule is NON_COMPLIANT if the service does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.1.19", + "Description": "This rule checks whether Cloud Trail is enabled in multiple regions within GCP. The equivalent service in GCP is Cloud Audit Logs, which provides a similar audit trail capability across multiple regions.", + "Name": "Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Audit Logs" + } + ] + }, + { + "Id": "10.2.1.20", + "Description": "Checks if a Google Cloud Spanner instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have logging enabled for audit logs.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "10.2.1.21", + "Description": "Checks if GCP VPC Service Controls have logging enabled. The rule is NON_COMPLIANT if the logging configuration for the service perimeter is not set. You can specify which logging type you want the rule to check.", + "Name": "Google Cloud VPC Service Controls", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC Service Controls" + } + ] + }, + { + "Id": "10.2.1.22", + "Description": "Checks if Google Cloud SQL for MySQL instances are configured to export logs to Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log export configured.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.23", + "Description": "Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.1.24", + "Description": "Checks if Google BigQuery is configured to log audit logs to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "BigQuery", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "10.2.1.25", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the dataset is not encrypted at rest or if it does not have audit logging enabled.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.1.26", + "Description": "Checks if DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.2.1.27", + "Description": "Checks if logging is enabled for your Google Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.1.28", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.2.1.29", + "Description": "Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.1.30", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the expected configuration.", + "Name": "Google Cloud Armor", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.1.31", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.2.1", + "Description": "Checks if Google Cloud Endpoints configurations have access logging enabled. The rule is NON_COMPLIANT if 'accessLog' settings are not present in the API configuration.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "iam_audit_logs_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.2.2", + "Description": "Verifies whether all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.2.3", + "Description": "Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints APIs. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Trace", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Trace" + } + ] + }, + { + "Id": "10.2.2.4", + "Description": "Checks if a Google Cloud Endpoints API has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or the log level is neither ERROR nor ALL.", + "Name": "Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Endpoints" + } + ] + }, + { + "Id": "10.2.2.5", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers are configured with the user-defined settings for connection draining. The rule is NON_COMPLIANT if the connection draining settings do not match the user-defined parameters.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.2.6", + "Description": "Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.2.2.7", + "Description": "Checks if at least one Google Cloud Audit Log is enabled for Google Cloud Storage (GCS) data access events across all GCS buckets. The rule is NON_COMPLIANT if there are no audit logs recording GCS data events.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.2.8", + "Description": "GCP equivalent of enabling Cloud Audit Logs for project-level auditing.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudsql_instance_postgres_enable_pgaudit_flag" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.2.2.9", + "Description": "Checks if a Google Cloud Build (GCB) trigger has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present logging configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.2.2.10", + "Description": "Verifies if logging is enabled with a valid severity level for Google Cloud Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or if the replication task logging of a target database has an invalid severity level.", + "Name": "Google Cloud Database Migration Service (DMS)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Database Migration Service (DMS)" + } + ] + }, + { + "Id": "10.2.2.11", + "Description": "Checks if a Google Cloud Firestore (with MongoDB compatibility) instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.2.2.12", + "Description": "Checks if Google Cloud VPN has logging enabled for the connection. The rule is NON_COMPLIANT if 'LogConfig.enabled' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "10.2.2.13", + "Description": "Checks if log configuration is set on active Cloud Run services. This rule is NON_COMPLIANT if an active Cloud Run service does not have the logging configuration defined or the logging setting is null in at least one revision.", + "Name": "Cloud Run", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Cloud Run" + } + ] + }, + { + "Id": "10.2.2.14", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.2.2.15", + "Description": "Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'logSeverity' is not set or 'logSeverity' is configured incorrectly.", + "Name": "Google App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google App Engine" + } + ] + }, + { + "Id": "10.2.2.16", + "Description": "Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the loggingConfig.enable is false or loggingConfig.logBucket is not equal to the specified logBucketName.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.2.2.17", + "Description": "Checks if Google Cloud Pub/Sub topic message logging is enabled. The rule is NON_COMPLIANT if a topic does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.2.18", + "Description": "Checks if a Google Cloud Pub/Sub service has Logging enabled for audit purposes. The rule is NON_COMPLIANT if the service does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.2.2.19", + "Description": "The Google Cloud Platform (GCP) equivalent for enabling multi-region logging is using Google Cloud Logging with the configuration to ensure that logs are retained across multiple regions, similar to AWS CloudTrail's multi-region capability.", + "Name": "Google Cloud Logging", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.2.2.20", + "Description": "Checks if a Google Cloud Spanner instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "10.2.2.21", + "Description": "Checks if Google Cloud Platform (GCP) VPC firewall rules have logging enabled. The rule is NON_COMPLIANT if the logging for a specific action (such as 'allowed' or 'denied') is not configured. You can specify which logging type you want the rule to check.", + "Name": "Google Cloud VPC", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_subnet_flow_logs_enabled", + "compute_network_dns_logging_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.2.22", + "Description": "Checks if Google Cloud SQL for MySQL instances are configured to publish logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log publishing configured.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "cloudsql_instance_postgres_log_min_error_statement_flag" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.2.23", + "Description": "Checks if the respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.2.2.24", + "Description": "Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "Google BigQuery", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.2.2.25", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if a dataset does not have audit logging enabled.", + "Name": "BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "10.2.2.26", + "Description": "Checks if Cloud DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.2.2.27", + "Description": "Checks if logging is enabled for your Google Cloud Storage (GCS) buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.2.2.28", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.2.2.29", + "Description": "Checks if Google Cloud VPC flow logs are found and enabled for all Google Cloud VPC networks. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC network.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.2.2.30", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the expected value.", + "Name": "Google Cloud Armor", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.2.2.31", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.3.1.1", + "Description": "Checks if Google Cloud Endpoints has access logging enabled. The rule is NON_COMPLIANT if 'accessLogs' is not present in the Endpoints configuration.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.3.1.2", + "Description": "Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logging level is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.3.1.3", + "Description": "Checks if Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.3.1.4", + "Description": "Checks if a Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or the logging level is neither ERROR nor ALL.", + "Name": "Google Cloud API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.3.1.5", + "Description": "Checks if Google Cloud Load Balancers are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if Load Balancer Desync mitigation mode does not match with user-defined Desync mitigation mode.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.3.1.6", + "Description": "Checks if Google Cloud CDN (Content Delivery Network) is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.3.1.7", + "Description": "Checks if at least one Google Cloud Audit Log is logging Google Cloud Storage (GCS) data events for all GCS buckets. The rule is NON_COMPLIANT if there are no audit logs recording GCS data events.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.1.8", + "Description": "Equivalent rule in GCP for CLOUD_TRAIL_ENABLED is to ensure that 'Cloud Audit Logging' is enabled for projects, as it provides similar audit logging capabilities.", + "Name": "Cloud Audit Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudsql_instance_postgres_enable_pgaudit_flag" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Cloud Audit Logging" + } + ] + }, + { + "Id": "10.3.1.9", + "Description": "Checks if a Google Cloud Build trigger has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.3.1.10", + "Description": "Checks if logging is enabled with a valid severity level for GCP Cloud SQL database instances. The rule is NON_COMPLIANT if logging is not enabled or Cloud SQL instance logging has a severity level that is not valid.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_connections_flag" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.3.1.11", + "Description": "Checks if a Google Cloud Firestore instance has logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.3.1.12", + "Description": "Checks if Google Cloud Platform (GCP) VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'loggingEnabled' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "10.3.1.13", + "Description": "Checks if Logging Configuration is set on active Cloud Run services. This rule is NON_COMPLIANT if an active Cloud Run service does not have Logging Configuration defined or the value for Logging Configuration is null in at least one revision.", + "Name": "Cloud Run", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Cloud Run" + } + ] + }, + { + "Id": "10.3.1.14", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.3.1.15", + "Description": "Checks if Google App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the services are not set to enable logging.", + "Name": "Google App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google App Engine" + } + ] + }, + { + "Id": "10.3.1.16", + "Description": "Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging configuration is disabled or the log bucket does not match the specified Cloud Storage bucket name.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.3.1.17", + "Description": "Checks if Google Cloud Pub/Sub has audit logging enabled. The rule is NON_COMPLIANT if a Pub/Sub topic does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.3.1.18", + "Description": "Checks if a Cloud Pub/Sub topic has Stackdriver Logging enabled. The rule is NON_COMPLIANT if the topic does not have logging enabled.", + "Name": "Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.3.1.19", + "Description": "The GCP equivalent for enabling multi-region logging is to utilize Google Cloud's Stackdriver Logging in a multi-region configuration. This enhances the visibility and tracking of logs across different regions, similar to AWS CloudTrail's functionality for multi-region tracking.", + "Name": "Google Cloud Logging (formerly Stackdriver Logging)", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Logging (formerly Stackdriver Logging)" + } + ] + }, + { + "Id": "10.3.1.20", + "Description": "Checks if a Google Cloud Spanner instance has Stackdriver Logging enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have Stackdriver Logging enabled for audit logs.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "10.3.1.21", + "Description": "Checks if Google Cloud Firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured for the firewall rules. You can specify which logging type (e.g., 'log all', 'log denied') you want the rule to check.", + "Name": "Google Cloud VPC Firewall", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud VPC Firewall" + } + ] + }, + { + "Id": "10.3.1.22", + "Description": "Checks if Google Cloud SQL for MySQL instances are configured to export audit logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log exporting configured.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.3.1.23", + "Description": "Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types (such as general log, slow query log, or error log) are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.3.1.24", + "Description": "Checks if Google BigQuery datasets are logging audits to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "Google BigQuery", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.3.1.25", + "Description": "Checks if Google Cloud BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if a dataset does not have audit logging enabled.", + "Name": "BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "10.3.1.26", + "Description": "Checks if Cloud DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.3.1.27", + "Description": "Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "10.3.1.28", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.3.1.29", + "Description": "Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.3.1.30", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Google Cloud Armor", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.3.1.31", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.3.2.1", + "Description": "Checks if a GCP Backup resource (using Cloud Storage or native backup services) has an attached IAM policy that prevents deletion of backups. The rule is NON_COMPLIANT if the Backup resource does not have IAM policies or has policies without a suitable 'Deny' statement (for permissions like storage.objects.delete or any equivalent for protecting backup data).", + "Name": "GCP Backup Services / Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "GCP Backup Services / Cloud Storage" + } + ] + }, + { + "Id": "10.3.2.2", + "Description": "Checks that there is at least one Google Cloud Audit Logging service enabled with security best practices. This rule is COMPLIANT if there is at least one audit log that meets all necessary security configurations.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudsql_instance_postgres_enable_pgaudit_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.3.2.3", + "Description": "Checks if Google Cloud Logging Log Buckets are encrypted with a customer-managed encryption key (CMEK) or a specified key. The rule is NON_COMPLIANT if a Log Bucket is not encrypted with a CMEK or is encrypted with a key not supplied in the rule parameter.", + "Name": "Google Cloud Logging", + "Checks": [ + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "compute_instance_encryption_with_csek_enabled", + "dataproc_encrypted_with_cmks_disabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.3.2.4", + "Description": "Checks if Google Cloud Audit Logs is configured to use Customer-managed encryption keys (CMEK). The rule is COMPLIANT if the encryption key is defined in the Cloud KMS service.", + "Name": "Google Cloud Security", + "Checks": [ + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "dataproc_encrypted_with_cmks_disabled", + "compute_instance_encryption_with_csek_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Security" + } + ] + }, + { + "Id": "10.3.2.5", + "Description": "Checks if Google Cloud Audit Logs has log integrity (signed digest) enabled. Google Cloud recommends that integrity validation must be enabled for all audit logs. The rule is NON_COMPLIANT if the validation is not enabled.", + "Name": "Google Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Audit Logs" + } + ] + }, + { + "Id": "10.3.2.6", + "Description": "Checks if Google Cloud Database Migration Service (GCP DMS) migration jobs are publicly accessible. The rule is NON_COMPLIANT if the 'publiclyAccessible' field is set to true.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "10.3.2.7", + "Description": "Checks if Google Cloud Firestore database backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore database backups are public.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.3.2.8", + "Description": "Checks if Google Cloud Persistent Disk snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots are shared with 'allUsers', meaning Google Cloud snapshots are public.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.2.9", + "Description": "Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the PodSpec is set to 'false'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.3.2.10", + "Description": "Checks if Google Cloud Filestore access instances are configured to enforce a root directory. The rule is NON_COMPLIANT if the root path is set to '/' (default root directory of the file system).", + "Name": "Google Cloud Filestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "10.3.2.11", + "Description": "Checks if Google Cloud Filestore access control configurations are set up to enforce an identity by ensuring that user permissions are properly defined. The rule is NON_COMPLIANT if permissions are not defined or if provided parameters do not match access control requirements.", + "Name": "Google Cloud Filestore", + "Checks": [ + "iam_account_access_approval_enabled", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "10.3.2.12", + "Description": "Checks if a Google Cloud account has VPC firewall rules configured to block public access. The rule is NON_COMPLIANT if there are firewall rules allowing ingress traffic from 0.0.0.0/0 on ports other than port 22.", + "Name": "Google Cloud VPC Firewall Rules", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud VPC Firewall Rules" + } + ] + }, + { + "Id": "10.3.2.13", + "Description": "Checks if the Google Cloud Function IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.", + "Name": "Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Cloud Functions" + } + ] + }, + { + "Id": "10.3.2.14", + "Description": "Checks if a Google Cloud SQL for PostgreSQL or MySQL manual database snapshot is public. The rule is NON_COMPLIANT if any existing and new Cloud SQL database snapshot is public.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_ip", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.3.2.15", + "Description": "Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration.requireSsl' field is false.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.3.2.16", + "Description": "Checks if Google Cloud SQL backups are public. The rule is NON_COMPLIANT if any existing and new Google Cloud SQL backups are public.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.3.2.17", + "Description": "Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset has 'access' permissions with 'role' set to 'roles/viewer' for 'allUsers'.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.3.2.18", + "Description": "Checks if Google Cloud Storage buckets have uniform bucket-level access enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for Cloud Storage buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.2.19", + "Description": "Verifies if the required public access prevention settings are configured at the project level. The compliance rule is considered NON_COMPLIANT when the specified fields do not align with the configuration settings in the Google Cloud resource.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "bigquery_dataset_public_access", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.2.20", + "Description": "Checks if the required IAM policies or organization policies are configured at the project or organization level. The rule is NON_COMPLIANT if the configuration item does not align with the expected policies for public access.", + "Name": "Google Cloud IAM", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "10.3.2.21", + "Description": "Checks if Google Cloud Storage (GCS) buckets are publicly accessible. The rule is NON_COMPLIANT if a GCS bucket is not listed in the excludedPublicBuckets parameter and the uniform bucket-level access is disabled (allowing public access).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.2.22", + "Description": "Checks if Object Versioning is enabled in Google Cloud Storage (GCS) buckets. The rule is NON_COMPLIANT if Object Versioning is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.2.23", + "Description": "Checks if your Google Cloud Storage buckets do not allow public access. The rule checks the Uniform Resource Identifier (URI) access control settings, IAM policies, and the bucket ACL.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.2.24", + "Description": "Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform bucket-level access settings, bucket policy, and bucket access control list (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.2.25", + "Description": "Checks if direct internet access is disabled for a Google AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.", + "Name": "Google AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google AI Platform Notebooks" + } + ] + }, + { + "Id": "10.3.2.26", + "Description": "Checks if Google Cloud Documents (specifically, Cloud Storage buckets or Pub/Sub topics) owned by the account are public. The rule is NON_COMPLIANT if Cloud Storage buckets or Pub/Sub topics with the owner 'Self' are publicly accessible.", + "Name": "Cloud Storage / Pub/Sub", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Cloud Storage / Pub/Sub" + } + ] + }, + { + "Id": "10.3.3.1", + "Description": "Checks if Google Cloud SQL instances are protected by a backup plan. The rule is NON_COMPLIANT if the Google Cloud SQL instance is not protected by a backup plan.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.3.3.2", + "Description": "Checks if a backup policy has a backup rule that meets the required frequency and retention duration. The rule is NON_COMPLIANT if recovery snapshots are not created at least as frequently as the specified schedule or expire before the designated retention period.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "10.3.3.3", + "Description": "Verifies that a backup or snapshot's retention policy for a Google Cloud Platform (GCP) resource, such as a Cloud Storage bucket or Compute Engine snapshot, meets the specified minimum retention period. If a backup's retention point is less than the required retention period, the rule is considered NON_COMPLIANT.", + "Name": "Cloud Storage / Compute Engine Snapshots", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Cloud Storage / Compute Engine Snapshots" + } + ] + }, + { + "Id": "10.3.3.4", + "Description": "Checks that there is at least one Google Cloud Audit Log enabled with security best practices. This rule is COMPLIANT if there is at least one log that meets all of the following security configurations.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_connections_flag" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.3.3.5", + "Description": "Checks if Google Cloud Logging Log Buckets are encrypted with Google Cloud KMS keys. The rule is NON_COMPLIANT if a Log Bucket is not encrypted with a KMS key or is encrypted with a KMS key not supplied in the rule parameter.", + "Name": "Google Cloud Logging", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.3.3.6", + "Description": "Checks if Google Cloud Audit Logging is configured to use Google Cloud Key Management Service (Cloud KMS) for encryption. The rule is COMPLIANT if the KmsKeyId is defined.", + "Name": "Google Cloud Audit Logging", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Audit Logging" + } + ] + }, + { + "Id": "10.3.3.7", + "Description": "Checks if Google Cloud Audit Logs allows for log ingestion integrity verification. Google Cloud recommends that log integrity check should be enabled for all audit logs. The rule is NON_COMPLIANT if integrity verification is not enabled.", + "Name": "Google Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Audit Logs" + } + ] + }, + { + "Id": "10.3.3.8", + "Description": "Checks if Cloud SQL instances have automated backups enabled. Optionally, the rule checks the backup retention period and the backup window.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.3.3.9", + "Description": "Checks whether Google Cloud Firestore collections are included in Google Cloud Backup plans. The rule is NON_COMPLIANT if Google Cloud Firestore collections are not present in any Google Cloud Backup plan.", + "Name": "Google Cloud Backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Backup" + } + ] + }, + { + "Id": "10.3.3.10", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore collections. The rule is NON_COMPLIANT if PITR is not enabled for Firestore collections.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.3.3.11", + "Description": "Checks if Google Cloud Firestore collections are protected by a backup plan. The rule is NON_COMPLIANT if the Firestore collection is not covered by a backup plan.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.3.3.12", + "Description": "Check if Google Cloud Persistent Disk snapshots are included in Google Cloud Backup plans. The rule is NON_COMPLIANT if Google Cloud Persistent Disk snapshots are not included in backup plans.", + "Name": "Google Cloud Backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Backup" + } + ] + }, + { + "Id": "10.3.3.13", + "Description": "Checks if Google Persistent Disks are protected by a backup plan. The rule is NON_COMPLIANT if the Google Persistent Disk is not covered by a backup plan.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.3.14", + "Description": "Checks if Google Compute Engine (GCE) instances are protected by a backup plan. The rule is NON_COMPLIANT if the Google Compute Engine instance is not covered by a backup plan.", + "Name": "Google Compute Engine", + "Checks": [ + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "10.3.3.15", + "Description": "Checks if Google Cloud Filestore instances are included in the backup plans of Google Cloud Backup. The rule is NON_COMPLIANT if Filestore instances are not included in the backup plans.", + "Name": "Google Cloud Backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Backup" + } + ] + }, + { + "Id": "10.3.3.16", + "Description": "Checks if Google Cloud Filestore instances are protected by a backup plan. The rule is NON_COMPLIANT if the Filestore instance is not covered by a backup plan.", + "Name": "Google Cloud Filestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "10.3.3.17", + "Description": "Check if the Google Cloud Memorystore for Redis instances have automatic backup turned on. The rule is NON_COMPLIANT if the Redis instance backup frequency is less than the specified retention period. For example: If the parameter is 15 days, then the rule is non-compliant if the backup frequency is set to less than 15 days.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "10.3.3.18", + "Description": "Checks if Google Cloud Filestore instances are protected by a backup plan. The rule is NON_COMPLIANT if the Google Cloud Filestore instance is not covered by a backup plan.", + "Name": "Google Cloud Filestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "10.3.3.19", + "Description": "Checks if a Google Cloud SQL instance retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Google Cloud SQL", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.3.3.20", + "Description": "Checks if Google Cloud SQL databases are present in Google Cloud Backup plans. The rule is NON_COMPLIANT if Google Cloud SQL databases are not included in any Google Cloud Backup plan.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.3.3.21", + "Description": "Checks if Google Cloud SQL instances are protected by a backup plan. The rule is NON_COMPLIANT if the Google Cloud SQL Database instance is not covered by a backup plan.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.3.3.22", + "Description": "Checks that Google Cloud BigQuery automated snapshots are enabled for datasets. The rule is NON_COMPLIANT if the value for snapshot retention period is greater than MaxRetentionPeriod or less than MinRetentionPeriod or the value is 0.", + "Name": "Google Cloud BigQuery", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud BigQuery" + } + ] + }, + { + "Id": "10.3.3.23", + "Description": "Checks if GCS (Google Cloud Storage) buckets are publicly accessible. The rule is NON_COMPLIANT if a GCS bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.3.24", + "Description": "Checks if Google Cloud Storage (GCS) buckets are protected by a backup plan. The rule is NON_COMPLIANT if the GCS bucket is not covered by a backup plan.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.4.1", + "Description": "Checks if a Google Cloud CDN (Content Delivery Network) distribution with Google Cloud Storage as the origin has an authorized service account configured. The rule is NON_COMPLIANT if the CDN distribution is backed by Google Cloud Storage and the origin service account is not configured correctly, or the origin is not a Google Cloud Storage bucket.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.3.4.2", + "Description": "Checks if a Google Cloud CDN service with a Google Cloud Storage origin has signed URLs enabled. The rule is NON_COMPLIANT for Cloud CDN services with Google Cloud Storage origins that don't have signed URLs enabled.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.3.4.3", + "Description": "Checks that there is at least one Google Cloud Audit Log configured with security best practices. This rule is COMPLIANT if there is at least one log that meets all of the following standards.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudsql_instance_postgres_log_min_error_statement_flag" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.3.4.4", + "Description": "Checks if Google Cloud Logging (formerly Stackdriver Logging) Logs are encrypted with Google-managed or customer-managed encryption keys. The rule is NON_COMPLIANT if a Log Bucket is not encrypted with a KMS key or is encrypted with a KMS key not specified in the rule parameter.", + "Name": "Google Cloud Logging", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.3.4.5", + "Description": "Checks if Google Cloud Audit Logs is configured to use Customer-managed encryption keys (Cmek) for logs. The rule is COMPLIANT if the kmsKeyName is defined.", + "Name": "Google Cloud Audit Logs", + "Checks": [ + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "dataproc_encrypted_with_cmks_disabled", + "compute_instance_encryption_with_csek_enabled" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Audit Logs" + } + ] + }, + { + "Id": "10.3.4.6", + "Description": "Checks if Google Cloud Audit Logs have integrity checking enabled. Google Cloud recommends that integrity checking must be enabled for all logs. The rule is NON_COMPLIANT if the integrity checking is not enabled.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.3.4.7", + "Description": "Checks if the Cloud Storage bucket has Object Versioning enabled, by default. The rule is NON_COMPLIANT if Object Versioning is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.3.4.8", + "Description": "Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and the bucket-level settings are public.", + "Name": "Google Cloud Storage (GCS)", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage (GCS)" + } + ] + }, + { + "Id": "10.3.4.9", + "Description": "Checks if versioning is enabled for your Google Cloud Storage buckets. Optionally, the rule checks if Object Versioning with minimum retention policies is configured for your buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.4.1.1.1", + "Description": "Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Trace", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Trace" + } + ] + }, + { + "Id": "10.4.1.1.2", + "Description": "Checks if a resource type has a Google Cloud Monitoring alerting policy for the specified metric. For resource types, you can specify Google Cloud Storage buckets, Compute Engine instances, Cloud SQL instances, or persistent disks. The rule is COMPLIANT if the specified metric has a resource ID and an associated alerting policy.", + "Name": "Cloud Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Cloud Monitoring" + } + ] + }, + { + "Id": "10.4.1.1.3", + "Description": "Checks if Google Cloud Audit Logs are configured to export logs to Google Cloud Storage. The audit configuration is NON_COMPLIANT if the export destination for logs is empty.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.4.1.1.4", + "Description": "Checks if Stackdriver Monitoring is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "10.4.1.1.5", + "Description": "Checks if Google Cloud Security Command Center (SCC) is enabled for a GCP project. The rule is NON_COMPLIANT if Google Cloud SCC is not enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "10.4.1.1.6", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.4.1.1.7", + "Description": "Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'monitoringConfig.enabled' field is set to false.", + "Name": "Google Cloud Armor", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.4.1.1", + "Description": "Checks if Google Cloud Trace tracing is enabled on Google Cloud API Gateway. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.4.1.2", + "Description": "Checks if a resource type has a Cloud Monitoring alerting policy for the specified metric. For resource types, you can specify Google Compute Engine instances, Google Kubernetes Engine clusters, Cloud SQL instances, or Google Cloud Storage buckets. The rule is COMPLIANT if the specified metric has a resource ID and a corresponding alerting policy.", + "Name": "Google Cloud Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "10.4.1.3", + "Description": "Checks if Stackdriver Monitoring (now known as Cloud Monitoring) is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.", + "Name": "Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Cloud Monitoring" + } + ] + }, + { + "Id": "10.4.1.4", + "Description": "Checks if Google Cloud Security Command Center (SCC) is enabled for a Google Cloud Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "10.4.1.5", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.4.1.6", + "Description": "Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'visible' field is set to false.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.4.2.1", + "Description": "Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.4.2.2", + "Description": "Checks if Google Cloud Monitoring (formerly Stackdriver Monitoring) alert policies have an action configured for the 'ALERTING', 'NO_DATA', or 'CLOSED' state. Optionally checks if any actions match a named notification channel. The rule is NON_COMPLIANT if there is no action specified for the alert policy or optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "10.4.2.3", + "Description": "Checks if a resource type has a Cloud Monitoring alert policy for the specified metric. For resource types, you can specify Google Compute Engine instances, Google Cloud Storage buckets, or Google SQL instances. The rule is COMPLIANT if the named metric has a resource ID and a Cloud Monitoring alert policy.", + "Name": "Cloud Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Cloud Monitoring" + } + ] + }, + { + "Id": "10.4.2.4", + "Description": "Checks if Stackdriver monitoring (now known as Google Cloud Operations suite) is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.", + "Name": "Google Cloud Operations", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Operations" + } + ] + }, + { + "Id": "10.4.2.5", + "Description": "Checks if Google Cloud Security Command Center (SCC) is enabled for a GCP Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "10.4.2.6", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.4.2.7", + "Description": "Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'monitoringEnabled' field is set to false.", + "Name": "Google Cloud Armor", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.4.3.1", + "Description": "Checks if Google Cloud Monitoring alerting policies have a notification channel configured for the 'Triggered', 'Pending', or 'OK' state. Optionally checks if any notification channels match a specified resource name. The rule is NON_COMPLIANT if there is no notification channel specified for the alerting policy or optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "10.5.1.1", + "Description": "Verifies if a Google Cloud Platform (GCP) backup plan has a backup policy that meets the required frequency and retention period. The policy is deemed NON_COMPLIANT if recovery points are not created as often as the specified frequency or if they expire before the specified retention period.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "10.5.1.2", + "Description": "Checks if a backup retention policy in Google Cloud Storage or Google Cloud Backup expires no earlier than after the specified period. The rule is NON_COMPLIANT if the backup has a retention policy that is less than the required retention period.", + "Name": "Google Cloud Backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Backup" + } + ] + }, + { + "Id": "10.5.1.3", + "Description": "Checks that there is at least one Google Cloud Audit log configuration defined with security best practices. This rule is COMPLIANT if there is at least one log configuration that meets all of the following: logging is enabled for all services and appropriate IAM policies are applied.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "compute_loadbalancer_logging_enabled", + "logging_sink_created" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.5.1.4", + "Description": "Checks if a Google Cloud Logging Log Bucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Google Cloud Logging", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.5.1.5", + "Description": "Checks if a Google Cloud Firestore backup retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the specified value.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.5.1.6", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore databases. The rule is NON_COMPLIANT if PITR is not enabled for Firestore databases.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.5.1.7", + "Description": "Checks if Persistent Disks are attached to Google Compute Engine instances. Optionally checks if Persistent Disks are set to be deleted when their associated instance is terminated.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "10.5.1.8", + "Description": "Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.", + "Name": "Google Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Container Registry" + } + ] + }, + { + "Id": "10.5.1.9", + "Description": "Checks if Google Cloud Search domains (using Google Cloud's managed search services) are configured to send logs to Google Cloud Logging. The rule is COMPLIANT if logging is enabled for a Google Cloud Search domain. This rule is NON_COMPLIANT if logging is not configured.", + "Name": "Google Cloud Logging", + "Checks": [ + "compute_network_dns_logging_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.5.1.10", + "Description": "Checks if Google Cloud Elasticsearch Service (GCP's equivalent to Amazon OpenSearch Service) has audit logging enabled. The rule is NON_COMPLIANT if an Elasticsearch Service domain does not have audit logging enabled.", + "Name": "Google Cloud Elasticsearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Elasticsearch Service" + } + ] + }, + { + "Id": "10.5.1.11", + "Description": "Checks if Google Cloud Elasticsearch clusters are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if logging is not configured.", + "Name": "Google Cloud Logging", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.5.1.12", + "Description": "Checks if a lifecycle rule is configured for a Google Cloud Storage bucket. The rule is NON_COMPLIANT if there is no active lifecycle configuration rules or the configuration does not match the specified parameter values.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.5.1.13", + "Description": "Checks if Google Cloud Storage (GCS) buckets with versioning enabled have lifecycle policies configured. The rule is NON_COMPLIANT if GCS lifecycle policy is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.6.3.1", + "Description": "Checks if Google Cloud API Gateway has access logging enabled. The rule is NON_COMPLIANT if 'accessLogSettings' is not present in the API Gateway configuration.", + "Name": "Google Cloud API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.6.3.2", + "Description": "Checks if all methods in Google Cloud API Gateway configurations have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if loggingLevel is neither ERROR nor INFO.", + "Name": "Google Cloud API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "10.6.3.3", + "Description": "Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.6.3.4", + "Description": "Checks if a Google Cloud Platform (GCP) Cloud Endpoints API has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if 'logLevel' is neither ERROR nor ALL.", + "Name": "Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Cloud Endpoints" + } + ] + }, + { + "Id": "10.6.3.5", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers are configured with a user-defined security policy to mitigate desynchronization attacks. The rule is NON_COMPLIANT if the HTTP(S) Load Balancer's security policy does not match the user-defined security policy.", + "Name": "Google Cloud HTTP(S) Load Balancer", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud HTTP(S) Load Balancer" + } + ] + }, + { + "Id": "10.6.3.6", + "Description": "Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "10.6.3.7", + "Description": "Checks if at least one Google Cloud Audit Log is logging Cloud Storage data access events for all Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs recording Cloud Storage data access events.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.6.3.8", + "Description": "Checks if Google Cloud Monitoring alerting policies have notification channels configured for the ALERTING, PENDING, or OK state. Optionally checks if any notification channels match a named channel ID. The rule is NON_COMPLIANT if there is no notification channel specified for the alerting policy or optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "10.6.3.9", + "Description": "Checks if a resource type has a Stackdriver Monitoring alerting policy for the specified metric. For resource type, you can specify Google Cloud Storage buckets, Compute Engine instances, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the specified metric has a resource ID and Stackdriver alerting policy.", + "Name": "Stackdriver Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Stackdriver Monitoring" + } + ] + }, + { + "Id": "10.6.3.10", + "Description": "This rule checks if Cloud Audit Logs are enabled in GCP, which is equivalent to the AWS rule for ensuring that CloudTrail is enabled. The main service involved is Cloud Logging.", + "Name": "Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Cloud Logging" + } + ] + }, + { + "Id": "10.6.3.11", + "Description": "Checks if a Google Cloud Build trigger has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "10.6.3.12", + "Description": "Checks if logging is enabled with a valid severity level for Google Cloud SQL database replication events. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.6.3.13", + "Description": "Checks if a Google Cloud Firestore instance has Cloud Logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Cloud Logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "10.6.3.14", + "Description": "Checks if GCP Cloud VPN has logging enabled for its tunnels. The rule is NON_COMPLIANT if 'logConfig.loggingEnabled' is set to false.", + "Name": "GCP Cloud VPN", + "Checks": [ + "compute_network_dns_logging_enabled", + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "GCP Cloud VPN" + } + ] + }, + { + "Id": "10.6.3.15", + "Description": "Checks if 'Stackdriver Monitoring' is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "10.6.3.16", + "Description": "Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the Pod security context is set to 'false'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.6.3.17", + "Description": "Checks if logging configuration is set on active Google Kubernetes Engine (GKE) deployments. This rule is NON_COMPLIANT if an active GKE deployment does not have logging enabled or the logging configuration is null in at least one container definition.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.6.3.18", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "10.6.3.19", + "Description": "Checks if Google Cloud Platform App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.", + "Name": "Google Cloud Logging", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "10.6.3.20", + "Description": "Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging is not enabled or the log bucket does not match the specified bucket name.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "10.6.3.21", + "Description": "Verifies if IAM users are part of at least one IAM group in Google Cloud Platform.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "10.6.3.22", + "Description": "Checks if Google Cloud Pub/Sub has logs enabled for audit logging. The rule is NON_COMPLIANT if Pub/Sub does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.6.3.23", + "Description": "Checks if a Google Cloud Pub/Sub topic has audit logging enabled. The rule is NON_COMPLIANT if the topic does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.6.3.24", + "Description": "The GCP equivalent for the rule identifier MULTI_REGION_CLOUD_TRAIL_ENABLED in the context of multi-region logging is to ensure that audit logs for services are enabled across multiple regions. This ensures that logs are available for compliance and monitoring across geographic boundaries.", + "Name": "Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Cloud Logging" + } + ] + }, + { + "Id": "10.6.3.25", + "Description": "Checks if a Google Cloud SQL instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_statement_flag" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.6.3.26", + "Description": "Checks if Google Cloud Platform (GCP) VPC firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured. You can specify which logging option you want the rule to check.", + "Name": "Google Cloud VPC", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_subnet_flow_logs_enabled", + "compute_network_dns_logging_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.6.3.27", + "Description": "Checks if Google Cloud Search instances have fine-grained access control enabled. The rule is NON_COMPLIANT if Access Control settings are not properly configured for the Cloud Search instance.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "10.6.3.28", + "Description": "Checks if Google Cloud SQL for MySQL instances are configured to enable Cloud Audit Logs. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log publishing enabled.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_mysql_skip_show_database_flag" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "10.6.3.29", + "Description": "Checks if respective logs of Google Cloud SQL are enabled. The rule is NON_COMPLIANT if any log types are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "10.6.3.30", + "Description": "Checks if Google BigQuery datasets are logging audits to a specific bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "Google BigQuery", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "10.6.3.31", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or if it is encrypted with another key, or if dataset audit logging is not enabled.", + "Name": "BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "10.6.3.32", + "Description": "Checks if DNS query logging is enabled for your Google Cloud DNS public managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS public managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "10.6.3.33", + "Description": "Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket policy does not allow another Google Cloud project to perform any storage.objects.get and storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.6.3.34", + "Description": "Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "10.6.3.35", + "Description": "Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "10.6.3.36", + "Description": "Checks if Google Cloud Security Command Center is enabled for a Google Cloud Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "10.6.3.37", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.6.3.38", + "Description": "Checks if Google Cloud Workflow has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration does not meet the minimum requirements.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "10.6.3.39", + "Description": "Checks if Google Cloud Virtual Private Cloud (Google Cloud VPC) flow logs are found and enabled for all Google Cloud VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Google Cloud VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "10.6.3.40", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the specified parameter value.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.6.3.41", + "Description": "Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The policy is NON_COMPLIANT if the 'logConfig.enable' field is set to false.", + "Name": "Google Cloud Armor", + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.6.3.42", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy, if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.7.1.1", + "Description": "Checks if Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.7.1.2", + "Description": "Checks if your Google Cloud Deployment Manager configurations send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Google Cloud Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager configurations do not send notifications.", + "Name": "Google Cloud Deployment Manager", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Deployment Manager" + } + ] + }, + { + "Id": "10.7.1.3", + "Description": "Checks if Google Cloud Monitoring alerting policies have notifications configured for various states (triggered, pending notification, and resolved). Optionally checks if any notifications match a specified topic. The rule is NON_COMPLIANT if there are no notifications specified for the alerting policy or the optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "10.7.1.4", + "Description": "Checks if a resource type has a Cloud Monitoring alert for the named metric. For resource type, you can specify Google Cloud Storage buckets, Compute Engine instances, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the named metric has a resource ID and Cloud Monitoring alert.", + "Name": "Cloud Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Cloud Monitoring" + } + ] + }, + { + "Id": "10.7.1.5", + "Description": "Checks if Stackdriver Monitoring (now Google Cloud Monitoring) is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "10.7.1.6", + "Description": "Checks if Google Cloud Security Command Center (SCC) is enabled for a Google Cloud Platform (GCP) project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "10.7.1.7", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.7.1.8", + "Description": "Checks if Google Cloud's monitoring for the Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'enableMetrics' field is set to false.", + "Name": "Google Cloud Armor", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "10.7.2.1", + "Description": "Checks if Google Cloud Trace is enabled for Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "10.7.2.2", + "Description": "Checks if your Google Cloud Deployment Manager configurations send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Google Cloud Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager configurations do not send notifications.", + "Name": "Google Cloud Deployment Manager", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Deployment Manager" + } + ] + }, + { + "Id": "10.7.2.3", + "Description": "Checks if Google Cloud Monitoring alert policies have notification channels configured for the ALARM, NO_DATA, or OK state. Optionally checks if any notification channels match a specified resource name. The rule is NON_COMPLIANT if there is no notification channel specified for the alert policy or optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "10.7.2.4", + "Description": "Checks if a resource type has a Cloud Monitoring alert policy for the specified metric. For resource type, you can specify Google Cloud Storage buckets, Compute Engine instances, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the specified metric has a resource ID and a Cloud Monitoring alert policy.", + "Name": "Cloud Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Cloud Monitoring" + } + ] + }, + { + "Id": "10.7.2.5", + "Description": "Checks if Stackdriver Monitoring (now part of Google Cloud Operations Suite) is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if detailed monitoring is not enabled.", + "Name": "Google Cloud Operations Suite", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Operations Suite" + } + ] + }, + { + "Id": "10.7.2.6", + "Description": "Checks if Google Cloud Security Command Center is enabled for a GCP Project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "10.7.2.7", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for message delivery status. The rule is NON_COMPLIANT if delivery status notifications for messages are not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "10.7.2.8", + "Description": "Checks if Google Cloud Monitoring security metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'enableMonitoring' field is set to false.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "11.3.1.1.1", + "Description": "Check if specified applications are installed on a Compute Engine instance, with an option to specify minimum versions and platforms.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "11.3.1.1.2", + "Description": "Checks if the compliance status of Google Cloud OS Config patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the Compute Engine instance. The rule is compliant if the field status is COMPLIANT.", + "Name": "Google Cloud OS Config", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.", + "Service": "Google Cloud OS Config" + } + ] + }, + { + "Id": "11.3.1.2.1", + "Description": "Checks if a private Google Container Registry (GCR) repository has vulnerability scanning enabled. The rule is NON_COMPLIANT if the private GCR repository's scan frequency is not set to scan on push or continuous scan. For more information on enabling vulnerability scanning, see Vulnerability scanning in the Google Container Registry documentation.", + "Name": "Google Container Registry (GCR)", + "Checks": [ + "gcr_container_scanning_enabled", + "artifacts_container_analysis_enabled" + ], + "Attributes": [ + { + "Section": "11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed.", + "Service": "Google Container Registry (GCR)" + } + ] + }, + { + "Id": "11.3.1.3.1", + "Description": "Verifies if the specified applications are installed on a Google Cloud instance, with the option to define the minimum acceptable version and restrict the rule to specific platforms (e.g., Linux, Windows).", + "Name": "Google Cloud Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "11.3.1.3.2", + "Description": "Checks if the compliance status of the Google Cloud OS Config patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance. The rule is compliant if the field status is COMPLIANT.", + "Name": "Google Cloud OS Config", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.", + "Service": "Google Cloud OS Config" + } + ] + }, + { + "Id": "11.3.1.3.3", + "Description": "Checks if a private Google Container Registry (GCR) repository has vulnerability scanning enabled. The rule is NON_COMPLIANT if the private GCR repository's scan frequency is not set to scan on push or continuous scan. For more information on enabling image vulnerability scanning, see Container Analysis API documentation.", + "Name": "Google Container Registry", + "Checks": [ + "gcr_container_scanning_enabled", + "artifacts_container_analysis_enabled" + ], + "Attributes": [ + { + "Section": "11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.", + "Service": "Google Container Registry" + } + ] + }, + { + "Id": "11.3.1.1", + "Description": "Checks if all of the specified applications are installed on the Google Compute Engine instance. Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to instances running that platform.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "11.3.1.2", + "Description": "Checks if the compliance status of Google Cloud's OS Config patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the instance. The rule is compliant if the field status is COMPLIANT.", + "Name": "OS Config", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.", + "Service": "OS Config" + } + ] + }, + { + "Id": "11.3.1.3", + "Description": "Checks if a private Google Container Registry (GCR) repository has vulnerability scanning enabled. The rule is NON_COMPLIANT if the private GCR repository's scan setting is not set to either scan on push or continuous scanning. For more information on enabling vulnerability scanning, see the Google Cloud documentation for Container Analysis.", + "Name": "Google Container Registry", + "Checks": [ + "gcr_container_scanning_enabled", + "artifacts_container_analysis_enabled" + ], + "Attributes": [ + { + "Section": "11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.", + "Service": "Google Container Registry" + } + ] + }, + { + "Id": "11.5.1.1.1", + "Description": "Checks whether a Google Cloud Load Balancer or Cloud CDN has Google Cloud Armor protection. It also checks if they have Security Policies associated for Google Cloud Load Balancer and Cloud CDN.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "11.5.1.1.2", + "Description": "Checks if Google Cloud Security Command Center (SCC) is enabled in your Google Cloud account and project. If you provide a GCP project for centralization, the rule evaluates the SCC results in the centralized project. The rule is COMPLIANT when SCC is enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "11.5.1.1", + "Description": "Checks whether a Google Cloud Load Balancer or Cloud CDN has Google Cloud Armor protection. It also checks if they have security policies associated for Google Cloud Load Balancer and Cloud CDN.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.1: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "11.5.1.2", + "Description": "Checks if Google Cloud Security Command Center (SCC) is enabled in your GCP project. The rule evaluates the SCC results in the specified GCP project. The rule is COMPLIANT when Security Command Center is enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.1: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "11.5.2.1", + "Description": "Checks if your Google Cloud Deployment Manager configurations send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Google Cloud Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager configurations do not send notifications.", + "Name": "Google Cloud Deployment Manager", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Deployment Manager" + } + ] + }, + { + "Id": "11.5.2.2", + "Description": "Checks if Google Cloud Monitoring Uptime Checks have an alerting policy configured for the HEALTHY, UNHEALTHY, or DISABLED state. Optionally checks if any actions match a specific notification channel. The rule is NON_COMPLIANT if there is no action specified for the alerting policy or optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "11.5.2.3", + "Description": "Checks whether Google Cloud Monitoring alerts with the given metric name have the specified settings.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "11.5.2.4", + "Description": "Checks if Google Cloud Audit Logs are configured to send logs to Google Cloud Logging. The audit log configuration is NON_COMPLIANT if the log sink is not set up or does not route logs correctly.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_sink_created" + ], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "11.5.2.5", + "Description": "Checks if Google Cloud Storage Object Change Notifications are enabled on a Cloud Storage bucket. The rule is NON_COMPLIANT if Cloud Storage Object Change Notifications are not set on a bucket, or if the notification type or destination do not match the event types and destination fields.", + "Name": "Google Cloud Storage", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "11.5.2.6", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for message delivery status of notifications sent to a topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "11.6.1.1", + "Description": "Checks if your Google Cloud Deployment Manager templates send notifications to a Google Cloud Pub/Sub topic. The rule is NON_COMPLIANT if Deployment Manager templates do not send notifications.", + "Name": "Google Cloud Deployment Manager", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to.", + "Service": "Google Cloud Deployment Manager" + } + ] + }, + { + "Id": "11.6.1.2", + "Description": "Checks if Google Cloud Monitoring alert policies have an action configured for the ALERT, NO_DATA, or OK state. Optionally checks if any actions match a specified notification channel. The rule is NON_COMPLIANT if there is no action specified for the alert policy or optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "11.6.1.3", + "Description": "Checks whether Google Cloud Monitoring alerting policies with the given metric type have the specified settings.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "11.6.1.4", + "Description": "Checks if Google Cloud Audit Logs are configured to send logs to Cloud Logging. The audit log configuration is NON_COMPLIANT if the corresponding sink is not creating logs in Cloud Logging.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "11.6.1.5", + "Description": "Checks if Google Cloud Storage (GCS) Notifications are enabled on a GCS bucket. The rule is NON_COMPLIANT if GCS Notifications are not set on a bucket, or if the event type or destination do not match the defined event types and notification destination.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "11.6.1.6", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of notification messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "12.10.5.1", + "Description": "Checks if your Google Cloud Deployment Manager templates send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Google Cloud Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager templates do not send notifications.", + "Name": "Google Cloud Deployment Manager", + "Checks": [], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.", + "Service": "Google Cloud Deployment Manager" + } + ] + }, + { + "Id": "12.10.5.2", + "Description": "Checks if Google Cloud Monitoring alerts have an action configured for the ALERT, NO_DATA, or OK state. Optionally checks if any actions match a named notification channel. The rule is NON_COMPLIANT if there is no action specified for the alert or optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "12.10.5.3", + "Description": "Checks whether Google Cloud Monitoring alert policies with the given metric type have the specified settings.", + "Name": "Google Cloud Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "12.10.5.4", + "Description": "Checks if Google Cloud Audit Logs are configured to send logs to Google Cloud Logging. The audit log is NON_COMPLIANT if the log sink is not configured to export logs to Cloud Logging.", + "Name": "Google Cloud Audit Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_sink_created" + ], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.", + "Service": "Google Cloud Audit Logging" + } + ] + }, + { + "Id": "12.10.5.5", + "Description": "Checks if Google Cloud Storage Notifications are enabled on a Cloud Storage bucket. The rule is NON_COMPLIANT if Cloud Storage Notifications are not set on a bucket, or if the event type or destination do not match the specified eventTypes and destination parameters.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "12.10.5.6", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for message delivery status notifications sent to a topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notifications for messages are not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "12.4.2.1.1", + "Description": "Checks if Google Cloud Resource Manager shares projects with an organization when integration is enabled with Cloud Identity. The rule is NON_COMPLIANT if the project is shared with individual users rather than the organization.", + "Name": "Google Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "12.4.2.1: PCI DSS compliance is managed.", + "Service": "Google Cloud Resource Manager" + } + ] + }, + { + "Id": "2.2.5.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP load balancers. The rule is NON_COMPLIANT if one or more HTTP load balancers do not have HTTP to HTTPS redirection configured, or if one or more HTTP load balancers have forwarding to an HTTP backend instead of redirection.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "2.2.5.2", + "Description": "Checks if Google Cloud CDN is using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for a Google Cloud CDN configuration if any 'OriginSslProtocols' includes 'SSLv3'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "2.2.5.3", + "Description": "Checks if Google Cloud CDN backends are using a minimum security policy and cipher suite of TLSv1.2 or greater for viewer connections. This rule is NON_COMPLIANT for a Cloud CDN backend if the minimumProtocolVersion is below TLSv1.2.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "2.2.5.4", + "Description": "Checks if Google Cloud CDN services are using a custom SSL certificate and are configured to use SNI to serve HTTPS requests. The rule is NON_COMPLIANT if a custom SSL certificate is associated but the SSL support method is a dedicated IP address.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "2.2.5.5", + "Description": "Checks if Google Cloud CDN is encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'OriginProtocolPolicy' is set to 'HTTP_ONLY' or if 'OriginProtocolPolicy' is set to 'match-viewer' and 'ViewerProtocolPolicy' is 'ALLOW_ALL'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "2.2.5.6", + "Description": "Checks if your Google Cloud CDN configurations use HTTPS for serving content. The rule is NON_COMPLIANT if the value of 'enableBackendService' is set to 'true' without enforcing HTTPS for backend services.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "2.2.5.7", + "Description": "Check if Google Cloud Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled on the service.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "2.2.5.8", + "Description": "Checks whether your Google Cloud Load Balancer SSL proxies are using a custom SSL policy. The rule is only applicable if there are SSL proxies for the Load Balancer.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "2.2.5.9", + "Description": "Checks if your Google Cloud Load Balancer SSL certificates use a predefined policy. The rule is NON_COMPLIANT if the Google Cloud Load Balancer's HTTPS/SSL certificate policy does not equal the value of the parameter 'predefinedPolicyName'.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "2.2.5.10", + "Description": "Checks if your Cloud Load Balancer is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured with SSL or HTTPS.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "2.2.5.11", + "Description": "Checks if Google Cloud Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if no security configuration is attached to the cluster or the security configuration does not meet the specified rule parameters.", + "Name": "Google Cloud Dataproc", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Dataproc" + } + ] + }, + { + "Id": "2.2.5.12", + "Description": "Checks whether connections to Google Cloud Elasticsearch clusters are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Elasticsearch cluster 'enableHttps' is not true or is true, and 'minimumTlsVersion' is not in 'tlsVersions'.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "2.2.5.13", + "Description": "Check if Google Cloud's Elasticsearch Service nodes are encrypted end-to-end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the Elasticsearch instance.", + "Name": "Google Cloud Elasticsearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Elasticsearch Service" + } + ] + }, + { + "Id": "2.2.5.14", + "Description": "Checks if Google BigQuery datasets require TLS/SSL encryption to connect to SQL clients. The rule is NON_COMPLIANT if any Google BigQuery dataset does not have encryption enabled for data in transit.", + "Name": "Google BigQuery", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "2.2.5.15", + "Description": "Checks if Cloud Storage buckets have policies that require requests to use HTTPS. The rule is NON_COMPLIANT if any Cloud Storage bucket has policies allowing HTTP requests.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "2.2.5.16", + "Description": "Checks if a server created with Google Cloud Storage uses FTP for data transfer. The rule is NON_COMPLIANT if the server protocol for data transfer is FTP-enabled.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "2.2.5.17", + "Description": "Checks if Google Cloud Firewall rules allow unrestricted incoming traffic ('0.0.0.0/0' or '::/0') and verify if only authorized TCP or UDP connections on specified ports are permitted. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "2.2.7.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP load balancers. The rule is NON_COMPLIANT if one or more HTTP load balancers do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP load balancers have forwarding to an HTTP load balancer instead of redirection.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "2.2.7.2", + "Description": "Checks if Google Cloud CDN is using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for a Cloud CDN configuration if any 'OriginSslProtocols' includes 'SSLv3'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "2.2.7.3", + "Description": "Checks if Google Cloud CDN configurations are encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'originProtocol' is 'HTTP_ONLY' or if 'originProtocol' is 'MATCH_VIEWER' and 'viewerProtocol' is 'ALLOW_ALL'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "2.2.7.4", + "Description": "Checks if your Google Cloud CDN configurations use HTTPS. The rule is NON_COMPLIANT if the value of 'enableHttp2' is set to 'true' while 'enableCaching' is set to 'true', but the backend service does not support HTTPS.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "2.2.7.5", + "Description": "Checks if your Google Cloud Firestore in Datastore mode has TLS enabled for secure connections. The rule is NON_COMPLIANT if Firestore is not encrypted by transport layer security (TLS).", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "2.2.7.6", + "Description": "Checks if Google Cloud Database Migration service endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Google Cloud Database Migration service does not have an SSL connection configured.", + "Name": "Google Cloud Database Migration Service", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "2.2.7.7", + "Description": "Checks if Google Cloud Database Migration Service endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "2.2.7.8", + "Description": "Checks if Google Cloud Memorystore (Redis) instances have encryption-in-transit enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'transit_encryption_mode' is set to 'DISABLED'.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "2.2.7.9", + "Description": "Check if Google Cloud's Elasticsearch service (operated through Google Cloud Marketplace) nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the Elasticsearch cluster.", + "Name": "Google Cloud Elasticsearch (via Google Cloud Marketplace)", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Elasticsearch (via Google Cloud Marketplace)" + } + ] + }, + { + "Id": "2.2.7.10", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS frontend with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers and does not check other types of load balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "2.2.7.11", + "Description": "Checks whether your Google Cloud Load Balancer SSL proxies are using a custom SSL policy. The rule is only applicable if there are SSL proxy listeners configured for the Load Balancer.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "2.2.7.12", + "Description": "Checks if your Google Cloud Platform (GCP) HTTPS Load Balancer SSL certificates are using a predefined policy. The rule is NON_COMPLIANT if the HTTPS Load Balancer SSL certificate's policy does not equal the value of the parameter 'predefinedPolicyName'.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "2.2.7.13", + "Description": "Checks if your Google Cloud Load Balancer is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured with SSL or HTTPS.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "2.2.7.14", + "Description": "Checks if Google Cloud Dataproc clusters have IAM conditions enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or the security configuration does not satisfy the specified rule parameters.", + "Name": "Google Cloud Dataproc", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Dataproc" + } + ] + }, + { + "Id": "2.2.7.15", + "Description": "Checks if a Google Cloud Pub/Sub topic enforces encryption in transit using HTTPS (TLS) for communication with the subscribers of the topic. The rule is NON_COMPLIANT if plain text communication is enabled for in-transit messages.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "2.2.7.16", + "Description": "Checks whether connections to Google Cloud Elasticsearch (GCP equivalent of OpenSearch) are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Elasticsearch domain 'enableHttps' is not 'true' or is 'true' and 'tlsPolicy' is not in the allowed TLS policies.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "2.2.7.17", + "Description": "Check if Google Cloud's Elasticsearch on GCP (via Google Cloud Marketplace) has end-to-end encryption enabled. The rule is NON_COMPLIANT if the node-to-node encryption is not activated.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "2.2.7.18", + "Description": "Checks if Google BigQuery datasets require secure access (TLS/SSL encryption) for connections. The rule is NON_COMPLIANT if any Google BigQuery dataset does not enforce secure connections.", + "Name": "Google BigQuery", + "Checks": [ + "cloudsql_instance_ssl_connections", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "2.2.7.19", + "Description": "Checks if Cloud Storage buckets have policies that require requests to use SSL/TLS. The rule is NON_COMPLIANT if any Cloud Storage bucket has policies allowing HTTP requests.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.2.1.1", + "Description": "Checks if a backup plan in Google Cloud Platform has a backup policy that meets the necessary frequency and retention duration. The policy is NON_COMPLIANT if recovery snapshots are not taken with the required frequency or if they expire before the designated retention time.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "3.2.1.2", + "Description": "Checks if a Cloud Storage object (recovery point) retains data for at least the specified retention period. The rule is NON_COMPLIANT if the object's retention policy is less than the required retention duration.", + "Name": "Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "3.2.1.3", + "Description": "Checks if a Google Cloud Logging LogBucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Google Cloud Logging", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "3.2.1.4", + "Description": "Checks if a Google Cloud Firestore database retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.2.1.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore collections. The rule is NON_COMPLIANT if PITR is not enabled for Firestore collections.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.2.1.6", + "Description": "Checks if Persistent Disks are attached to Google Compute Engine instances. Optionally checks if Persistent Disks are set to delete on instance termination.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "3.2.1.7", + "Description": "Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.", + "Name": "Google Container Registry (GCR)", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum.", + "Service": "Google Container Registry (GCR)" + } + ] + }, + { + "Id": "3.2.1.8", + "Description": "Checks if a lifecycle rule is configured for a Google Cloud Storage bucket. The rule is NON_COMPLIANT if there is no active lifecycle configuration or the configuration does not match the parameter values.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.2.1.9", + "Description": "Checks if Google Cloud Storage (GCS) buckets with versioning enabled have lifecycle policies configured. The rule is NON_COMPLIANT if the GCS lifecycle policy is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.1.1.1", + "Description": "Verifies if a backup policy has a backup job that meets the necessary schedule and retention criteria. The job is deemed NON_COMPLIANT if recovery snapshots are not created at least as frequently as defined by the schedule or if they expire before the defined retention period.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "3.3.1.1.2", + "Description": "Checks if a recovery point expiration in Google Cloud Platform (GCP) meets the specified retention period requirements. The rule is NON_COMPLIANT if the recovery point has a retention period shorter than the required retention period, specifically for services like Google Cloud Storage or Google Cloud Backup and DR.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "3.3.1.1.3", + "Description": "Checks if a Google Cloud Logging LogBucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Google Cloud Logging", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "3.3.1.1.4", + "Description": "Checks if a Google Cloud Firestore database's retention policy is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.3.1.1.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Cloud Firestore or Cloud Bigtable tables. The rule is NON_COMPLIANT if PITR is not enabled for these tables.", + "Name": "Cloud Firestore / Cloud Bigtable", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Cloud Firestore / Cloud Bigtable" + } + ] + }, + { + "Id": "3.3.1.1.6", + "Description": "Checks if Persistent Disk volumes are attached to Compute Engine instances. Optionally checks if Persistent Disk volumes are configured to be deleted when an instance is terminated.", + "Name": "Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "3.3.1.1.7", + "Description": "Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.", + "Name": "Google Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Container Registry" + } + ] + }, + { + "Id": "3.3.1.1.8", + "Description": "Checks if a lifecycle rule is configured for a Google Cloud Storage bucket. The rule is NON_COMPLIANT if there is no active lifecycle configuration rules or the configuration does not match with the parameter values.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.1.1.9", + "Description": "Checks if Google Cloud Storage (GCS) version-enabled buckets have lifecycle management policies configured. The rule is NON_COMPLIANT if GCS lifecycle management policies are not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.1.3.1", + "Description": "Checks if a backup plan has a backup rule that meets the required frequency and retention period in Google Cloud Platform (GCP). The rule is considered NON_COMPLIANT if recovery points are not created at least as frequently as the specified frequency or if they expire before the defined retention period.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "3.3.1.3.2", + "Description": "Verifies that a backup in Google Cloud Storage does not expire before the specified retention period. The rule is NON_COMPLIANT if the backup's retention policy is set to less than the required retention period.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.1.3.3", + "Description": "Checks if a Google Cloud Logging Log Bucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Google Cloud Logging", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "3.3.1.3.4", + "Description": "Checks if a Google Cloud Firestore database's retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.3.1.3.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore databases. The rule is NON_COMPLIANT if PITR is not enabled for Firestore databases.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.3.1.3.6", + "Description": "Checks if Persistent Disks are attached to Compute Engine instances. Optionally checks if Persistent Disks are set to delete on instance termination.", + "Name": "Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "3.3.1.3.7", + "Description": "Checks if a private Google Container Registry (GCR) has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.", + "Name": "Google Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Container Registry" + } + ] + }, + { + "Id": "3.3.1.3.8", + "Description": "Checks if a lifecycle rule is configured for a Google Cloud Storage (GCS) bucket. The rule is NON_COMPLIANT if there is no active Object Lifecycle Management configuration or the configuration does not match with the parameter values.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.1.3.9", + "Description": "Checks if Google Cloud Storage (GCS) buckets with versioning enabled have lifecycle policies configured. The rule is NON_COMPLIANT if GCS lifecycle policy is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.2.1", + "Description": "Verifies if a backup plan has a backup policy that meets the required frequency and retention period. The policy is NON_COMPLIANT if recovery points are not created at least as frequently as specified or are deleted before the required retention duration.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "3.3.2.2", + "Description": "Checks if a backup in Cloud Storage or Persistent Disk has a retention period that meets or exceeds the specified duration. The rule is NON_COMPLIANT if the backup retention policy is shorter than required.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "3.3.2.3", + "Description": "Checks if a Google Cloud Logging LogBucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Google Cloud Logging", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "3.3.2.4", + "Description": "Checks if a Google Cloud Firestore database's retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.3.2.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore. The rule is NON_COMPLIANT if PITR is not enabled for Firestore.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.3.2.6", + "Description": "Checks if Persistent Disks are attached to Compute Engine instances. Optionally checks if Persistent Disks are set to be deleted when the instance is deleted.", + "Name": "Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "3.3.2.7", + "Description": "Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.", + "Name": "Google Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Container Registry" + } + ] + }, + { + "Id": "3.3.2.8", + "Description": "Checks if a lifecycle rule is configured for a Google Cloud Storage (GCS) bucket. The rule is NON_COMPLIANT if there are no active lifecycle configuration rules or the configuration does not match with the parameter values.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.2.9", + "Description": "Checks if Google Cloud Storage (GCS) buckets with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if GCS lifecycle policy is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.3.1", + "Description": "Verifies if a backup policy in GCP has a backup rule that meets the necessary frequency and retention criteria. The rule is deemed NON_COMPLIANT if recovery snapshots are not created at least as frequently as specified in the policy or if they expire before the established retention period.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "3.3.3.2", + "Description": "Checks if a backup retention policy for Google Cloud Storage complies with the specified retention period. The rule is NON_COMPLIANT if the backup's retention setting is less than the required duration.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.3.3", + "Description": "Checks if a Google Cloud Logging LogBucket retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Google Cloud Logging", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "3.3.3.4", + "Description": "Checks if a Google Cloud Firestore database retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.3.3.5", + "Description": "Checks if point-in-time recovery (PITR) is enabled for Google Cloud Firestore or Cloud Spanner databases. The rule is NON_COMPLIANT if PITR is not enabled for Firestore or Spanner databases.", + "Name": "Google Cloud Firestore / Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Firestore / Cloud Spanner" + } + ] + }, + { + "Id": "3.3.3.6", + "Description": "Checks if Persistent Disks are attached to Compute Engine instances. Optionally checks if Persistent Disks are set to be deleted when the instance is terminated.", + "Name": "Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "3.3.3.7", + "Description": "Checks if a private Google Container Registry (GCR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the GCR private repository.", + "Name": "Google Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Container Registry" + } + ] + }, + { + "Id": "3.3.3.8", + "Description": "Checks if a lifecycle rule is configured for a Google Cloud Storage bucket. The rule is NON_COMPLIANT if there is no active lifecycle configuration rules or the configuration does not match with the parameter values.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.3.3.9", + "Description": "Checks if Google Cloud Storage (GCS) buckets with versioning enabled have a retention policy configured. The rule is NON_COMPLIANT if GCS retention policy is not enabled.", + "Name": "Google Cloud Storage (GCS)", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.", + "Service": "Google Cloud Storage (GCS)" + } + ] + }, + { + "Id": "3.5.1.1.1", + "Description": "Checks if Google Cloud Platform (GCP) SSL Certificates are marked for expiration within the specified number of days. GCP manages SSL certificates through Google-managed SSL certificates which are automatically renewed; however, user-managed certificates need manual renewal. The rule is NON_COMPLIANT if your SSL certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.5.1.1.2", + "Description": "Checks if Google Cloud's Certificate Authority Service has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.5.1.1.3", + "Description": "Checks if a Cloud Endpoints API service uses a valid SSL certificate. The rule is NON_COMPLIANT if the API service does not have an associated SSL certificate enabled.", + "Name": "Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Cloud Endpoints" + } + ] + }, + { + "Id": "3.5.1.1.4", + "Description": "Checks if the certificate associated with a Google Cloud CDN (Content Delivery Network) is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN distribution uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.5.1.1.5", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured to use SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a certificate from Certificate Manager or is configured with a certificate different from a Certificate Manager certificate.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.5.1.1.6", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, an SSL or HTTPS listener must be configured with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers and does not apply to other types of load balancers in GCP.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.5.1.1.7", + "Description": "Checks if the managed Google Cloud IAM policies you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.5.1.1.8", + "Description": "Checks if the IAM policies attached to your GCP Service Accounts do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in a policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_sa_no_user_managed_keys", + "iam_role_kms_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.5.1.1.9", + "Description": "Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud Key Management Service (Google Cloud KMS)", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Key Management Service (Google Cloud KMS)" + } + ] + }, + { + "Id": "3.5.1.3.1", + "Description": "Checks if Google Cloud Certificate Manager Certificates in your account are marked for expiration within the specified number of days. Certificates provided by Certificate Manager are automatically renewed if they are managed by Google Cloud. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.5.1.3.2", + "Description": "Checks if Google Cloud Certificate Authority Service (GCP CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.5.1.3.3", + "Description": "Checks if an API Gateway endpoint uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway endpoint does not have an associated SSL certificate.", + "Name": "API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "API Gateway" + } + ] + }, + { + "Id": "3.5.1.3.4", + "Description": "Checks if a Backup Vault in GCP has an attached resource-based policy that prevents deletion of recovery points. The rule is NON_COMPLIANT if the Backup Vault does not have resource-based policies or has policies lacking a suitable 'Deny' statement (statement with 'storage.objects.delete', 'storage.objects.update', and 'storage.buckets.setIamPolicy' permissions).", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.5.1.3.5", + "Description": "Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN configuration uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.5.1.3.6", + "Description": "Checks if Google Cloud Database Migration Service (Google Cloud DMS) instances are public. The rule is NON_COMPLIANT if the 'public' field is set to true.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "3.5.1.3.7", + "Description": "Checks if Google Cloud Firestore database backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore database backups are public.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.5.1.3.8", + "Description": "Checks if Google Cloud Persistent Disk snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots are shared with all users, indicating that Google Cloud Persistent Disk snapshots are public.", + "Name": "Google Cloud Compute Engine", + "Checks": [ + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "3.5.1.3.9", + "Description": "Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the ReadOnlyRootFilesystem parameter in the container specifications of a Kubernetes Pod is set to 'false'.", + "Name": "Google Kubernetes Engine", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Kubernetes Engine" + } + ] + }, + { + "Id": "3.5.1.3.10", + "Description": "Checks if Google Cloud Filestore access control is configured to enforce a root directory. The rule is NON_COMPLIANT if the access path is set to '/' (default root directory of the file system).", + "Name": "Google Cloud Filestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "3.5.1.3.11", + "Description": "Checks if Google Cloud Filestore instances are configured to enforce user identity. The rule is NON_COMPLIANT if 'POSIX user' is not defined or if parameters are provided and there is no match in the corresponding parameter.", + "Name": "Google Cloud Filestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "3.5.1.3.12", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured to use SSL certificates from Google Managed Certificates or other trusted Certificate Authority. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a valid SSL certificate or is configured with a certificate that is not trusted.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.5.1.3.13", + "Description": "Checks if the Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS backend service with your Global or Regional Load Balancer. This rule is only applicable to HTTP(S) Load Balancers and does not check TCP/UDP Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.5.1.3.14", + "Description": "Checks if a Google Cloud Platform project has VPC firewall rules configured to block public access settings. The rule is NON_COMPLIANT if the ingress firewall rules allow traffic from 0.0.0.0/0 on ports other than port 22.", + "Name": "Google Cloud VPC Firewall Rules", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud VPC Firewall Rules" + } + ] + }, + { + "Id": "3.5.1.3.15", + "Description": "Checks if the managed GCP Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.5.1.3.16", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not permit actions that are blocked on all GCP KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on any GCP KMS key in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.5.1.3.17", + "Description": "Checks if Google Cloud Key Management Service (GCP KMS) keys are not scheduled for deletion in GCP KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud Key Management Service (Cloud KMS)", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Key Management Service (Cloud KMS)" + } + ] + }, + { + "Id": "3.5.1.3.18", + "Description": "Checks if the Google Cloud Functions IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access, it is NON_COMPLIANT.", + "Name": "Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Cloud Functions" + } + ] + }, + { + "Id": "3.5.1.3.19", + "Description": "Checks if a Google Cloud SQL database instance snapshot is public. The rule is NON_COMPLIANT if any existing and new Cloud SQL snapshot is public.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_ip", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "3.5.1.3.20", + "Description": "Checks if the Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipConfiguration.enablePublicIp' field is true in the instance configuration.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment", + "compute_instance_public_ip" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "3.5.1.3.21", + "Description": "Checks if Google Cloud SQL backups are public. The rule is NON_COMPLIANT if any existing and new Google Cloud SQL backups are public.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "3.5.1.3.22", + "Description": "Checks if Google BigQuery datasets have public access enabled. The rule is NON_COMPLIANT if the 'access' field contains any entries allowing public (allUsers) access.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "3.5.1.3.23", + "Description": "Checks if Google Cloud Storage (GCS) buckets have uniform bucket-level access enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.5.1.3.24", + "Description": "Checks if the required public access prevention settings are configured at the project level in Google Cloud. The rule is only NON_COMPLIANT when the fields set below do not match the corresponding fields in the configuration item.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudsql_instance_public_access", + "bigquery_dataset_public_access", + "compute_instance_public_ip" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.5.1.3.25", + "Description": "Checks if the required Public Access prevention settings are configured at the project level. The rule is NON_COMPLIANT if the configuration item does not match one or more settings from parameters (or default).", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.5.1.3.26", + "Description": "Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.", + "Name": "Google Cloud Storage (GCS)", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage (GCS)" + } + ] + }, + { + "Id": "3.5.1.3.27", + "Description": "Checks if Object Versioning is enabled on a Google Cloud Storage (GCS) bucket, as MFA Delete equivalent functionality is not available. The rule is NON_COMPLIANT if Object Versioning is not enabled.", + "Name": "Google Cloud Storage (GCS)", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage (GCS)" + } + ] + }, + { + "Id": "3.5.1.3.28", + "Description": "Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Uniform Bucket-Level Access settings, bucket policy, and bucket access control list (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.5.1.3.29", + "Description": "Checks if your Google Cloud Storage buckets do not allow public write access. The rule examines the bucket IAM policies, access control policies, and uniform bucket-level access settings.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.5.1.3.30", + "Description": "Checks if direct internet access is disabled for a Google Cloud AI Platform Notebooks instance. The rule is NON_COMPLIANT if an AI Platform Notebooks instance is internet-enabled.", + "Name": "Google Cloud AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud AI Platform Notebooks" + } + ] + }, + { + "Id": "3.5.1.3.31", + "Description": "Checks if Google Cloud Document AI processor resources owned by the account are public. The rule is NON_COMPLIANT if Document AI processors with the owner 'Self' are public.", + "Name": "Google Cloud Document AI", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Document AI" + } + ] + }, + { + "Id": "3.5.1.1", + "Description": "Checks if all methods in Google Cloud Endpoints services have caching enabled and cache encrypted. The rule is NON_COMPLIANT if any method in a Google Cloud Endpoints service is not configured to cache or the cache is not encrypted.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "3.5.1.2", + "Description": "Checks if a Google BigQuery dataset is encrypted at rest. The rule is NON_COMPLIANT if encryption of data at rest is not enabled for a BigQuery dataset.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "3.5.1.3", + "Description": "Checks if a Google Cloud Platform (GCP) recovery point is encrypted. The rule is NON_COMPLIANT if the recovery point is not encrypted.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "3.5.1.4", + "Description": "Checks if Google Cloud Logging log sinks are encrypted with a specified Google Cloud KMS key. The rule is NON_COMPLIANT if a log sink is not encrypted with any KMS key or is encrypted with a KMS key not supplied in the rule parameter.", + "Name": "Google Cloud Logging", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "3.5.1.5", + "Description": "Checks if Google Cloud Audit Logs is configured to use the Google Cloud Key Management Service (Cloud KMS) for encryption. The rule is COMPLIANT if the KmsKeyId is defined.", + "Name": "Google Cloud Audit Logs", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Audit Logs" + } + ] + }, + { + "Id": "3.5.1.6", + "Description": "Checks if a Google Cloud Build trigger has encryption enabled for all of its artifacts. The rule is NON_COMPLIANT if 'encryptionDisabled' is set to 'true' for any primary or secondary (if present) artifact configurations.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "3.5.1.7", + "Description": "Checks if the project contains environment variables GOOGLE_CLOUD_ACCESS_KEY and GOOGLE_CLOUD_SECRET_KEY. The rule is NON_COMPLIANT when the project environment variables contain plaintext credentials.", + "Name": "Google Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Resource Manager" + } + ] + }, + { + "Id": "3.5.1.8", + "Description": "Checks if a Google Cloud Build project configured with Google Cloud Storage (GCS) Logs has encryption enabled for its logs. The rule is NON_COMPLIANT if 'encryptionDisabled' is set to 'true' in the 'storage' configuration of a Cloud Build project.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "3.5.1.9", + "Description": "Checks if Google Cloud Firestore or Google Cloud Bigtable instances are encrypted. The rule is NON_COMPLIANT if a Firestore or Bigtable instance is not encrypted.", + "Name": "Google Cloud Firestore / Google Cloud Bigtable", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Firestore / Google Cloud Bigtable" + } + ] + }, + { + "Id": "3.5.1.10", + "Description": "Checks if storage encryption is enabled for your Google Cloud Firestore databases. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.5.1.11", + "Description": "Checks if Google Cloud Firestore or Google Cloud Bigtable table is encrypted with Google Cloud Key Management Service (KMS). The rule is NON_COMPLIANT if the Firestore or Bigtable table is not encrypted with Google Cloud KMS. The rule is also NON_COMPLIANT if the encrypted Google Cloud KMS key is not present in the keyResourceIds input parameter.", + "Name": "Google Cloud Firestore / Google Cloud Bigtable", + "Checks": [ + "bigquery_table_cmk_encryption" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Firestore / Google Cloud Bigtable" + } + ] + }, + { + "Id": "3.5.1.12", + "Description": "Checks if the Google Cloud Firestore databases are encrypted and checks their status. The rule is COMPLIANT if the status is enabled or enabling.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "3.5.1.13", + "Description": "Checks if Google Cloud Persistent Disk encryption is enabled by default. The rule is NON_COMPLIANT if the encryption is not enabled.", + "Name": "Google Cloud Storage / Google Compute Engine", + "Checks": [ + "compute_instance_encryption_with_csek_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage / Google Compute Engine" + } + ] + }, + { + "Id": "3.5.1.14", + "Description": "Verifies if secrets are passed as environment variables in Google Cloud Platform containers. The rule is NON_COMPLIANT if any environment variable key matches a key listed in the 'secretKeys' parameter (excluding environment variables from other sources such as Google Cloud Storage).", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "3.5.1.15", + "Description": "Checks if Google Cloud Filestore is configured to encrypt file data using Google Cloud Key Management Service (Google Cloud KMS). The rule is NON_COMPLIANT if the 'fileShare.encryptionKey.name' is not set or does not match the required KMS key.", + "Name": "Google Cloud Filestore", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "3.5.1.16", + "Description": "Checks if Google Kubernetes Engine (GKE) clusters are configured to have Kubernetes secrets encrypted using Google Cloud KMS. The rule is NON_COMPLIANT if a GKE cluster does not have the appropriate encryption settings in place or if secrets are not being encrypted using the specified KMS key.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "3.5.1.17", + "Description": "Checks if Google Kubernetes Engine (GKE) clusters are configured to have Kubernetes secrets encrypted using Google Cloud KMS (Key Management Service).", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "3.5.1.18", + "Description": "Checks if Google Cloud Memorystore for Redis instances have encryption-at-rest enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'redis_version' does not support encryption or if the KMS key does not match the approved KMS key settings.", + "Name": "Google Cloud Memorystore for Redis", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Memorystore for Redis" + } + ] + }, + { + "Id": "3.5.1.19", + "Description": "Checks if Google Cloud Elasticsearch (managed by Google Cloud) has encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption at rest option is not enabled.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "3.5.1.20", + "Description": "Checks if attached Google Cloud Persistent Disks are encrypted and optionally are encrypted with a specified CMEK (Customer Managed Encryption Keys). The rule is NON_COMPLIANT if attached Persistent Disks are unencrypted or are encrypted with a CMEK key not in the supplied parameters.", + "Name": "Google Cloud Storage", + "Checks": [ + "compute_instance_encryption_with_csek_enabled", + "dataproc_encrypted_with_cmks_disabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.5.1.21", + "Description": "Checks if Google Cloud Pub/Sub topics are encrypted at rest with Google-managed encryption. The rule is NON_COMPLIANT for a Pub/Sub topic if 'encryptionConfiguration' is not present.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "3.5.1.22", + "Description": "Checks if storage encryption is enabled for your Google Cloud SQL instances. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_ssl_connections", + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "3.5.1.23", + "Description": "Checks if a Google Cloud SQL instance has automated backups encrypted. The rule is NON_COMPLIANT if a Cloud SQL instance does not have automated backups encrypted.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_automated_backups", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "3.5.1.24", + "Description": "Checks if Google Cloud's Elasticsearch (GCP equivalent of Amazon OpenSearch Service) instances have encryption at rest configuration enabled. The rule is NON_COMPLIANT if the 'encryption' settings are not enabled.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "3.5.1.25", + "Description": "Checks if a Google Cloud SQL instance is encrypted at rest. The rule is NON_COMPLIANT if a Google Cloud SQL instance is not encrypted at rest.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_ssl_connections", + "cloudsql_instance_sqlserver_contained_database_authentication_flag" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "3.5.1.26", + "Description": "Checks if Google Cloud SQL database backups are encrypted. The rule is NON_COMPLIANT if the Google Cloud SQL database backups are not encrypted.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_automated_backups", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "3.5.1.27", + "Description": "Checks if storage encryption is enabled for your Google Cloud SQL instances. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_ssl_connections", + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "3.5.1.28", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if the dataset does not have audit logging enabled.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "3.5.1.29", + "Description": "Checks if Google BigQuery datasets are using a specified Google Cloud Key Management Service (GCP KMS) key for encryption. The rule is COMPLIANT if encryption is enabled and the dataset is encrypted with the key provided in the kmsKeyResource parameter. The rule is NON_COMPLIANT if the dataset is not encrypted or encrypted with another key.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "3.5.1.30", + "Description": "Checks if your Google Cloud Storage bucket has default object encryption enabled or that the bucket policy explicitly denies upload requests without server-side encryption. The rule is NON_COMPLIANT if your Google Cloud Storage bucket is not encrypted by default.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "3.5.1.31", + "Description": "Checks if GCS buckets are encrypted with Google Cloud Key Management Service (Cloud KMS). The rule is NON_COMPLIANT if the GCS bucket is not encrypted with a Cloud KMS key.", + "Name": "Google Cloud Storage (GCS)", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Storage (GCS)" + } + ] + }, + { + "Id": "3.5.1.32", + "Description": "Checks if Google Cloud KMS (Cloud Key Management Service) key is configured for a Google AI Platform endpoint configuration. The rule is NON_COMPLIANT if 'kmsKeyName' is not specified for the Google AI Platform endpoint configuration.", + "Name": "Google AI Platform", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google AI Platform" + } + ] + }, + { + "Id": "3.5.1.33", + "Description": "Checks if a Google Cloud Key Management Service (Google Cloud KMS) key is configured for a Google AI Platform notebook instance. The rule is NON_COMPLIANT if 'kmsKeyName' is not specified for the AI Platform notebook instance.", + "Name": "Google Cloud AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud AI Platform" + } + ] + }, + { + "Id": "3.5.1.34", + "Description": "Checks if all secrets in Google Cloud Secret Manager are encrypted using a customer managed encryption key (CMEK) created in Google Cloud Key Management Service (KMS). The rule is COMPLIANT if a secret is encrypted using a customer managed key. This rule is NON_COMPLIANT if a secret is encrypted using the default Google-managed encryption keys.", + "Name": "Google Cloud Secret Manager", + "Checks": [ + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption", + "dataproc_encrypted_with_cmks_disabled", + "compute_instance_encryption_with_csek_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "3.5.1.35", + "Description": "Checks if Pub/Sub topics are encrypted with Google Cloud Key Management Service (Google Cloud KMS). The rule is NON_COMPLIANT if a Pub/Sub topic is not encrypted with Google Cloud KMS. Optionally, specify the key resource names for the rule to check.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "3.6.1.2.1", + "Description": "Checks if Google Cloud Certificate Manager certificates in your account are marked for expiration within the specified number of days. Certificates managed by Google Cloud Certificate Manager are automatically renewed, but those imported from other providers are not. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.6.1.2.2", + "Description": "Checks if Google Cloud Certificate Authority Service (Google CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.6.1.2.3", + "Description": "Checks if a Google Cloud Endpoints API has an SSL certificate associated with its configuration. The rule is NON_COMPLIANT if the API does not have an associated SSL certificate for secure communication.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "3.6.1.2.4", + "Description": "Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.6.1.2.5", + "Description": "Checks if Google Cloud Load Balancers have backend services configured with SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without an SSL certificate or is configured with a certificate that is not from Google Cloud Certificate Manager.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.6.1.2.6", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by Google Cloud SSL Certificates. To use this rule, an SSL or HTTPS load balancer configuration must be applied with your load balancer in GCP. This rule is only applicable to HTTP(S) Load Balancers. This rule does not check TCP Proxy Load Balancers and Internal Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.6.1.2.7", + "Description": "Checks if the managed GCP Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.6.1.2.8", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM and Google Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud IAM and Google Cloud KMS" + } + ] + }, + { + "Id": "3.6.1.2.9", + "Description": "Checks if Google Cloud Key Management Service (GCP KMS) keys are not scheduled for deletion in GCP KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud Key Management Service (GCP KMS)", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Key Management Service (GCP KMS)" + } + ] + }, + { + "Id": "3.6.1.3.1", + "Description": "Checks if Google Cloud Platform SSL Certificates in your project are marked for expiration within the specified number of days. Google-managed SSL certificates are automatically renewed. User-managed certificates are not automatically renewed. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.6.1.3.2", + "Description": "Checks if Google Cloud Certificate Authority Service (Google Cloud CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.6.1.3.3", + "Description": "Checks if a Google Cloud HTTP(S) Load Balancer front-end configuration uses an SSL certificate. The rule is NON_COMPLIANT if the load balancer does not have an associated SSL certificate.", + "Name": "Google Cloud HTTP(S) Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud HTTP(S) Load Balancing" + } + ] + }, + { + "Id": "3.6.1.3.4", + "Description": "Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.6.1.3.5", + "Description": "Checks if Google Cloud Load Balancers (both HTTP(S) Load Balancers and TCP/UDP Load Balancers) have backend services and target proxies configured to use certificates from Google-managed SSL Certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service or target proxy that is configured without a Google-managed SSL Certificate or is configured with a certificate different from a Google-managed SSL Certificate.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.6.1.3.6", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS frontend configuration with your Google Cloud Load Balancer. This rule is only applicable to HTTPS Load Balancers. This rule does not check TCP Load Balancers or Internal Load Balancers.", + "Name": "Google Cloud Load Balancer", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Load Balancer" + } + ] + }, + { + "Id": "3.6.1.3.7", + "Description": "Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.6.1.3.8", + "Description": "Checks if the IAM policies attached to your GCP users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM and Google Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud IAM and Google Cloud KMS" + } + ] + }, + { + "Id": "3.6.1.3.9", + "Description": "Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud KMS", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud KMS" + } + ] + }, + { + "Id": "3.6.1.4.1", + "Description": "Checks if Google Cloud Certificate Manager Certificates in your project are marked for expiration within the specified number of days. Certificates provided by Certificate Manager are automatically renewed. Certificate Manager does not automatically renew certificates that you import. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.6.1.4.2", + "Description": "Checks if Google Cloud Certificate Authority Service has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.6.1.4.3", + "Description": "Checks if an API Gateway stage uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway stage does not have an associated SSL certificate.", + "Name": "API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured.", + "Service": "API Gateway" + } + ] + }, + { + "Id": "3.6.1.4.4", + "Description": "Checks if the SSL certificate associated with a Google Cloud CDN is a default certificate. The rule is NON_COMPLIANT if a Google Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.6.1.4.5", + "Description": "Checks if Google Cloud Load Balancers have backend services configured with HTTPS certificates from Google Managed SSL Certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a Google Managed SSL certificate or is configured with a certificate not issued by Google.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.6.1.4.6", + "Description": "Checks if the Google Cloud HTTP(S) Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure that an SSL or HTTPS frontend configuration is set up with your HTTP(S) Load Balancer. This rule is only applicable to HTTP(S) Load Balancers. This rule does not check TCP/SSL Proxy Load Balancers or Internal Load Balancers.", + "Name": "Google Cloud HTTP(S) Load Balancer", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud HTTP(S) Load Balancer" + } + ] + }, + { + "Id": "3.6.1.4.7", + "Description": "Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.6.1.4.8", + "Description": "Checks if the IAM policies attached to your GCP users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.6.1.4.9", + "Description": "Checks if Google Cloud Key Management Service (GCP KMS) keys are not scheduled for deletion in GCP KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud Key Management Service (GCP KMS)", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Key Management Service (GCP KMS)" + } + ] + }, + { + "Id": "3.6.1.1", + "Description": "Checks if Google Cloud Certificate Manager SSL Certificates in your account are marked for expiration within the specified number of days. Certificates managed by Google Cloud are automatically renewed. Certificates that are imported do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.6.1.2", + "Description": "Checks if Google Cloud Certificate Authority Service (CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.6.1.3", + "Description": "Checks if a Google Cloud Endpoints API has an SSL certificate. The rule is NON_COMPLIANT if the Google Cloud Endpoints API does not have an associated SSL certificate.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "3.6.1.4", + "Description": "Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.6.1.5", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers have backends that are configured to use SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud certificate.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.6.1.6", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure you have an SSL or HTTPS listener configured with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers. This rule does not check other types of load balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.6.1.7", + "Description": "Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.6.1.8", + "Description": "Checks if the IAM policies attached to your Google Cloud users, service accounts, and groups do not permit actions that are blocked for all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed for all Google Cloud KMS keys in a policy.", + "Name": "Google Cloud IAM and Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud IAM and Cloud KMS" + } + ] + }, + { + "Id": "3.6.1.9", + "Description": "Checks if Google Cloud Key Management Service (Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud Key Management Service (Cloud KMS)", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured.", + "Service": "Google Cloud Key Management Service (Cloud KMS)" + } + ] + }, + { + "Id": "3.7.1.1", + "Description": "Checks if Google Cloud Certificate Manager certificates in your account are marked for expiration within the specified number of days. Certificates in Google Cloud can be managed, including automatic renewals for managed certificates. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.7.1.2", + "Description": "Checks if RSA certificates managed by Google Cloud's Certificate Manager have a key length of at least '2048' bits. The rule is NON_COMPLIANT if the minimum key length is less than 2048 bits.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.7.1.3", + "Description": "Checks if Google Cloud Certificate Authority Service (GCP CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.7.1.4", + "Description": "Checks if a Cloud Endpoint uses an SSL certificate. The rule is NON_COMPLIANT if the Cloud Endpoint does not have an associated SSL certificate.", + "Name": "Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Cloud Endpoints" + } + ] + }, + { + "Id": "3.7.1.5", + "Description": "Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN configuration uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.7.1.6", + "Description": "Checks if Google Cloud HTTPS Load Balancers have backend services configured with SSL/TLS certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 HTTPS Load Balancer has at least 1 backend service that is configured without a SSL/TLS certificate from Google Cloud Certificate Manager or is configured with a certificate different from those managed by Google Cloud Certificate Manager.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.1.7", + "Description": "Checks if the Global Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS frontend with your Global Load Balancer. This rule is only applicable to Global Load Balancers. This rule does not check Regional Load Balancers or Internal Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.1.8", + "Description": "Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.7.1.9", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on any Google Cloud KMS key in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.7.1.10", + "Description": "Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud Key Management Service (Google Cloud KMS)", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Key Management Service (Google Cloud KMS)" + } + ] + }, + { + "Id": "3.7.2.1", + "Description": "Checks if Google Cloud's Certificate Manager Certificates in your project are marked for expiration within the specified number of days. Certificates provided by Google Cloud are automatically renewed. Google Cloud does not automatically renew certificates that you import. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.7.2.2", + "Description": "Checks if Google Cloud Private CA has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.7.2.3", + "Description": "Checks if a Cloud Endpoints API uses an SSL certificate. The rule is NON_COMPLIANT if the Cloud Endpoints API does not have an associated SSL certificate.", + "Name": "Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Cloud Endpoints" + } + ] + }, + { + "Id": "3.7.2.4", + "Description": "Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.7.2.5", + "Description": "Checks if Google Cloud Load Balancers have backend services configured with SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without an SSL certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud Certificate Manager certificate.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.2.6", + "Description": "Checks if the HTTPS Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an HTTPS or SSL proxy load balancer. This rule is only applicable to HTTPS Load Balancers. This rule does not check TCP/UDP Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.2.7", + "Description": "Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM and Google Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM and Google Cloud KMS" + } + ] + }, + { + "Id": "3.7.2.8", + "Description": "Checks if the IAM policies attached to your GCP IAM users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all GCP KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.7.2.9", + "Description": "Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for destruction in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for destruction.", + "Name": "Google Cloud KMS", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud KMS" + } + ] + }, + { + "Id": "3.7.4.1", + "Description": "Checks if Google Cloud Certificate Manager Certificates in your account are marked for expiration within the specified number of days. Certificates managed by Google Cloud Certificate Manager can be automatically renewed, but the auto-renewal is dependent on the proper configuration. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.7.4.2", + "Description": "Checks if Google Cloud Certificate Authority Service (CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.7.4.3", + "Description": "Checks if a Google Cloud Endpoints API has an SSL certificate associated. The rule is NON_COMPLIANT if the API does not have an associated SSL certificate.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "3.7.4.4", + "Description": "Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.7.4.5", + "Description": "Checks if automatic key rotation is enabled for each key and matches to the key ID of the customer created Google Cloud KMS key. The rule is NON_COMPLIANT if the IAM role associated with the resource does not have the cloudkms.keys.get permission", + "Name": "Google Cloud Key Management Service (KMS)", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Key Management Service (KMS)" + } + ] + }, + { + "Id": "3.7.4.6", + "Description": "Checks if Google Cloud Load Balancers (including HTTP(S) Load Balancers and TCP/UDP Load Balancers) have backend services that are configured to use SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from one in Google Cloud Certificate Manager.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.4.7", + "Description": "Checks if the Classic Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an SSL or HTTPS frontend configuration with your Network Load Balancer. This rule is only applicable to Classic Load Balancers. This rule does not check HTTP(S) Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.4.8", + "Description": "Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM and Google Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM and Google Cloud KMS" + } + ] + }, + { + "Id": "3.7.4.9", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.7.4.10", + "Description": "Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud KMS", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud KMS" + } + ] + }, + { + "Id": "3.7.5.1", + "Description": "Checks if Google Cloud Certificate Manager SSL certificates in your account are nearing expiration within the specified number of days. Certificates managed by Google Cloud are automatically renewed, while those imported must be manually renewed. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.7.5.2", + "Description": "Checks if automatic key rotation is enabled for each key in Google Cloud's KMS and matches to the key ID of the customer created Google Cloud KMS key. The rule is NON_COMPLIANT if the IAM role associated with the resource does not have the 'cloudkms.keys.get' permission.", + "Name": "Google Cloud Key Management Service (KMS)", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible", + "iam_sa_user_managed_key_rotate_90_days" + ], + "Attributes": [ + { + "Section": "3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Key Management Service (KMS)" + } + ] + }, + { + "Id": "3.7.6.1", + "Description": "Checks if Google Cloud Certificate Manager certificates in your account are marked for expiration within the specified number of days. Certificates provided by Google Cloud are not automatically renewed, and you must manually renew them before expiration. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.7.6.2", + "Description": "Checks if Google Cloud Certificate Authority Service (GCP CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.7.6.3", + "Description": "Checks if an API Gateway endpoint uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway endpoint does not have an associated SSL certificate.", + "Name": "API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "API Gateway" + } + ] + }, + { + "Id": "3.7.6.4", + "Description": "Checks if the SSL certificate associated with a Google Cloud CDN is the default Google-managed SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN configuration uses the default Google-managed SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.7.6.5", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured to use SSL certificates from Google Managed SSL Certificates. This rule is NON_COMPLIANT if at least 1 HTTP(S) Load Balancer has at least 1 backend service that is configured without a Google Managed SSL Certificate or is configured with a certificate different from a Google Managed SSL Certificate.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.6.6", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. This rule is applicable only to HTTP(S) Load Balancers. It does not check TCP/UDP Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.6.7", + "Description": "Verifies that the Google Cloud IAM policies do not permit blocked actions on Google Cloud KMS keys. The rule is considered NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.7.6.8", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.7.6.9", + "Description": "Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud Key Management Service (Google Cloud KMS)", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Key Management Service (Google Cloud KMS)" + } + ] + }, + { + "Id": "3.7.7.1", + "Description": "Checks if Google Cloud Certificate Manager certificates in your project are marked for expiration within the specified number of days. Certificates created by Google Cloud Certificate Manager are automatically renewed. However, imported certificates are not automatically renewed. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Certificate Manager", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Manager" + } + ] + }, + { + "Id": "3.7.7.2", + "Description": "Checks if Google Cloud Certificate Authority Service (GCP CAS) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "Google Cloud Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Certificate Authority Service" + } + ] + }, + { + "Id": "3.7.7.3", + "Description": "Checks if a Cloud Endpoints service configuration is using an SSL certificate. The rule is NON_COMPLIANT if the Cloud Endpoints service does not have an associated SSL certificate.", + "Name": "Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Cloud Endpoints" + } + ] + }, + { + "Id": "3.7.7.4", + "Description": "Checks if the certificate associated with a Google Cloud CDN (Content Delivery Network) backend service is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN backend service uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "3.7.7.5", + "Description": "Checks if Google Cloud Load Balancers have backend services configured to use certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud Certificate Manager certificate.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.7.6", + "Description": "Checks if the Network Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure your Network Load Balancer has a frontend configuration with HTTPS. This rule is applicable only to Network Load Balancers and does not check HTTP(S) Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "3.7.7.7", + "Description": "Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.7.7.8", + "Description": "Checks if the IAM policies attached to your Google Cloud users, service accounts, and groups do not allow blocked actions on all GCP KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all GCP KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "3.7.7.9", + "Description": "Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for deletion in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for deletion.", + "Name": "Google Cloud Key Management Service (Google Cloud KMS)", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.", + "Service": "Google Cloud Key Management Service (Google Cloud KMS)" + } + ] + }, + { + "Id": "4.2.1.1.1", + "Description": "Checks if Google Cloud Managed SSL Certificates in your project are about to expire within the specified number of days. Managed SSL Certificates are automatically renewed by Google Cloud. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Google Cloud Managed SSL Certificates", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Managed SSL Certificates" + } + ] + }, + { + "Id": "4.2.1.1.2", + "Description": "Checks if Google Cloud Certificate Authority (GCP Certificate Authority Service) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with status that is not DISABLED.", + "Name": "GCP Certificate Authority Service", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "GCP Certificate Authority Service" + } + ] + }, + { + "Id": "4.2.1.1.3", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP load balancers. The rule is NON_COMPLIANT if one or more HTTP load balancers do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP load balancers have forwarding to an HTTP listener instead of redirection.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "4.2.1.1.4", + "Description": "Checks if an API Gateway endpoint uses an SSL certificate. The rule is NON_COMPLIANT if the API Gateway endpoint does not have an associated SSL certificate.", + "Name": "API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "API Gateway" + } + ] + }, + { + "Id": "4.2.1.1.5", + "Description": "Checks if the certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "4.2.1.1.6", + "Description": "Checks if Google Cloud CDN is using deprecated SSL protocols for HTTPS communication between Google Cloud CDN edge locations and backend services. This rule is NON_COMPLIANT for a Cloud CDN if any 'SslProtocols' includes 'SSLv3'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "4.2.1.1.7", + "Description": "Checks if Google Cloud CDN is encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'OriginProtocolPolicy' is 'HTTP_ONLY' or if 'OriginProtocolPolicy' is 'MATCH_VIEWER' and 'ViewerProtocolPolicy' is 'ALLOW_ALL'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "4.2.1.1.8", + "Description": "Checks if your Google Cloud CDN uses HTTPS for serving content (directly or via a redirection). The rule is NON_COMPLIANT if the value of 'https' is not enforced in the Load Balancer settings for the backend service.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "4.2.1.1.9", + "Description": "Checks if your Google Cloud Firestore database has transport security enabled. The rule is NON_COMPLIANT if a Firestore database is not secured by Transport Layer Security (TLS).", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "4.2.1.1.10", + "Description": "Checks if Google Cloud Database Migration Service (GCP DMS) connections are configured with an SSL connection. The rule is NON_COMPLIANT if GCP DMS does not have an SSL connection configured.", + "Name": "Google Cloud Database Migration Service", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "4.2.1.1.11", + "Description": "Checks if Google Cloud Database Migration Service (GCP DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "4.2.1.1.12", + "Description": "Checks if Google Cloud Memorystore for Redis replication instances have encryption-in-transit enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'transitEncryptionEnabled' is set to 'false'.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "4.2.1.1.13", + "Description": "Check if Google Cloud's Elasticsearch Service nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled.", + "Name": "Cloud ElasticSearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Cloud ElasticSearch Service" + } + ] + }, + { + "Id": "4.2.1.1.14", + "Description": "Checks if Google Cloud Load Balancers have backend services configured with SSL certificates from Google Cloud Certificate Manager. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service that is configured without a certificate from Google Cloud Certificate Manager or is configured with a certificate different from a Google Cloud Certificate Manager certificate.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "4.2.1.1.15", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure an SSL or HTTPS proxy is configured with your Google Cloud Load Balancer. This rule is only applicable to External Load Balancers. This rule does not check Internal Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "4.2.1.1.16", + "Description": "Checks whether your Google Cloud Load Balancer SSL certificates are using a custom policy. The rule is only applicable if there are SSL certificates associated with the Google Cloud Load Balancer.", + "Name": "Google Cloud Load Balancer", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancer" + } + ] + }, + { + "Id": "4.2.1.1.17", + "Description": "Checks if your Google Cloud Load Balancer (GCLB) SSL policies use a predefined policy. The rule is NON_COMPLIANT if the GCLB HTTPS/SSL listener's policy does not equal the value of the parameter 'predefinedPolicyName'.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "4.2.1.1.18", + "Description": "Checks if your Google Cloud Load Balancer is configured with HTTPS or SSL certificates. The rule is NON_COMPLIANT if a backend service does not have an SSL certificate configured for HTTPS traffic.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "4.2.1.1.19", + "Description": "Checks if Google Cloud Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or the security configuration does not satisfy the specified rule parameters.", + "Name": "Google Cloud Dataproc", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Dataproc" + } + ] + }, + { + "Id": "4.2.1.1.20", + "Description": "Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "4.2.1.1.21", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "4.2.1.1.22", + "Description": "Checks if Google Cloud Key Management Service (Google Cloud KMS) keys are not scheduled for destruction in Google Cloud KMS. The rule is NON_COMPLIANT if KMS keys are scheduled for destruction.", + "Name": "Google Cloud KMS", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud KMS" + } + ] + }, + { + "Id": "4.2.1.1.23", + "Description": "Checks if a Google Cloud Pub/Sub topic enforces encryption in transit using HTTPS (TLS) for communication between publishers and subscribers. The rule is NON_COMPLIANT if plain text communication is enabled for in-transit messages.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "4.2.1.1.24", + "Description": "Checks whether connections to Google Cloud Elasticsearch (GCP equivalent of Amazon OpenSearch) are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Elasticsearch domain 'enforceHTTPS' is not 'true' or is 'true' and 'tlsSecurityPolicy' is not in 'tlsPolicies'.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "4.2.1.1.25", + "Description": "Check if Google Cloud's Managed Service for Elasticsearch nodes are encrypted end to end. The rule is NON_COMPLIANT if the communication between nodes is not encrypted.", + "Name": "Google Cloud Managed Service for Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Managed Service for Elasticsearch" + } + ] + }, + { + "Id": "4.2.1.1.26", + "Description": "Checks if Google BigQuery datasets require TLS/SSL encryption to connect to SQL clients. The rule is NON_COMPLIANT if any Google BigQuery dataset has parameter 'require_ssl' not set to true.", + "Name": "BigQuery", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "4.2.1.1.27", + "Description": "Checks if Google Cloud Storage buckets have policies that require requests to use SSL/TLS. The rule is NON_COMPLIANT if any Google Cloud Storage bucket has policies allowing HTTP requests.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "4.2.1.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all backend services associated with Google Cloud Load Balancers. The rule is NON_COMPLIANT if one or more backend services do not have HTTP to HTTPS redirection configured or if any backend services forward requests to another HTTP backend service instead of redirecting.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "4.2.1.2", + "Description": "Checks if Google Cloud CDN (Cloud Content Delivery Network) backends are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for a Google Cloud CDN backend if any 'OriginSslProtocols' includes 'SSLv3'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "4.2.1.3", + "Description": "Checks if Google Cloud CDN is encrypting traffic to custom backends. The rule is NON_COMPLIANT if 'originProtocol' is 'HTTP' and 'clientRedirect' is 'ALLOW_ALL'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "4.2.1.4", + "Description": "Checks if your Google Cloud CDN configurations enforce HTTPS by verifying that the 'secure' option is enabled for the load balancer backend service. The rule is NON_COMPLIANT if the load balancer allows HTTP traffic without redirection to HTTPS.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "4.2.1.5", + "Description": "Checks if your Google Cloud Firestore is set to use HTTPS for API requests. The rule is NON_COMPLIANT if Firestore does not have HTTPS enabled for secure communication.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "4.2.1.6", + "Description": "Checks if Google Cloud Database Migration Service (GCP DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if GCP DMS does not have an SSL connection configured.", + "Name": "Google Cloud Database Migration Service", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "4.2.1.7", + "Description": "Checks if Google Cloud Platform (GCP) Cloud SQL for Redis data stores is configured to use SSL encryption for data communicated with other endpoints. The rule is NON_COMPLIANT if SSL encryption is not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "4.2.1.8", + "Description": "Checks if Google Cloud Memorystore (Redis) instances have in-transit encryption enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'transitEncryptionMode' is set to 'DISABLED'.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "4.2.1.9", + "Description": "Check if Google Cloud's Elasticsearch nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the ElastiSearch cluster.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "4.2.1.10", + "Description": "Checks if the Google Cloud Load Balancers (GCLB) use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, use an HTTPS load balancer with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers. This rule does not check TCP Proxy Load Balancers or SSL Proxy Load Balancers.", + "Name": "Google Cloud Load Balancer", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancer" + } + ] + }, + { + "Id": "4.2.1.11", + "Description": "Checks whether your Google Cloud Platform (GCP) HTTPS Load Balancer is using a custom SSL policy. The rule is only applicable if there are SSL listeners for the HTTPS Load Balancer.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "4.2.1.12", + "Description": "Checks if your Google Cloud Load Balancer SSL certificates use a predefined policy. The rule is NON_COMPLIANT if the Google Cloud Load Balancer HTTPS/SSL listener's policy does not equal the value of the parameter 'predefinedPolicyName'.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "4.2.1.13", + "Description": "Checks if your Google Cloud Platform Load Balancer is configured with SSL (HTTPS) backend services. The rule is NON_COMPLIANT if a backend service is not configured with SSL or HTTPS.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "4.2.1.14", + "Description": "Checks if Google Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not satisfy the specified rule parameters.", + "Name": "Google Dataproc", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Dataproc" + } + ] + }, + { + "Id": "4.2.1.15", + "Description": "Checks if a Google Cloud Pub/Sub topic enforces encryption in transit using HTTPS (TLS) with the broker nodes of the topic. The rule is NON_COMPLIANT if plain text communication is enabled for in-topic broker node connections.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "4.2.1.16", + "Description": "Checks whether connections to Google Cloud Search domains are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Search domain 'RequireHTTPS' is not 'true' or is 'true' and the 'TLSVersion' is not in the acceptable security policies.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "4.2.1.17", + "Description": "Check if Google Cloud's Elasticsearch (GCP equivalent to Amazon OpenSearch Service) nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the cluster.", + "Name": "Elasticsearch on Google Cloud", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Elasticsearch on Google Cloud" + } + ] + }, + { + "Id": "4.2.1.18", + "Description": "Checks if Google BigQuery requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Google BigQuery dataset has parameter `enable_legacy_sql` not set to false, as BigQuery encrypts data in transit using TLS by default.", + "Name": "BigQuery", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "4.2.1.19", + "Description": "Checks if Google Cloud Storage buckets have policies that require requests to use SSL/TLS. The rule is NON_COMPLIANT if any Cloud Storage bucket has policies allowing HTTP requests.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "5.3.4.1", + "Description": "Checks if Google Cloud Endpoints (API Gateway in GCP) has access logging enabled. The rule is NON_COMPLIANT if 'access_log' is not present in the API configuration.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "5.3.4.2", + "Description": "Checks if all methods in Google Cloud Endpoints configurations have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if logLevel is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "5.3.4.3", + "Description": "Checks if Google Cloud Trace is enabled for Google Cloud Functions or Cloud Run services. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Trace", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Trace" + } + ] + }, + { + "Id": "5.3.4.4", + "Description": "Checks if a Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is set to a value other than ERROR or ALL.", + "Name": "Google Cloud API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "5.3.4.5", + "Description": "Checks if Network Load Balancers (NLB) are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if NLB Desync mitigation mode does not match with the user-defined Desync mitigation mode.", + "Name": "Google Cloud Network Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Network Load Balancing" + } + ] + }, + { + "Id": "5.3.4.6", + "Description": "Checks if Google Cloud CDN backends are configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN backend does not have logging configured.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "5.3.4.7", + "Description": "Checks if at least one Google Cloud Logging service is logging Google Cloud Storage (GCS) data access events for all GCS buckets. The rule is NON_COMPLIANT if there are no logging configurations that record GCS data access events.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "5.3.4.8", + "Description": "Checks that there is at least one Google Cloud Audit Log configured with security best practices. This rule is COMPLIANT if there is at least one log that meets all of the following:", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "5.3.4.9", + "Description": "Google Cloud Logging must be enabled to ensure that all actions and events in the project are recorded, similar to AWS CloudTrail.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "5.3.4.10", + "Description": "Checks if a Google Cloud Build project has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "5.3.4.11", + "Description": "Checks if a Google Cloud Logging log bucket retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Google Cloud Logging", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "5.3.4.12", + "Description": "Checks if logging is enabled with a valid severity level for Google Cloud Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "5.3.4.13", + "Description": "Checks if a Google Cloud Firestore (with Datastore compatibility) instance has Cloud Logging enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Cloud Logging enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "5.3.4.14", + "Description": "Checks if Google Cloud VPN has logging enabled for the tunnel. The rule is NON_COMPLIANT if 'LoggingEnabled' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "5.3.4.15", + "Description": "Checks if logging configuration is set on active Google Kubernetes Engine (GKE) Pod Definitions. This rule is NON_COMPLIANT if an active GKE Pod Definition does not have the logging configuration resource defined or the value for logging configuration is null in at least one container definition.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "5.3.4.16", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "5.3.4.17", + "Description": "Checks if Google Cloud Elasticsearch domains (via Google Cloud's Elastic Stack solution) are configured to send logs to Google Cloud Logging. The rule is COMPLIANT if logging is enabled for a Google Cloud Elasticsearch domain. This rule is NON_COMPLIANT if logging is not configured.", + "Name": "Google Cloud Logging", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "5.3.4.18", + "Description": "Checks if Google Cloud Platform App Engine services are configured to send logs to Cloud Logging. The rule is NON_COMPLIANT if the value of `logHealthChecks` is false.", + "Name": "Google Cloud App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud App Engine" + } + ] + }, + { + "Id": "5.3.4.19", + "Description": "Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the logging is not enabled or the log bucket is not equal to the specified Cloud Storage bucket name.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "5.3.4.20", + "Description": "Checks if Google Cloud Pub/Sub subscriptions have audit logging enabled. The rule is NON_COMPLIANT if a subscription does not have audit logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "5.3.4.21", + "Description": "Checks if a Google Cloud Pub/Sub service has Cloud Logging (formerly Stackdriver Logging) enabled for audit logs. The rule is NON_COMPLIANT if audit logging is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "5.3.4.22", + "Description": "In GCP, enabling audit logging across multiple regions can be achieved using Google Cloud Audit Logs, ensuring that logs are collected and stored in a centralized location, similar to AWS CloudTrail. This service provides multi-regional logging capabilities.", + "Name": "Google Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Audit Logs" + } + ] + }, + { + "Id": "5.3.4.23", + "Description": "Checks if a Google Cloud SQL instance has Stackdriver logging enabled for audit logs. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Stackdriver logging enabled for audit logs.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_statement_flag" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "5.3.4.24", + "Description": "Checks if Google Cloud Platform (GCP) Firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not enabled for the firewall rules.", + "Name": "Google Cloud Firewall", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "5.3.4.25", + "Description": "Checks if Google Cloud Elasticsearch (GCP variant of OpenSearch) clusters have audit logging enabled. The rule is NON_COMPLIANT if a Google Cloud Elasticsearch cluster does not have audit logging enabled.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "5.3.4.26", + "Description": "Checks if Google Cloud Elasticsearch (GCP's equivalent to Amazon OpenSearch Service) clusters are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if logging is not configured.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "5.3.4.27", + "Description": "Checks if Google Cloud SQL for MySQL instances are configured to export logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have log export configured.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "5.3.4.28", + "Description": "Checks if logging is enabled for Google Cloud SQL databases. The rule is NON_COMPLIANT if any log types are not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "5.3.4.29", + "Description": "Checks if Google BigQuery datasets are logging audits to a specific logging sink. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'sinkNames' parameter is provided but the audit logging destination does not match.", + "Name": "Google BigQuery", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "5.3.4.30", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if audit logging is not enabled for the dataset.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "5.3.4.31", + "Description": "Checks if Cloud DNS query logging is enabled for your Google Cloud Platform (GCP) Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your GCP Cloud DNS managed zones.", + "Name": "Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled", + "dns_dnssec_disabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Cloud DNS" + } + ] + }, + { + "Id": "5.3.4.32", + "Description": "Checks if logging is enabled for your Cloud Storage buckets. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "5.3.4.33", + "Description": "Checks if Google Cloud Workflows has logging enabled. The rule is NON_COMPLIANT if a workflow does not have logging enabled or the logging configuration does not meet the minimum requirements.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "5.3.4.34", + "Description": "Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are enabled for all GCP VPC networks. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "5.3.4.35", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the specified value.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "5.3.4.36", + "Description": "Checks if logging is enabled on GCP Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy if it does not have logging enabled.", + "Name": "GCP Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.", + "Service": "GCP Cloud Armor" + } + ] + }, + { + "Id": "6.3.3.1", + "Description": "Checks if all of the specified applications are installed on the instance. Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to instances running that platform.", + "Name": "Google Cloud Compute Engine (OS Config)", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google Cloud Compute Engine (OS Config)" + } + ] + }, + { + "Id": "6.3.3.2", + "Description": "Checks if the compliance status of Google Cloud Compute Engine instance patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation. The rule is compliant if the field status is COMPLIANT.", + "Name": "Google Cloud Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "6.3.3.3", + "Description": "Checks if Google Cloud Run services are set to the latest platform version. The rule is NON_COMPLIANT if the platform is not set to LATEST_VERSION, or if neither the latestLinuxVersion nor latestWindowsVersion are specified as parameters.", + "Name": "Google Cloud Run", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google Cloud Run" + } + ] + }, + { + "Id": "6.3.3.4", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is running the oldest supported version. The rule is NON_COMPLIANT if a GKE cluster is running the oldest supported version (equal to the parameter 'oldestVersionSupported').", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "6.3.3.5", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is running a supported Kubernetes version. This rule is NON_COMPLIANT if a GKE cluster is running an unsupported version (less than the parameter 'oldestVersionSupported').", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "6.3.3.6", + "Description": "Checks if Google Cloud Memorystore for Redis instances have automatic updates enabled. The rule is NON_COMPLIANT for a Memorystore instance if it is using the Redis engine and automatic updates are not enabled.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "6.3.3.7", + "Description": "Checks if automatic application updates in a GCP App Engine environment are enabled. The rule is COMPLIANT if the value for automatic updates is set to true. The rule is NON_COMPLIANT if the value for automatic updates is set to false, or if a parameter is provided and its value does not match the existing configurations.", + "Name": "Google App Engine", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google App Engine" + } + ] + }, + { + "Id": "6.3.3.8", + "Description": "Checks if the Google Cloud Function settings for runtime, service account, timeout, and memory size match the expected values. The rule ignores functions with 'container' deployment type and functions with runtime set to 'OS-only Runtime'. The rule is NON_COMPLIANT if the Cloud Function settings do not match the expected values.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "6.3.3.9", + "Description": "Checks if Google Cloud Elasticsearch (GCE) version updates are available but not installed. The rule is NON_COMPLIANT for an Elasticsearch cluster if the latest software updates are not installed.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "6.3.3.10", + "Description": "Checks if Google Cloud SQL instances are configured for automatic minor version upgrades. The rule is NON_COMPLIANT if the value of 'autoUpgrade' is false.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "6.3.3.11", + "Description": "Checks if Google BigQuery datasets have the specified maintenance settings. The rule is NON_COMPLIANT if the automatic upgrades to major version are disabled.", + "Name": "Google BigQuery", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "6.4.1.1", + "Description": "Checks if Google Cloud Armor is enabled on Google Cloud Load Balancers. The rule is NON_COMPLIANT if key: armor.enabled is set to false.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.2", + "Description": "Checks if a Google Cloud API Gateway API configuration is using a Google Cloud Armor security policy. The rule is NON_COMPLIANT if a Google Cloud Armor policy is not used or if the used policy does not match what is specified in the rule parameter.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.3", + "Description": "Checks if Google Cloud Apigee APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud Apigee API if it is not associated with a security policy.", + "Name": "Google Cloud Apigee", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Apigee" + } + ] + }, + { + "Id": "6.4.1.4", + "Description": "Checks if Google Cloud CDN (Content Delivery Network) is associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN is not associated with a Cloud Armor security policy.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "6.4.1.5", + "Description": "Checks if the security policy is associated with a Global External HTTP(S) Load Balancer or Cloud CDN in GCP. When Google Cloud Platform Firewall Rules are set up, the policy owner specifies the security policy ID in the GCP policy and can optionally enable remediation.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "6.4.1.6", + "Description": "Verifies that the security policies associated with the GCP Web Application Firewall (WAF) are applied in the correct order of precedence. The correct precedence is determined by the ranks specified in the rules configuration. When Google Cloud Security Policies are established, the highest precedence is given the lowest numeric value (0), followed by subsequent values (1, 2, etc.). The policy owner defines the order in the security policy configuration and can implement automatic remediation if desired.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.7", + "Description": "Checks if Cloud Armor Security Policies contain rules. The policy is NON_COMPLIANT if there are no rules in a Cloud Armor Security Policy.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.8", + "Description": "Checks if a Google Cloud Armor Security Policy contains any security rules. This rule is NON_COMPLIANT if a Security Policy does not contain any security rules.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.9", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if there are no rules present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.10", + "Description": "Checks if a Google Cloud Armor security policy rule contains any conditions. The rule is NON_COMPLIANT if no conditions are present within the Cloud Armor security policy rule.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.11", + "Description": "Verifies if a Cloud Armor Security Policy includes any security rules or rule groups. This rule is NON_COMPLIANT if a Security Policy does not contain any security rule or rule group.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.12", + "Description": "Checks if Google Cloud Armor security policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Google Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.13", + "Description": "Checks whether Google Cloud Armor security policy rule contains conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.1.14", + "Description": "Checks if a Google Cloud Armor Security Policy contains any security rules. The policy is NON_COMPLIANT if there are no security rules defined within the policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.1", + "Description": "Checks if Google Cloud Armor is enabled on Google Cloud Load Balancers (GCLBs). The rule is NON_COMPLIANT if key: armor.enabled is set to false.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.2", + "Description": "Checks if a Google Cloud Endpoints API is using a Google Cloud Armor security policy. The rule is NON_COMPLIANT if a Google Cloud Armor security policy is not used or if the used security policy does not match what is listed in the rule parameter.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "6.4.2.3", + "Description": "Checks if Google Cloud Endpoints APIs are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud Endpoints API if it is not associated with a security policy.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "6.4.2.4", + "Description": "Checks if Google Cloud CDN (Content Delivery Network) is associated with a Google Cloud Armor security policy. The rule is NON_COMPLIANT if a Cloud CDN is not associated with a Cloud Armor policy.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "6.4.2.5", + "Description": "Checks if the security policy is associated with a Google Cloud Load Balancer, Google Cloud Armor security policies, or Cloud CDN. When Google Cloud Armor creates this rule, the policy owner specifies the securityPolicyId in the policy and can optionally enable remediation.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.6", + "Description": "Verifies if the firewall rules within the Google Cloud Armor security policy are in the correct order based on their priority. The priority is determined by the sequence in which firewall rules are defined in the security policy. Google Cloud Armor allows the user to specify the order of the rules, starting from the highest priority (0) and increasing subsequent priorities (1, 2, etc.). Remediation can be optionally implemented to correct misconfigured priorities.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.7", + "Description": "Checks if Google Cloud Armor Security Policies contain rules. The rule is NON_COMPLIANT if there are no rules in a Google Cloud Armor Security Policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.8", + "Description": "Checks if a Google Cloud Armor security policy contains any security rules. This rule is NON_COMPLIANT if a security policy does not contain any security rules.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.9", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if there are no rules present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.10", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Cloud Armor security policy.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.11", + "Description": "Checks whether a Google Cloud Armor Security Policy contains any security rules. This rule is NON_COMPLIANT if a Security Policy does not contain any security rules.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.12", + "Description": "Checks if Cloud Armor security policies contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor security policy.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.13", + "Description": "Checks whether a Google Cloud Armor security policy rule contains at least one condition. This rule is COMPLIANT if the security policy rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.4.2.14", + "Description": "Checks if a Google Cloud Armor Security Policy contains any rules. The rule is NON_COMPLIANT if there are no rules present within a Security Policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "6.5.5.1", + "Description": "Checks if the Google Cloud Function is not using the default traffic allocation settings. The rule is NON_COMPLIANT if the Cloud Function is using the traffic allocation of '100% to the latest version'.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.5: Changes to all system components are managed securely.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "6.5.5.2", + "Description": "Verifies if the first deployment step of Google Cloud Build performs multiple deployments. Optionally checks if each following stage deploys to more than the specified number of deployments (deploymentLimit).", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.5: Changes to all system components are managed securely.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "6.5.6.1", + "Description": "Checks if the Cloud Function's deployment configuration is not using the default deployment strategy. The rule is NON_COMPLIANT if the Cloud Function is using the deployment strategy 'ALWAYS_ACTIVE'.", + "Name": "Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.6: Changes to all system components are managed securely.", + "Service": "Cloud Functions" + } + ] + }, + { + "Id": "6.5.6.2", + "Description": "Checks if the first deployment stage of Google Cloud Deploy performs more than one deployment. Optionally checks if each of the subsequent remaining stages deploy to more than the specified number of deployments (deploymentLimit).", + "Name": "Google Cloud Deploy", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.6: Changes to all system components are managed securely.", + "Service": "Google Cloud Deploy" + } + ] + }, + { + "Id": "7.2.1.1", + "Description": "Checks if a GCP project is part of an Organization. The rule is NON_COMPLIANT if a GCP project is not part of an Organization or the Organization ID does not match rule parameter OrganizationId.", + "Name": "Google Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Resource Manager" + } + ] + }, + { + "Id": "7.2.1.2", + "Description": "Checks if a backup vault in Google Cloud Platform (GCP) has an attached resource-based policy that prevents deletion of backup snapshots. The rule is considered NON_COMPLIANT if the Backup Vault does not have resource-based policies or has policies without a suitable 'Deny' statement (statement with 'storage.objects.delete', 'storage.objects.update', and 'storage.buckets.setIamPolicy' permissions).", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.1.3", + "Description": "Checks if a Google Cloud Build (GCB) configuration has privileged mode enabled. The rule is NON_COMPLIANT for a GCB build configuration if 'privileged' is set to 'true'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "7.2.1.4", + "Description": "Checks if custom Google Cloud Pub/Sub topics have an IAM policy attached. The rule is NON_COMPLIANT for custom Pub/Sub topics without an IAM policy attached.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "7.2.1.5", + "Description": "Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "compute_instance_default_service_account_in_use" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.1.6", + "Description": "Checks if the privileged parameter in the container definition of Google Kubernetes Engine (GKE) Pod specifications is set to 'false'. The rule is NON_COMPLIANT if the privileged parameter is 'true'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.2.1.7", + "Description": "Checks if Google Cloud Run (GCR) services only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the 'Readiness checks' option for the service does not enforce read-only file system permissions.", + "Name": "Google Cloud Run", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Run" + } + ] + }, + { + "Id": "7.2.1.8", + "Description": "Checks if Google Kubernetes Engine (GKE) deployment specifications have a security context defined to specify a user for containers to run on. The rule is NON_COMPLIANT if the 'runAsUser' parameter is not present or set to '0' (root).", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.2.1.9", + "Description": "Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.1.10", + "Description": "Checks if the IAM policies attached to your GCP service accounts, roles, and groups do not allow blocked actions on all GCP Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all GCP Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM and Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM and Cloud KMS" + } + ] + }, + { + "Id": "7.2.1.11", + "Description": "Checks if the IAM feature is not in use. The rule is NON_COMPLIANT if a Google Cloud Identity (GCI) user, service account, or Google Group has any IAM policies that are attached inline rather than using predefined IAM roles.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.1.12", + "Description": "Checks in each Google Cloud Identity and Access Management (IAM) resource if a policy resource name (IAM role) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the role is attached to the IAM resource.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.1.13", + "Description": "Checks whether the IAM policy is attached to an IAM user, a group with one or more IAM users, or a service account in Google Cloud Platform (GCP).", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.2.1.14", + "Description": "Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'role': 'roles/owner' which effectively allows all permissions on all resources.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.1.15", + "Description": "Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_audit_logs_enabled", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.1.16", + "Description": "Checks if all specified managed IAM roles are associated with a Google Cloud IAM service account. The rule is NON_COMPLIANT if a managed IAM role is not associated with the service account.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_role_sa_enforce_separation_of_duties", + "iam_no_service_roles_at_project_level" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.1.17", + "Description": "Checks if the root user access key is available in Google Cloud Platform. The rule is COMPLIANT if the user access key does not exist. Otherwise, NON_COMPLIANT.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.1.18", + "Description": "Verifies if IAM users are associated with at least one IAM group in Google Cloud Platform.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.2.1.19", + "Description": "Checks if none of your Google Cloud IAM users have roles or permissions directly attached to them. IAM users must inherit permissions from IAM groups or service accounts. The rule is NON_COMPLIANT if there is at least one custom role or permission that is directly attached to the IAM user.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "iam_role_sa_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.1.20", + "Description": "Checks if a Google Cloud Spanner instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud Spanner instance does not have IAM database authentication enabled.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "7.2.1.21", + "Description": "Checks if Google Cloud Elasticsearch clusters have fine-grained access control enabled. The rule is NON_COMPLIANT if IAM permissions are not set up correctly for the Elasticsearch cluster.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "7.2.1.22", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.2.1.23", + "Description": "Checks if a Google Cloud SQL instance has Cloud Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.2.1.24", + "Description": "Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.1.25", + "Description": "Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud accounts. For example, the rule checks that the GCS bucket policy does not allow another Google Cloud account to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.1.26", + "Description": "Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud IAM principals, service accounts, IP addresses, or VPC Service Controls that you provide. The rule is COMPLIANT if a bucket policy is not present.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.1.27", + "Description": "Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.1.28", + "Description": "Checks if the Google AI Platform Notebooks Root Access setting is enabled for AI Platform Notebook instances. The rule is NON_COMPLIANT if the Root Access setting is set to 'Enabled' for an AI Platform Notebook instance.", + "Name": "Google AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google AI Platform Notebooks" + } + ] + }, + { + "Id": "7.2.1.29", + "Description": "Checks if the Google Cloud Incident Response Team (GCSIRT) can access your GCP account. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for GCSIRT access is not configured.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "7.2.2.1", + "Description": "Checks if a GCP project is part of an organization. The rule is NON_COMPLIANT if a GCP project is not linked to any organization or the organization ID does not match the specified rule parameter OrganizationId.", + "Name": "Google Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Resource Manager" + } + ] + }, + { + "Id": "7.2.2.2", + "Description": "Checks if a GCP Cloud Storage bucket used for backups has an attached IAM policy preventing deletion of backup files. The rule is NON_COMPLIANT if the bucket does not have IAM policies or has policies without sufficient 'Deny' permissions regarding the deletion of objects in the bucket.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.2.3", + "Description": "Checks if a Google Cloud Build project has privileged mode enabled. The rule is NON_COMPLIANT for a Cloud Build project if 'privileged' option is set to 'true'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "7.2.2.4", + "Description": "Checks if custom Google Cloud Pub/Sub schemas have a resource policy attached. The rule is NON_COMPLIANT for custom schemas without a resource policy attached.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "7.2.2.5", + "Description": "Checks if a Google Compute Engine (GCE) instance has a Google Cloud Identity and Access Management (IAM) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.", + "Name": "Google Cloud Identity and Access Management (IAM)", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.2.2.6", + "Description": "Checks if the Privileged flag in the IAM policy for GKE Pod specifications is set to 'true'. The rule is NON_COMPLIANT if the Privileged flag is 'true'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.2.2.7", + "Description": "Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem field in the Pod specification is set to ‘false’.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.2.2.8", + "Description": "Checks if Google Kubernetes Engine (GKE) Pod specifications define a user for containers to run on. The rule is NON_COMPLIANT if the 'securityContext.runAsUser' parameter is not present or set to '0' (root user).", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.2.2.9", + "Description": "Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.2.10", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM and KMS", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM and KMS" + } + ] + }, + { + "Id": "7.2.2.11", + "Description": "Checks if the IAM user, role, or group has any custom IAM policies that are directly attached to them, which would indicate that inline policy features are being used. The rule is NON_COMPLIANT if a Google Cloud IAM (Identity and Access Management) user, service account, or group has any custom IAM policy bindings.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.2.12", + "Description": "Checks in each Google Cloud IAM resource if a policy (Policy ID) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy is attached to the IAM resource.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.2.13", + "Description": "Checks whether the IAM policy is attached to a Google Cloud IAM user, a group with one or more IAM users, or a service account with one or more trusted identities.", + "Name": "IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "IAM" + } + ] + }, + { + "Id": "7.2.2.14", + "Description": "Checks if Google Cloud Identity and Access Management (IAM) policies have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'allow' permissions on all roles over 'all resources'.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.2.15", + "Description": "Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_audit_logs_enabled", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.2.16", + "Description": "Checks if all Google Cloud Platform (GCP) Identity and Access Management (IAM) roles have the specified policies attached. The rule is NON_COMPLIANT if a specified policy is not attached to the IAM role.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.2.17", + "Description": "Checks if the Google Cloud Platform (GCP) service account with owner privileges exists. The rule is COMPLIANT if the service account does not exist. Otherwise, NON_COMPLIANT.", + "Name": "IAM (Identity and Access Management)", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "IAM (Identity and Access Management)" + } + ] + }, + { + "Id": "7.2.2.18", + "Description": "Verifies if IAM users are part of at least one IAM group in Google Cloud Platform.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.2.2.19", + "Description": "Checks if none of your Google Cloud Platform (GCP) Identity and Access Management (IAM) users have custom roles or permissions attached directly to them. IAM users should inherit permissions from IAM groups or predefined roles. The rule is NON_COMPLIANT if there is at least one custom role or permission directly attached to the IAM user.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "iam_role_sa_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.2.20", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.2.2.21", + "Description": "Checks if Google Cloud Elasticsearch instances have fine-grained access control enabled. The rule is NON_COMPLIANT if IAM roles and permissions are not properly configured for the Elasticsearch instance.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "7.2.2.22", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "7.2.2.23", + "Description": "Checks if a Google Cloud SQL instance has Google Cloud Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.2.2.24", + "Description": "Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.2.25", + "Description": "Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. The rule checks that the GCS bucket policy does not allow another Google Cloud project to perform any storage.buckets.get* actions and storage.objects.delete on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.2.26", + "Description": "Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, service accounts, IAM roles, or specified IP addresses. The rule is COMPLIANT if a bucket policy is not present.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.2.27", + "Description": "Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.2.28", + "Description": "Checks if the Google AI Platform Notebook instance has root access enabled. The rule is NON_COMPLIANT if the root access is set to 'Enabled' for a Google AI Platform Notebook instance.", + "Name": "Google AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google AI Platform" + } + ] + }, + { + "Id": "7.2.2.29", + "Description": "Checks if the Google Cloud Security Incident Response Team (SIRT) can access your GCP project. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for SIRT access is not configured.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "7.2.3.1", + "Description": "Checks if a Cloud Build project environment has privileged mode enabled. The rule is NON_COMPLIANT for a Cloud Build project if 'privileged' is set to 'true'.", + "Name": "Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned.", + "Service": "Cloud Build" + } + ] + }, + { + "Id": "7.2.3.2", + "Description": "Checks if Google Cloud Pub/Sub schema registries have an access control policy attached. The rule is NON_COMPLIANT for custom schema registries without an access control policy attached.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "7.2.3.3", + "Description": "Checks if the 'privileged' flag in the container configuration of Google Kubernetes Engine (GKE) Pod specifications is set to 'true'. The rule is NON_COMPLIANT if the 'privileged' flag is 'true'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.2.3.4", + "Description": "Checks if Google Kubernetes Engine (GKE) Pod specifications specify a user for containers to run on. The rule is NON_COMPLIANT if the 'securityContext.runAsUser' parameter is not present or set to '0'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.2.3.5", + "Description": "Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM / Google Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM / Google Cloud KMS" + } + ] + }, + { + "Id": "7.2.3.6", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM and Google Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM and Google Cloud KMS" + } + ] + }, + { + "Id": "7.2.3.7", + "Description": "Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'role: 'roles/owner' which grants broad permissions over all resources.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.3.8", + "Description": "Checks if the root user service account key exists. The rule is COMPLIANT if the service account key does not exist. Otherwise, NON_COMPLIANT.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.2.3.9", + "Description": "Checks if the Vertex AI Workbench Root Access setting is enabled for Vertex AI Workbench Notebooks. The rule is NON_COMPLIANT if the Root Access setting is set to 'Enabled' for a Vertex AI Workbench Notebook instance.", + "Name": "Vertex AI", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned.", + "Service": "Vertex AI" + } + ] + }, + { + "Id": "7.2.4.1", + "Description": "Checks whether IAM groups in Google Cloud Platform (GCP) have at least one IAM user associated with them.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.4: Access to system components and data is appropriately defined and assigned.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.2.4.2", + "Description": "Checks if your Google Cloud IAM users have passwords or active access keys that have not been used within the specified number of days you provided. The rule is NON_COMPLIANT if there are inactive accounts not recently used.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.4: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.4.3", + "Description": "Checks if Google Cloud Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.4: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "7.2.5.1.1", + "Description": "Verifies if IAM Groups in Google Cloud Platform have at least one IAM User assigned to them.", + "Name": "IAM (Identity and Access Management)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5.1: Access to system components and data is appropriately defined and assigned.", + "Service": "IAM (Identity and Access Management)" + } + ] + }, + { + "Id": "7.2.5.1.2", + "Description": "Checks if your GCP Identity and Access Management (IAM) users have service account keys that have not been used within the specified number of days you provided. The rule is NON_COMPLIANT if there are inactive accounts not recently used.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_user_managed_key_rotate_90_days", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "7.2.5.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.5.1.3", + "Description": "Checks if Google Cloud Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5.1: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "7.2.5.1", + "Description": "Checks if a Google Cloud account is part of Google Cloud Resource Manager Organization. The rule is NON_COMPLIANT if a Google Cloud account is not part of an Organization or the Organization ID does not match rule parameter MasterAccountId.", + "Name": "Google Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Resource Manager" + } + ] + }, + { + "Id": "7.2.5.2", + "Description": "Checks if a Google Cloud Storage bucket has an attached IAM policy that prevents deletion of objects. The rule is NON_COMPLIANT if the Cloud Storage bucket does not have IAM policies or has policies without suitable 'Deny' statements (statements with storage.objects.delete and storage.objects.update permissions).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.5.3", + "Description": "Checks if a Compute Engine instance has a Google Cloud Identity and Access Management (IAM) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the Compute Engine instance.", + "Name": "Compute Engine", + "Checks": [ + "iam_sa_no_administrative_privileges", + "compute_instance_default_service_account_in_use" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "7.2.5.4", + "Description": "Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the 'readOnlyRootFilesystem' parameter in the Pod Security Policy or the Pod specification is set to 'false'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.2.5.5", + "Description": "Checks if the managed Google Cloud IAM policies you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.5.6", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.5.7", + "Description": "Verifies that no IAM users, roles, or groups have inline policies defined in Google Cloud Platform, where a non-compliant status is assigned if any are found.", + "Name": "Google Cloud Identity and Access Management (IAM)", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_account_access_approval_enabled", + "iam_no_service_roles_at_project_level" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.2.5.8", + "Description": "Checks in each Google Cloud Platform Identity and Access Management (IAM) resource, if a policy Google Resource Name (GRN) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy GRN is attached to the IAM resource.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.5.9", + "Description": "Checks whether the IAM policy is attached to a Google Cloud Identity and Access Management (IAM) user, a group with one or more IAM users, or a service account with one or more trusted entities.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.5.10", + "Description": "Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'allow' with 'roles/owner' over '//cloudresourcemanager.googleapis.com/projects/{project_id}'.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_no_service_roles_at_project_level", + "iam_sa_no_administrative_privileges", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.5.11", + "Description": "Checks if GCP IAM policies that you create grant permissions to all actions on individual GCP resources. The rule is NON_COMPLIANT if any customer managed IAM policy allows full access to at least 1 GCP service.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_audit_logs_enabled", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.5.12", + "Description": "Checks if all specified IAM policies are attached to the Google Cloud Identity and Access Management (IAM) role. The rule is NON_COMPLIANT if a specified policy is not attached to the IAM role.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.5.13", + "Description": "Checks if none of your Google Cloud IAM users have roles directly attached. IAM users must inherit permissions from IAM groups or service accounts. The rule is NON_COMPLIANT if there is at least one role that is directly attached to the IAM user.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "iam_role_sa_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.2.5.14", + "Description": "Checks if a Google Cloud Spanner instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud Spanner instance does not have IAM database authentication enabled.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "7.2.5.15", + "Description": "Checks if Google Cloud Search has fine-grained access control enabled. The rule is NON_COMPLIANT if IAM roles and permissions are not properly configured for the Search resources.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "7.2.5.16", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.2.5.17", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.2.5.18", + "Description": "Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.5.19", + "Description": "Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other GCP projects. For example, the rule checks that the GCS bucket policy does not allow another GCP project to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.5.20", + "Description": "Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, federated users, service accounts, IP addresses, or VPCs that you provide. The rule is COMPLIANT if a bucket policy is not present.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.5.21", + "Description": "Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.5.22", + "Description": "Checks if the Google Cloud Security Team (GCST) can access your Google Cloud account. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for GCST access is not configured.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "7.2.6.1", + "Description": "Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container specification is set to ‘false’.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.2.6.2", + "Description": "Checks whether IAM users are members of at least one IAM group in Google Cloud Platform (GCP).", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.2.6.3", + "Description": "Checks if Google Cloud's Managed Service for Elasticsearch has IAM roles properly configured for access control. The rule is NON_COMPLIANT if IAM roles are not set correctly for the Elasticsearch service.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "7.2.6.4", + "Description": "Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket IAM policy does not allow another Google Cloud project to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket IAM policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.2.6.5", + "Description": "Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.1.1", + "Description": "Checks if a GCP project is part of an Organization. The rule is NON_COMPLIANT if a GCP project is not part of an Organization or the Organization ID does not match the specified parameter OrganizationId.", + "Name": "Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Cloud Resource Manager" + } + ] + }, + { + "Id": "7.3.1.2", + "Description": "Checks if a Google Cloud Storage bucket used for backups has an attached IAM policy which prevents deletion of backup objects. The rule is NON_COMPLIANT if the Storage bucket does not have IAM policies or has policies without a suitable 'Deny' statement (statement with storage.objects.delete, storage.objects.update permissions).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.1.3", + "Description": "Checks if a Google Compute Engine (GCE) instance has a Google Cloud Identity and Access Management (IAM) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.1.4", + "Description": "Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the 'readOnlyRootFilesystem' parameter in the container specification of the Pod definition is set to 'false'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.3.1.5", + "Description": "Checks if the managed GCP Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.1.6", + "Description": "Checks if the IAM policies attached to your GCP service accounts and roles do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.1.7", + "Description": "Checks if there are any IAM policies directly attached to GCP service accounts, which would indicate the service accounts have inline policies. The rule is NON_COMPLIANT if a GCP service account has any IAM role directly attached.", + "Name": "Identity and Access Management (IAM)", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "iam_sa_no_user_managed_keys", + "iam_role_sa_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.3.1.8", + "Description": "Checks in each Google Cloud Identity and Access Management (IAM) resource if a policy (IAM Role or Permission) associated with the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy is attached to the IAM resource.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.1.9", + "Description": "Verifies if the Google Cloud IAM policy is attached to a Google Cloud user, a Google Cloud group with one or more users, or a Google Cloud service account with one or more trusted entities.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.1.10", + "Description": "Checks if Google Cloud Identity and Access Management (IAM) policies have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy binding includes 'role' that allows '*' permissions to 'allUsers'.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.1.11", + "Description": "Checks if Google Cloud Identity and Access Management (IAM) policies grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_audit_logs_enabled", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.1.12", + "Description": "Checks if all predefined IAM roles specified in the list are assigned to the Google Cloud IAM service account. The rule is NON_COMPLIANT if a predefined role is not assigned to the service account.", + "Name": "Google Cloud Identity and Access Management (IAM)", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "iam_role_sa_enforce_separation_of_duties", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.3.1.13", + "Description": "Checks if none of your Google Cloud IAM (Identity and Access Management) users have custom roles or permissions assigned directly. IAM users (service accounts) should inherit permissions from IAM groups or organizational policies. The rule is NON_COMPLIANT if there is at least one custom role or permission assigned directly to the IAM user.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "iam_role_sa_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.1.14", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.3.1.15", + "Description": "Checks if Google Cloud Elasticsearch Service instances have fine-grained access control enabled. The rule is NON_COMPLIANT if the fine-grained access control setting is not enabled for the Elasticsearch instance.", + "Name": "Google Cloud Elasticsearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Elasticsearch Service" + } + ] + }, + { + "Id": "7.3.1.16", + "Description": "Checks if a Google Cloud SQL instance has Google Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.3.1.17", + "Description": "Checks if a Google Cloud SQL instance has Google Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.3.1.18", + "Description": "Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.1.19", + "Description": "Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket policy does not allow another Google Cloud project to perform any storage.objects.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.1.20", + "Description": "Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud IAM principals, service accounts, IP addresses, or VPC Service Controls that you provide. The rule is COMPLIANT if a bucket policy is not present.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.1.21", + "Description": "Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.1.22", + "Description": "Checks if the Google Cloud Security Operations Center (SOC) can access your Google Cloud account. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for SOC access is not configured.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "7.3.2.1", + "Description": "Checks if a GCP project belongs to a Google Cloud Organization. The rule is NON_COMPLIANT if a GCP project is not part of a Google Cloud Organization or if the Organization ID does not match the specified parameter.", + "Name": "Google Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Resource Manager" + } + ] + }, + { + "Id": "7.3.2.2", + "Description": "Checks if a backup plan in Google Cloud Platform (GCP) has a resource policy that prevents the deletion of backup snapshots. The rule is NON_COMPLIANT if the backup plan does not have resource policies or has policies without a suitable 'Deny' statement (conditions that restrict deletion operations on the backup resources).", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "7.3.2.3", + "Description": "Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM (Identity and Access Management) service account attached to it. The rule is NON_COMPLIANT if no service account is attached to the GCE instance.", + "Name": "Google Compute Engine", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "7.3.2.4", + "Description": "Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container specification is set to 'false'.", + "Name": "Google Kubernetes Engine", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Kubernetes Engine" + } + ] + }, + { + "Id": "7.3.2.5", + "Description": "Checks if the managed Google Cloud Identity and Access Management (IAM) policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud KMS" + } + ] + }, + { + "Id": "7.3.2.6", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, service accounts, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.2.7", + "Description": "Checks if IAM policies are managed instead of using inline policies. The rule is NON_COMPLIANT if a Google Cloud IAM user, service account, or group has any inline policy instead of only using Google Cloud IAM custom roles and permissions.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.2.8", + "Description": "Checks in each GCP Identity and Access Management (IAM) resource if a policy (e.g., IAM Role or IAM Policy) is attached to the IAM resource. The rule is NON_COMPLIANT if the specified policy is attached to the IAM resource.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.2.9", + "Description": "Checks whether the IAM policy is attached to a GCP user (service account), a Google group containing one or more users, or a GCP role with one or more principals.", + "Name": "IAM (Identity and Access Management)", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "IAM (Identity and Access Management)" + } + ] + }, + { + "Id": "7.3.2.10", + "Description": "Checks if Google Cloud Identity and Access Management (IAM) policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer-managed IAM policy binding includes 'role: roles/owner' or any role that grants permissions to all actions over 'resource: /*'.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.2.11", + "Description": "Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any custom IAM policy allows full access to at least 1 Google Cloud service.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.2.12", + "Description": "Checks if all managed IAM roles specified in the list of IAM policies are attached to the Google Cloud Identity and Access Management (IAM) role. The rule is NON_COMPLIANT if a managed policy is not attached to the IAM role.", + "Name": "Google Cloud Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.3.2.13", + "Description": "Checks if none of your Google Cloud Platform (GCP) IAM users have custom roles or permissions directly attached. IAM users must inherit permissions from IAM groups or predefined roles. The rule is NON_COMPLIANT if there is at least one custom role or permission attached directly to the IAM user.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.2.14", + "Description": "Checks if a Google Cloud Spanner instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud Spanner instance does not have IAM database authentication enabled.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "7.3.2.15", + "Description": "Checks if Google Cloud's Elasticsearch Service (managed by Elastic) domains have fine-grained access control enabled. The rule is NON_COMPLIANT if security features are not enabled for the Elasticsearch Service domain.", + "Name": "Google Cloud Elasticsearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Elasticsearch Service" + } + ] + }, + { + "Id": "7.3.2.16", + "Description": "Checks if a Google Cloud SQL instance has Cloud Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "7.3.2.17", + "Description": "Checks if a Google Cloud SQL instance has Google Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Cloud SQL instance does not have Cloud IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_public_access", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.3.2.18", + "Description": "Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.2.19", + "Description": "Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other GCP projects or external accounts. The rule checks that the GCS bucket IAM policy does not allow another GCP project or external account to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket IAM policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.2.20", + "Description": "Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, service accounts, IP addresses, or VPCs that you provide. The rule is COMPLIANT if a bucket policy does not allow public access.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.2.21", + "Description": "Checks if your Google Cloud Storage bucket IAM policies do not allow other inter-account permissions than the control Google Cloud Storage bucket IAM policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.2.22", + "Description": "Checks if the Google Cloud Security Command Center (SCC) can access your Google Cloud project. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for SCC access is not configured.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "7.3.3.1", + "Description": "Checks if a GCP project is part of an organization. The rule is NON_COMPLIANT if a GCP project is not associated with an organization or if the organization ID does not match the rule parameter 'OrganizationId'.", + "Name": "Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Cloud Resource Manager" + } + ] + }, + { + "Id": "7.3.3.2", + "Description": "Checks if a Google Cloud Backup (GCB) Vault has an attached IAM policy which prevents deletion of backup recovery points. The rule is NON_COMPLIANT if the Backup Vault does not have IAM policies or has policies without appropriate 'deny' conditions.", + "Name": "Google Cloud Backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Backup" + } + ] + }, + { + "Id": "7.3.3.3", + "Description": "Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "compute_instance_default_service_account_in_use" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.3.4", + "Description": "Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container spec is set to 'false'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "7.3.3.5", + "Description": "Checks if the managed GCP Identity and Access Management (IAM) policies do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.3.6", + "Description": "Verifies that the IAM policies associated with your GCP service accounts and Google groups do not permit actions that are blocked by GCP's key management controls on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in a policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "kms_key_rotation_enabled", + "iam_role_kms_enforce_separation_of_duties", + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.3.7", + "Description": "Checks if the IAM policy feature is not in use. The rule is NON_COMPLIANT if a Google Cloud Identity and Access Management (IAM) user, service account, or IAM group has any inline policies associated with them.", + "Name": "Google Cloud Identity and Access Management (IAM)", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.3.3.8", + "Description": "Checks in each Google Cloud IAM resource, if a policy specified by Resource Name (URN) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy URN is attached to the IAM resource.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.3.9", + "Description": "Checks whether the IAM policy is attached to a Google Cloud IAM user, a Google Group with one or more IAM users, or a Google Service Account with one or more trusted identities.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.3.10", + "Description": "Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'binding' with 'role' that grants 'roles/owner', 'roles/editor', or any other role that has broad permissions over 'allUsers' or 'allAuthenticatedUsers' over 'projects/*'.", + "Name": "Google Cloud Identity and Access Management (IAM)", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "7.3.3.11", + "Description": "Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_audit_logs_enabled", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.3.12", + "Description": "Checks if all specified IAM roles in Google Cloud have the required IAM policies attached. The rule is NON_COMPLIANT if a required IAM policy is not attached to the role.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_role_sa_enforce_separation_of_duties", + "iam_no_service_roles_at_project_level", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.3.13", + "Description": "Checks if none of your Google Cloud IAM users have policies attached. IAM users must inherit permissions from IAM groups or roles. The rule is NON_COMPLIANT if there is at least one policy that is attached to the IAM user.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "7.3.3.14", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.3.3.15", + "Description": "Checks if Google Cloud Search instances have fine-grained access control enabled. The rule is NON_COMPLIANT if IAM policies do not enforce fine-grained access control for the Cloud Search instance.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "7.3.3.16", + "Description": "Checks if a Google Cloud SQL instance has Google Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.3.3.17", + "Description": "Checks if a Google Cloud SQL instance has Cloud IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have Cloud IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_public_access", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "7.3.3.18", + "Description": "Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.3.19", + "Description": "Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the Google Cloud Storage bucket IAM policy does not allow another Google Cloud project to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Google Cloud Storage bucket IAM policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.3.20", + "Description": "Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, IAM users, service accounts, IP addresses, or VPCs that you provide. The rule is COMPLIANT if a bucket policy is not present.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.3.21", + "Description": "Checks if your Google Cloud Storage bucket permissions do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "7.3.3.22", + "Description": "Checks if the Google Cloud Armor Security Team can access your GCP project. The rule is NON_COMPLIANT if Cloud Armor is enabled but the role for the Security Team access is not configured.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s).", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "8.2.1.1", + "Description": "Checks if running Google Compute Engine (GCE) instances are launched using Google Cloud Keys. The rule is NON_COMPLIANT if a running GCE instance is launched with a service account key.", + "Name": "Google Compute Engine", + "Checks": [ + "iam_sa_no_user_managed_keys" + ], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "8.2.1.2", + "Description": "Checks whether IAM groups in GCP have at least one IAM member (user/service account)", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.2.1.3", + "Description": "Checks whether the IAM policy is attached to a Google Cloud Identity and Access Management (IAM) user, or to a group of users, or to a service account with trusted identities.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.1.4", + "Description": "Checks if the Google Cloud Platform (GCP) root service account (unrestricted access) key is available. The rule is COMPLIANT if the service account key does not exist. Otherwise, NON_COMPLIANT.", + "Name": "IAM (Identity and Access Management)", + "Checks": [ + "iam_sa_no_user_managed_keys", + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "IAM (Identity and Access Management)" + } + ] + }, + { + "Id": "8.2.1.5", + "Description": "Verifies if IAM users belong to at least one IAM group in Google Cloud Platform.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.2.2.1", + "Description": "Checks if the project contains environment variables GOOGLE_APPLICATION_CREDENTIALS. The rule is NON_COMPLIANT when the project environment variables contain plaintext credentials.", + "Name": "Google Cloud Environment Variables", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Environment Variables" + } + ] + }, + { + "Id": "8.2.2.2", + "Description": "Checks if running Google Compute Engine (GCE) instances are launched using Google Cloud key pairs. The rule is NON_COMPLIANT if a running GCE instance is launched with a key pair.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "8.2.2.3", + "Description": "Checks if secrets are passed as container environment variables. The rule is NON_COMPLIANT if 1 or more environment variable key matches a key listed in the 'secretKeys' parameter (excluding environmental variables from other locations such as Google Cloud Storage).", + "Name": "Google Kubernetes Engine", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Kubernetes Engine" + } + ] + }, + { + "Id": "8.2.2.4", + "Description": "Checks whether IAM groups have at least one IAM user in Google Cloud Platform.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.2.2.5", + "Description": "Checks whether the IAM policy is attached to a Google Cloud IAM user, a group of Google Cloud IAM users, or a Google Cloud IAM role with one or more trusted entities.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.2.6", + "Description": "Checks if the Google Cloud project has any service account key with Owner role. The rule is COMPLIANT if no service account key with the Owner role exists. Otherwise, NON_COMPLIANT.", + "Name": "IAM (Identity and Access Management)", + "Checks": [ + "iam_sa_no_user_managed_keys", + "iam_no_service_roles_at_project_level", + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "IAM (Identity and Access Management)" + } + ] + }, + { + "Id": "8.2.2.7", + "Description": "Checks whether IAM users are members of at least one IAM group in Google Cloud Platform (GCP). This can be done using the Identity and Access Management (IAM) service to review roles and group memberships.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.2.2.8", + "Description": "Checks if Google Secret Manager secret has rotation enabled. The rule also checks an optional maxAllowedRotationFrequency parameter. If specified, the rotation frequency of the secret is compared with the max allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation or if the rotation frequency exceeds the specified maxAllowedRotationFrequency.", + "Name": "Google Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Secret Manager" + } + ] + }, + { + "Id": "8.2.2.9", + "Description": "Checks if Google Cloud Secret Manager secrets rotated successfully according to the rotation schedule. Secret Manager monitors the rotation date, and the rule is NON_COMPLIANT if the date passes and the secret isn't rotated.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.2.2.10", + "Description": "Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.2.2.11", + "Description": "Checks if Google Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.", + "Name": "Google Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Secret Manager" + } + ] + }, + { + "Id": "8.2.4.1", + "Description": "Checks if running Google Compute Engine (GCE) instances are launched using Google Cloud key pairs. The rule is NON_COMPLIANT if a running GCE instance is launched with a key pair.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "8.2.4.2", + "Description": "Verifica se os grupos IAM têm pelo menos um usuário IAM.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.4.3", + "Description": "Verifies if the IAM policy is attached to a Google Cloud IAM user, a Google Group containing one or more IAM users, or a Google Cloud IAM Role that has one or more trusted identities.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.4.4", + "Description": "Check if the service account with editor or owner roles has been assigned. The rule is COMPLIANT if such service accounts do not exist. Otherwise, NON_COMPLIANT.", + "Name": "IAM (Identity and Access Management)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "IAM (Identity and Access Management)" + } + ] + }, + { + "Id": "8.2.4.5", + "Description": "Verifies if IAM users are included in at least one IAM group within Google Cloud Platform (GCP).", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.5.1", + "Description": "Checks if running Google Compute Engine (GCE) instances are launched using SSH keys. The rule is NON_COMPLIANT if a running GCE instance is launched with a project-wide SSH key.", + "Name": "Google Compute Engine", + "Checks": [ + "compute_instance_block_project_wide_ssh_keys_disabled" + ], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "8.2.5.2", + "Description": "In Google Cloud Platform (GCP), this can be achieved by checking the IAM policy of a group to see if it contains any IAM members. This involves verifying that each IAM group has at least one user assigned in the IAM roles.", + "Name": "IAM (Identity and Access Management)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "IAM (Identity and Access Management)" + } + ] + }, + { + "Id": "8.2.5.3", + "Description": "Verifies whether the IAM policy is attached to a Google Cloud IAM user, a Google Group that contains one or more IAM users, or a Google IAM role that is associated with one or more service accounts.", + "Name": "IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "IAM" + } + ] + }, + { + "Id": "8.2.5.4", + "Description": "Checks if the Google Cloud IAM service account key for the root user exists. The rule is COMPLIANT if the service account key does not exist. Otherwise, NON_COMPLIANT.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_user_managed_keys", + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.5.5", + "Description": "Checks whether IAM users are members of at least one IAM group in Google Cloud Platform (GCP).", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.6.1", + "Description": "Checks whether IAM groups in Google Cloud Platform have at least one IAM user assigned to them.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.2.6.2", + "Description": "Checks if your GCP Identity and Access Management (IAM) users have passwords or active service account keys that have not been used within the specified number of days. The rule is NON_COMPLIANT if there are inactive accounts not recently used.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.6.3", + "Description": "Checks if Google Cloud Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.2.7.1", + "Description": "Checks if a GCP project is part of a Google Cloud Organization. The rule is NON_COMPLIANT if a GCP project is not associated with the organization or if the Organization ID does not match the rule parameter MasterOrganizationId.", + "Name": "Google Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Resource Manager" + } + ] + }, + { + "Id": "8.2.7.2", + "Description": "Checks if a GCP Backup Policy has suitable IAM policies attached to it to prevent the deletion of backup sources. The rule is NON_COMPLIANT if the Backup Policy does not have IAM policies or has policies without a suitable 'deny' condition (condition with storage.objects.delete, storage.objects.update permissions).", + "Name": "Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "8.2.7.3", + "Description": "Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM (Identity and Access Management) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.", + "Name": "Google Compute Engine (GCE)", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Compute Engine (GCE)" + } + ] + }, + { + "Id": "8.2.7.4", + "Description": "Checks if Google Kubernetes Engine (GKE) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem field in the container spec of GKE Pod definitions is set to 'false'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "8.2.7.5", + "Description": "Verifies that the IAM policies within Google Cloud Platform do not permit disallowed actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any disallowed action is allowed on Google Cloud KMS keys by the IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.7.6", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on any Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM and Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM and Cloud KMS" + } + ] + }, + { + "Id": "8.2.7.7", + "Description": "Checks if the IAM policy feature is not in use. The rule is NON_COMPLIANT if a Google Cloud Identity (GCP IAM) user, IAM role, or IAM group has any inline policy.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.7.8", + "Description": "Checks in each Google Cloud IAM resource if a policy (role or binding) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy is attached to the IAM resource.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.7.9", + "Description": "Checks whether the IAM policy ARN is attached to a user, group, or role with associated members in Google Cloud Platform.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.2.7.10", + "Description": "Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer-managed IAM policy binding includes 'role' that grants 'roles/owner' or 'roles/editor' over 'allUsers'.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.7.11", + "Description": "Checks if Google Cloud IAM roles that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer managed IAM role allows full access to at least 1 Google Cloud service.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "iam_role_sa_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.7.12", + "Description": "Checks if all Google Cloud IAM policies specified in the list of IAM roles are attached to the Google Cloud IAM role. The rule is NON_COMPLIANT if a IAM policy is not attached to the IAM role.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.7.13", + "Description": "Checks if none of your Google Cloud IAM users have roles attached directly. IAM users must inherit permissions from IAM groups or service accounts. The rule is NON_COMPLIANT if there is at least one role that is attached directly to the IAM user.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "iam_role_sa_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.7.14", + "Description": "Checks if a Google Cloud SQL instance has Google Cloud IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.2.7.15", + "Description": "Checks if Google Cloud Search has fine-grained access control enabled. The rule is NON_COMPLIANT if security features for Cloud Search are not configured correctly.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "8.2.7.16", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.2.7.17", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.2.7.18", + "Description": "Checks if Google Cloud Storage Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.2.7.19", + "Description": "Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket IAM policy does not allow another Google Cloud project to perform any storage.buckets.get and storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket IAM policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.2.7.20", + "Description": "Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the GCP principals, service accounts, or IP addresses that you provide. The rule is COMPLIANT if a bucket policy (IAM role bindings) is not present.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.2.7.21", + "Description": "Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Cloud Storage bucket policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.2.7.22", + "Description": "Checks if the Google Cloud Incident Response Team (GCSIRT) can access your GCP project. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for GCSIRT access is not configured.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "8.2.8.1", + "Description": "Checks if a Google Cloud account is part of Google Cloud Resource Manager Organization. The rule is NON_COMPLIANT if a Google Cloud project is not associated with any organization or the organization's ID does not match the specified OrganizationId parameter.", + "Name": "Google Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Resource Manager" + } + ] + }, + { + "Id": "8.2.8.2", + "Description": "Checks whether only the Google Cloud Platform (GCP) Metadata Server v2 is enabled. This rule is NON_COMPLIANT if the Metadata version is not specified in the instance configuration or if both Metadata v1 and v2 are enabled.", + "Name": "Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Compute Engine" + } + ] + }, + { + "Id": "8.2.8.3", + "Description": "Checks if a Google Cloud Platform (GCP) Backup Policy has an attached resource-based IAM policy which prevents deletion of recovery points. The rule is NON_COMPLIANT if the Backup Policy does not have IAM policies or has policies without a suitable 'Deny' statement (statement with roles/storage.admin permissions for backup deletion).", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.2.8.4", + "Description": "Checks if your Google Compute Engine (GCE) instance metadata version is configured with the Enhanced Metadata feature enabled. The rule is NON_COMPLIANT if the metadata access is set to legacy mode.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "8.2.8.5", + "Description": "Checks if a Google Compute Engine (GCE) instance has a Google Cloud IAM service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "compute_instance_default_service_account_in_use" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.8.6", + "Description": "Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the ReadOnlyRootFilesystem parameter in the container specification of the Pod definition is set to 'false'.", + "Name": "Google Kubernetes Engine", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Kubernetes Engine" + } + ] + }, + { + "Id": "8.2.8.7", + "Description": "Checks if the managed Google Cloud Identity and Access Management (IAM) policies you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.8.8", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow forbidden actions on Cloud Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any forbidden action is permitted on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM & Cloud KMS", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM & Cloud KMS" + } + ] + }, + { + "Id": "8.2.8.9", + "Description": "Checks if the IAM policy feature is not in use. The rule is NON_COMPLIANT if a Google Cloud Identity and Access Management (IAM) user, service account, or IAM group has any IAM policy bindings attached directly to them instead of using predefined roles or custom roles.", + "Name": "Google Cloud Identity and Access Management (IAM)", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.2.8.10", + "Description": "Checks in each Google Cloud IAM resource if a policy Google Cloud Resource Name (GCRN) in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy GCRN is attached to the IAM resource.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.8.11", + "Description": "Checks whether the IAM policy is attached to a Google Cloud IAM user, a group with one or more IAM users, or a Google Cloud IAM role with one or more trusted entities.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.2.8.12", + "Description": "Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer managed IAM policy statement includes 'role' that allows all actions on all resources.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.8.13", + "Description": "Checks if Google Cloud IAM policies that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer-managed IAM policy allows full access to at least 1 Google Cloud service.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_audit_logs_enabled", + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.8.14", + "Description": "Checks if all IAM policies specified in the list are attached to the Google Cloud IAM role. The rule is NON_COMPLIANT if a managed policy is not attached to the IAM role.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.8.15", + "Description": "Checks if none of your Google Cloud IAM users have policies attached directly to them. IAM users must inherit permissions from IAM roles or groups. The rule is NON_COMPLIANT if there is at least one policy that is attached to the IAM user.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.2.8.16", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM database authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.2.8.17", + "Description": "Checks if Google Cloud Elasticsearch domains have fine-grained access control enabled. The rule is NON_COMPLIANT if IAM roles and permissions for the Elasticsearch Service are not configured properly to enforce fine-grained access control.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "8.2.8.18", + "Description": "Checks if a Google Cloud SQL instance has IAM authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.2.8.19", + "Description": "Checks if a Google Cloud SQL instance has Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.2.8.20", + "Description": "Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.2.8.21", + "Description": "Checks if a Google Cloud Storage (GCS) bucket IAM policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other GCP projects. For example, the rule checks that the GCS bucket IAM policy does not allow another GCP project to perform any storage.buckets.get or storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket IAM policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.2.8.22", + "Description": "Checks that the access granted by the Google Cloud Storage bucket is restricted to specified Google Cloud principals, service accounts, user accounts, or IP addresses provided. The rule is COMPLIANT if a bucket policy is not present.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.2.8.23", + "Description": "Checks if your Google Cloud Storage bucket policies do not allow other inter-account permissions than the control Google Cloud Storage bucket policy that you provide.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.2.8.24", + "Description": "Checks if the Google Cloud Security Team can access your GCP project. The rule is NON_COMPLIANT if Google Cloud Armor is enabled but the role for Security Team access is not configured.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "8.3.10.1.1", + "Description": "Checks if active IAM service account keys are rotated within the number of days specified in maxAccessKeyAge. The rule is NON_COMPLIANT if service account keys are not rotated within the specified time period. The default value is 90 days.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_user_managed_key_rotate_90_days", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.10.1.2", + "Description": "Checks if Google Cloud Secret Manager secret has rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret does not have a scheduled rotation. The rule is also NON_COMPLIANT if the rotation frequency exceeds the maximumAllowedRotationFrequency parameter.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.10.1.3", + "Description": "Checks if Google Cloud Secret Manager secrets rotated successfully according to the rotation schedule. Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.10.1.4", + "Description": "Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.11.1", + "Description": "Checks if running Google Compute Engine (GCE) instances are launched using Google Cloud key pairs. The rule is NON_COMPLIANT if a running GCE instance is launched with a key pair.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "8.3.11.2", + "Description": "Checks whether IAM groups in Google Cloud Platform have at least one IAM user associated with them.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.3.11.3", + "Description": "Checks whether the IAM policy is attached to a Google Cloud IAM user, a group of IAM users, or a service account with one or more trusted entities.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.11.4", + "Description": "Checks if the root user access key is available. The rule is COMPLIANT if the user access key does not exist. Otherwise, NON_COMPLIANT.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.11.5", + "Description": "Checks whether IAM users are members of at least one IAM group in Google Cloud Platform (GCP). This can be achieved using Cloud IAM to manage roles and permissions associated with groups and users.", + "Name": "Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed.", + "Service": "Cloud IAM" + } + ] + }, + { + "Id": "8.3.2.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP(S) Load Balancers in Google Cloud Platform. The rule is NON_COMPLIANT if one or more HTTP(S) Load Balancer configurations do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP(S) Load Balancer configurations forward traffic to an HTTP listener instead of redirecting to HTTPS.", + "Name": "Google Cloud HTTP(S) Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud HTTP(S) Load Balancing" + } + ] + }, + { + "Id": "8.3.2.2", + "Description": "Checks if all methods in Google Cloud API Gateway APIs have cache enabled and cache encrypted. The rule is NON_COMPLIANT if any method in a Google Cloud API Gateway API is not configured to cache or the cache is not encrypted.", + "Name": "Google Cloud API Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "8.3.2.3", + "Description": "Checks if a Google BigQuery dataset is encrypted at rest. The rule is NON_COMPLIANT if encryption of data at rest is not enabled for a BigQuery dataset.", + "Name": "BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "8.3.2.4", + "Description": "Checks if a Cloud Storage backup snapshot is encrypted. The rule is NON_COMPLIANT if the snapshot is not encrypted.", + "Name": "Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "8.3.2.5", + "Description": "Checks if Google Cloud CDN distributions are using deprecated SSL protocols for HTTPS communication between CDN edge locations and custom origins. This rule is NON_COMPLIANT for a Google Cloud CDN distribution if any 'OriginSslProtocols' includes 'SSLv3'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "8.3.2.6", + "Description": "Checks if Google Cloud CDN is encrypting traffic to custom origins. The rule is NON_COMPLIANT if 'OriginProtocol' is 'HTTP' or if 'OriginProtocol' is 'MATCH_VIEWER' and 'ViewerProtocol' is 'ALLOW_ALL'.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "8.3.2.7", + "Description": "Checks if your Google Cloud CDN configurations use HTTPS. The rule is NON_COMPLIANT if the value of 'https' is not enforced for the backend services serving content.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "8.3.2.8", + "Description": "Checks if Google Cloud Logging (Stackdriver Logging) log sinks are encrypted with a specified Google Cloud KMS key or any KMS key. The rule is NON_COMPLIANT if a log sink is not encrypted with a KMS key or is encrypted with a KMS key that is not supplied in the rule parameter.", + "Name": "Google Cloud Logging", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "8.3.2.9", + "Description": "Checks if Google Cloud Audit Logs is configured to use Cloud KMS for encryption. The rule is COMPLIANT if the KmsKeyId for the service account is defined.", + "Name": "Google Cloud Audit Logs", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Audit Logs" + } + ] + }, + { + "Id": "8.3.2.10", + "Description": "Checks if a Google Cloud Build configuration has encryption enabled for all of its artifacts. The rule is NON_COMPLIANT if 'encryptionDisabled' is set to 'true' for any artifact configurations in the build triggers.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "8.3.2.11", + "Description": "Checks if the project contains environment variables GOOGLE_CLOUD_ACCESS_KEY_ID and GOOGLE_CLOUD_SECRET_ACCESS_KEY. The rule is NON_COMPLIANT when the project environment variables contain plaintext credentials.", + "Name": "Google Cloud Platform (GCP)", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Platform (GCP)" + } + ] + }, + { + "Id": "8.3.2.12", + "Description": "Checks if a Google Cloud Build (GCB) project configured with Google Cloud Storage (GCS) logs has encryption enabled for its logs. The rule is NON_COMPLIANT if 'encryptionDisabled' is set to 'true' in the GCS logs configuration of a Cloud Build project.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "8.3.2.13", + "Description": "Checks if Google Cloud Datastore instances are encrypted. The rule is NON_COMPLIANT if a Datastore instance is not encrypted.", + "Name": "Google Cloud Datastore", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Datastore" + } + ] + }, + { + "Id": "8.3.2.14", + "Description": "Checks if your Google Cloud Firestore database has network encryption enabled. The rule is NON_COMPLIANT if a Firestore database is not encrypted by transport layer security (TLS).", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "8.3.2.15", + "Description": "Checks if Google Cloud Database Migration Service (GCP DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Google Cloud DMS does not have an SSL connection configured.", + "Name": "Google Cloud Database Migration Service", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "8.3.2.16", + "Description": "Checks if Google Cloud Database Migration Service (GCDMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "8.3.2.17", + "Description": "Checks if storage encryption is enabled for Google Cloud Firestore. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "8.3.2.18", + "Description": "Checks if Google Cloud Firestore is encrypted with Google Cloud Key Management Service (KMS). The rule is NON_COMPLIANT if the Google Cloud Firestore database is not encrypted with Google Cloud KMS. The rule is also NON_COMPLIANT if the specified Google Cloud KMS key is not present in the kmsKeyArns input parameter.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "8.3.2.19", + "Description": "Checks if the Google Cloud Firestore databases are encrypted and checks their status. The rule is COMPLIANT if the status is enabled or enabling.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "8.3.2.20", + "Description": "Checks if Google Cloud Persistent Disk encryption is enabled by default. The rule is NON_COMPLIANT if the encryption is not enabled.", + "Name": "Google Compute Engine", + "Checks": [ + "compute_instance_encryption_with_csek_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "8.3.2.21", + "Description": "Checks if secrets are passed as environment variables in Google Cloud Run or Google Kubernetes Engine (GKE). The rule is NON_COMPLIANT if 1 or more environment variable key matches a key listed in the 'secretKeys' parameter, excluding variables from other sources like Google Cloud Storage.", + "Name": "Google Cloud Run / Google Kubernetes Engine", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Run / Google Kubernetes Engine" + } + ] + }, + { + "Id": "8.3.2.22", + "Description": "Checks if Google Cloud Filestore is configured to encrypt the file data using Google Cloud Key Management Service (Google Cloud KMS). The rule is NON_COMPLIANT if the 'encryptionKey' parameter in the Filestore instance configuration does not match the specified KMS key.", + "Name": "Google Cloud Filestore", + "Checks": [ + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "8.3.2.23", + "Description": "Checks if Google Kubernetes Engine (GKE) clusters are configured to have Kubernetes secrets encrypted using Google Cloud KMS. The rule is NON_COMPLIANT if a GKE cluster does not have an encryption configuration for secrets or if the encryption configuration does not specify secrets as a resource.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "8.3.2.24", + "Description": "Checks if Google Kubernetes Engine (GKE) clusters are configured to have Kubernetes secrets encrypted using Google Cloud Key Management Service (KMS) keys.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "8.3.2.25", + "Description": "Checks if Google Cloud Memorystore for Redis instances have encryption-at-rest enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'redisConfig.enableAuth' is disabled or if the 'redisConfig.kmsKeyName' does not match the approvedKmsKeyArns parameter.", + "Name": "Google Cloud Memorystore", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Memorystore" + } + ] + }, + { + "Id": "8.3.2.26", + "Description": "Checks if Google Cloud Memorystore for Redis instances have encryption-in-transit enabled. The rule is NON_COMPLIANT for a Memorystore instance if 'transitEncryptionMode' is set to 'DISABLED'.", + "Name": "Google Cloud Memorystore for Redis", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Memorystore for Redis" + } + ] + }, + { + "Id": "8.3.2.27", + "Description": "Checks if Google Cloud Search instances have encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption settings are not properly configured.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "8.3.2.28", + "Description": "Check if Google Cloud Elasticsearch (part of Google Cloud's managed services) has node-to-node encryption enabled. The rule should be NON_COMPLIANT if node-to-node encryption is not enabled for the Elasticsearch deployment.", + "Name": "Google Cloud Elasticsearch", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Elasticsearch" + } + ] + }, + { + "Id": "8.3.2.29", + "Description": "Checks if the TCP/UDP Load Balancers use SSL certificates provided by Google Cloud Certificate Manager. To use this rule, ensure the Load Balancer is set up for SSL or HTTPS traffic. This rule is only applicable to TCP/UDP Load Balancers. This rule does not check Application Load Balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "8.3.2.30", + "Description": "Checks whether your Cloud Load Balancer SSL policies are configured with a custom policy. The rule is only applicable if there are SSL listeners for the Cloud Load Balancer.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "8.3.2.31", + "Description": "Checks if your Google Cloud Platform Load Balancer SSL policies use a predefined policy. The rule is NON_COMPLIANT if the Google Cloud Load Balancer HTTPS/SSL listener's policy does not equal the value of the parameter 'predefinedPolicyName'.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "8.3.2.32", + "Description": "Checks if your Google Cloud Load Balancer is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured with SSL or HTTPS.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "8.3.2.33", + "Description": "Checks if Google Cloud Dataproc clusters have Kerberos enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or the security configuration does not satisfy the specified rule parameters.", + "Name": "Google Cloud Dataproc", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Dataproc" + } + ] + }, + { + "Id": "8.3.2.34", + "Description": "Checks if attached Google Persistent Disks are encrypted and optionally are encrypted with a specified Customer Managed Encryption Key (CMEK). The rule is NON_COMPLIANT if attached Persistent Disks are unencrypted or are encrypted with a CMEK not in the supplied parameters.", + "Name": "Google Cloud Storage and Compute Engine", + "Checks": [ + "compute_instance_encryption_with_csek_enabled", + "dataproc_encrypted_with_cmks_disabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Storage and Compute Engine" + } + ] + }, + { + "Id": "8.3.2.35", + "Description": "Checks if Google Cloud Pub/Sub topics are encrypted at rest with Google-managed encryption. The rule is NON_COMPLIANT for a Pub/Sub topic if 'Encryption' is not configured.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "8.3.2.36", + "Description": "Checks if a Google Cloud Pub/Sub topic enforces encryption in transit using HTTPS (TLS) when communicating with subscribers. The rule is NON_COMPLIANT if plain text communication is enabled for connections to the topic.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "8.3.2.37", + "Description": "Checks if storage encryption is enabled for your Google Cloud Spanner instances. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "8.3.2.38", + "Description": "Checks if a Cloud SQL instance in GCP has backups encrypted. The rule is NON_COMPLIANT if a Cloud SQL instance does not have backups encrypted.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_automated_backups", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "8.3.2.39", + "Description": "Checks if Google Cloud OpenSearch domains have encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption at rest options are not enabled.", + "Name": "Google Cloud OpenSearch", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud OpenSearch" + } + ] + }, + { + "Id": "8.3.2.40", + "Description": "Checks whether connections to Google Cloud Search domains are using HTTPS. The rule is NON_COMPLIANT if the Google Cloud Search domain 'EnforceHTTPS' is not 'true' or is 'true' and 'TLSecurityPolicy' is not in 'securityPolicies'.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "8.3.2.41", + "Description": "Check if Google Cloud Search nodes are encrypted end to end. The rule is NON_COMPLIANT if the node-to-node encryption is not enabled on the search service.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "8.3.2.42", + "Description": "Checks if a Google Cloud SQL instance is encrypted at rest. The rule is NON_COMPLIANT if a Google Cloud SQL instance is not encrypted at rest.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_ssl_connections", + "cloudsql_instance_sqlserver_contained_database_authentication_flag" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "8.3.2.43", + "Description": "Checks if Google Cloud SQL database snapshots are encrypted. The rule is NON_COMPLIANT if the Google Cloud SQL database snapshots are not encrypted.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_ssl_connections", + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.3.2.44", + "Description": "Checks if storage encryption is enabled for your Google Cloud SQL instances. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_ssl_connections", + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.3.2.45", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or if a dataset does not have audit logging enabled.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "8.3.2.46", + "Description": "Checks if Google BigQuery datasets are using a specified Google Cloud Key Management Service (Cloud KMS) key for encryption. The rule is COMPLIANT if encryption is enabled and the dataset is encrypted with the key provided. The rule is NON_COMPLIANT if the dataset is not encrypted or encrypted with another key.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_cmk_encryption", + "bigquery_table_cmk_encryption" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "8.3.2.47", + "Description": "Checks if Google BigQuery requires TLS/SSL encryption for connections. The rule is NON_COMPLIANT if any Google BigQuery service does not enforce TLS/SSL encryption for client connections.", + "Name": "Google BigQuery", + "Checks": [ + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "8.3.2.48", + "Description": "Checks if your Google Cloud Storage bucket has default object encryption enabled or if the bucket's IAM policies explicitly deny write access without using encryption such as Google-managed encryption keys. The rule is NON_COMPLIANT if your Google Cloud Storage bucket is not encrypted by default.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.3.2.49", + "Description": "Checks if Google Cloud Storage (GCS) buckets have policies that require requests to use SSL/TLS. The rule is NON_COMPLIANT if any GCS bucket has policies allowing HTTP requests.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.3.2.50", + "Description": "Checks if the Google Cloud Storage buckets are encrypted with Google Cloud KMS. The rule is NON_COMPLIANT if the Cloud Storage bucket is not encrypted with a Google Cloud KMS key.", + "Name": "Google Cloud Storage", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.3.2.51", + "Description": "Checks if Google Cloud Key Management Service (GCP KMS) key is configured for a Google Cloud AI Platform endpoint configuration. The rule is NON_COMPLIANT if 'kmsKeyName' is not specified for the Google Cloud AI Platform endpoint configuration.", + "Name": "Google Cloud AI Platform", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud AI Platform" + } + ] + }, + { + "Id": "8.3.2.52", + "Description": "Checks if a Google Cloud Key Management Service (GCP KMS) key is configured for a Google AI Platform Notebook instance. The rule is NON_COMPLIANT if 'kmsKeyName' is not specified for the AI Platform Notebook instance.", + "Name": "Google AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google AI Platform Notebooks" + } + ] + }, + { + "Id": "8.3.2.53", + "Description": "Checks if all secrets in Google Cloud Secret Manager are encrypted using Google-managed encryption keys or a customer-managed key created in Google Cloud Key Management Service (KMS). The rule is COMPLIANT if a secret is encrypted using a customer-managed key. This rule is NON_COMPLIANT if a secret is encrypted using Google-managed encryption keys.", + "Name": "Google Cloud Secret Manager", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.2.54", + "Description": "Checks if Pub/Sub topics are encrypted with Google Cloud Key Management Service (Google Cloud KMS). The rule is NON_COMPLIANT if a Pub/Sub topic is not encrypted with Google Cloud KMS. Optionally, specify the key resource names, the key aliases, or the key IDs for the rule to check.", + "Name": "Google Cloud Pub/Sub", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "8.3.4.1", + "Description": "Checks if a GCP project is part of an Organization. The rule is NON_COMPLIANT if a GCP project is not attached to a GCP Organization or the Organization ID does not match rule parameter OrganizationId.", + "Name": "Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Cloud Resource Manager" + } + ] + }, + { + "Id": "8.3.4.2", + "Description": "Checks if a Backup Vault in GCP has an attached IAM policy which prevents deletion of recovery points. The rule is NON_COMPLIANT if the Backup Vault does not have IAM policies or has policies without a suitable 'Deny' statement (statement with the permissions backup.deleteRecoveryPoint, backup.updateRecoveryPointLifecycle, and backup.putBackupVaultAccessPolicy).", + "Name": "Cloud Backup", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Cloud Backup" + } + ] + }, + { + "Id": "8.3.4.3", + "Description": "Checks if a Google Compute Engine (GCE) instance has a Google Cloud Identity and Access Management (IAM) service account attached to it. The rule is NON_COMPLIANT if no IAM service account is attached to the GCE instance.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.4", + "Description": "Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the Pod security context is set to 'false'.", + "Name": "Google Kubernetes Engine", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Kubernetes Engine" + } + ] + }, + { + "Id": "8.3.4.5", + "Description": "Checks if the managed Google Cloud IAM policies that you create do not allow blocked actions on Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on Google Cloud KMS keys by the managed IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.6", + "Description": "Checks if the IAM policies attached to your Google Cloud IAM users, roles, and groups do not allow blocked actions on all Google Cloud KMS keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Google Cloud KMS keys in an IAM policy.", + "Name": "Google Cloud IAM", + "Checks": [ + "kms_key_not_publicly_accessible", + "iam_role_kms_enforce_separation_of_duties", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.7", + "Description": "Checks if IAM policies are not inline policies. The rule is NON_COMPLIANT if a Google Cloud IAM user, IAM role, or IAM group has any inline policy associated with it.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.8", + "Description": "Checks in each Google Cloud Identity and Access Management (IAM) resource if a policy resource name (policy ARN equivalent) specified in the input parameter is attached to the IAM resource. The rule is NON_COMPLIANT if the policy resource name is attached to the IAM resource.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.9", + "Description": "Checks whether the IAM policy is attached to a Google Cloud IAM user, a group with one or more IAM users, or a service account (role) with one or more trusted identities.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.10", + "Description": "Checks if Google Cloud IAM policies that you create have Allow statements that grant permissions to all actions on all resources. The rule is NON_COMPLIANT if any customer-managed IAM policy statement includes 'role': 'roles/owner' or grants 'allUser' permissions over 'allResources'.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.11", + "Description": "Checks if Google Cloud IAM roles that you create grant permissions to all actions on individual Google Cloud resources. The rule is NON_COMPLIANT if any customer managed IAM role allows full access to at least 1 Google Cloud service.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level", + "iam_role_sa_enforce_separation_of_duties" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.12", + "Description": "Checks if all specified IAM policies are attached to the Google Cloud IAM Service Account. The rule is NON_COMPLIANT if a policy is not attached to the Service Account.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.13", + "Description": "Checks if none of your Google Cloud IAM users have policies directly attached. IAM users must inherit permissions from IAM groups or roles. The rule is NON_COMPLIANT if there is at least one policy attached to the IAM user.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_no_administrative_privileges", + "iam_no_service_roles_at_project_level" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.4.14", + "Description": "Checks if a Google Cloud Spanner instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud Spanner instance does not have IAM database authentication enabled.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "8.3.4.15", + "Description": "Checks if Google Cloud's Elasticsearch Service (managed by Elastic) domains have fine-grained access control enabled. The rule is NON_COMPLIANT if fine-grained access control is not enabled for the Elasticsearch domain.", + "Name": "Google Cloud Elasticsearch Service", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Elasticsearch Service" + } + ] + }, + { + "Id": "8.3.4.16", + "Description": "Checks if a Google Cloud SQL instance has IAM database authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.3.4.17", + "Description": "Checks if a Google Cloud SQL instance has Google Cloud Identity and Access Management (IAM) authentication enabled. The rule is NON_COMPLIANT if a Google Cloud SQL instance does not have IAM authentication enabled.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "8.3.4.18", + "Description": "Checks if Google Cloud Storage (GCS) Buckets allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Google Cloud Storage Buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.3.4.19", + "Description": "Checks if a Google Cloud Storage (GCS) bucket policy does not allow blocklisted bucket-level and object-level actions on resources in the bucket for principals from other Google Cloud projects. For example, the rule checks that the GCS bucket policy does not allow another Google Cloud project to perform any storage.objects.get and storage.objects.delete actions on any object in the bucket. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the GCS bucket policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.3.4.20", + "Description": "Checks that the access granted by the Google Cloud Storage bucket is restricted by any of the Google Cloud principals, IAM roles, service accounts, IP addresses, or VPNs that you provide. The rule is COMPLIANT if a bucket policy is not present.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.3.4.21", + "Description": "Verifies that your Google Cloud Storage bucket policies do not permit inter-project permissions beyond the specified control Cloud Storage bucket policy.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.3.4.22", + "Description": "Checks if the Google Cloud Security Operations team can access your Google Cloud account. The rule is NON_COMPLIANT if Cloud Armor is enabled but the role for Security Operations team access is not configured.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "8.3.5.1", + "Description": "Checks if active IAM service account keys are rotated (changed) within the number of days specified in keyRotationPeriod. The rule is NON_COMPLIANT if service account keys are not rotated within the specified time period. The default value is 90 days.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_user_managed_key_rotate_90_days", + "kms_key_rotation_enabled", + "apikeys_key_rotated_in_90_days" + ], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.5.2", + "Description": "Checks if Google Cloud Secret Manager secret has rotation enabled and verifies the rotation frequency against the maximum allowed frequency specified. The rule is NON_COMPLIANT if the secret is not scheduled for rotation or if the rotation frequency exceeds the given maximum allowed frequency.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.5.3", + "Description": "Checks if Google Cloud Secret Manager secrets are rotated successfully according to the rotation schedule. Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.5.4", + "Description": "Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.6.1", + "Description": "Checks if the account password policy for Google Cloud Identity users meets the specified requirements indicated in the parameters. The rule is NON_COMPLIANT if the account password policy does not meet the specified requirements.", + "Name": "Google Cloud Identity", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.6: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Identity" + } + ] + }, + { + "Id": "8.3.7.1", + "Description": "Checks if active IAM access keys are rotated (changed) within the number of days specified in maxAccessKeyAge (default 90 days). The rule is NON_COMPLIANT if access keys are not rotated within the specified time period.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_user_managed_key_rotate_90_days", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.7.2", + "Description": "Checks if Google Cloud Secret Manager secret has rotation enabled. The rule also checks an optional maxAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation or if the rotation frequency exceeds the specified maxAllowedRotationFrequency.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.7.3", + "Description": "Checks if Google Cloud Secret Manager secrets rotated successfully according to the rotation schedule. Google Cloud Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.7.4", + "Description": "Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.9.1", + "Description": "Checks if active IAM service account keys are rotated (changed) within the number of days specified in maxKeyAge. The rule is NON_COMPLIANT if service account keys are not rotated within the specified time period. The default value is 90 days.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_user_managed_key_rotate_90_days", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.3.9.2", + "Description": "Checks if Google Cloud Secret Manager secret has rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the specified maximumAllowedRotationFrequency parameter.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.3.9.3", + "Description": "Checks if GCP Secret Manager secrets are rotated successfully according to the rotation schedule. Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.", + "Name": "GCP Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed.", + "Service": "GCP Secret Manager" + } + ] + }, + { + "Id": "8.3.9.4", + "Description": "Checks if Google Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Google Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed.", + "Service": "Google Secret Manager" + } + ] + }, + { + "Id": "8.4.1.1", + "Description": "Checks if the Google Cloud Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one IAM user.", + "Name": "Google Cloud Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Google Cloud Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.4.1.2", + "Description": "Checks if Google Cloud multi-factor authentication (MFA) is enabled for all Google Cloud Identity and Access Management (IAM) users that use a console password. The rule is COMPLIANT if MFA is enabled.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.4.1.3", + "Description": "Checks if your GCP account is enabled to use multi-factor authentication (MFA) for signing in with the root service account. The rule is NON_COMPLIANT if any virtual MFA devices are allowed for root service account sign-ins.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.4.1.4", + "Description": "Verifies if the Google Cloud Platform (GCP) service account used has multi-factor authentication (MFA) enabled for enhanced security. The evaluation returns NON_COMPLIANT if the service account does not have MFA set up.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.4.1.5", + "Description": "Checks if Object Versioning is enabled in Google Cloud Storage buckets. The rule is NON_COMPLIANT if Object Versioning is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.4.2.1", + "Description": "Checks if the Google Cloud Identity and Access Management (IAM) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one IAM user.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.4.2.2", + "Description": "Checks if Google Cloud Platform (GCP) multi-factor authentication (MFA) is enabled for all Google Identity users that use a console password. The rule is COMPLIANT if MFA is enabled.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.4.2.3", + "Description": "Checks if your GCP account is enabled to use multi-factor authentication (MFA) for Google Cloud Platform accounts. The rule is NON_COMPLIANT if any accounts can sign in without a valid MFA setup.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.4.2.4", + "Description": "Checks if the root user of your GCP account requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the Google Cloud Platform (GCP) root account user does not have multi-factor authentication (MFA) enabled.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.4.2.5", + "Description": "Checks if Object Versioning is enabled in Google Cloud Storage (GCS) buckets. The rule is NON_COMPLIANT if Object Versioning is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.4.3.1", + "Description": "Checks if Google Cloud IAM users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one IAM user.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.4.3.2", + "Description": "Checks if Google Cloud Platform (GCP) multi-factor authentication (MFA) is enabled for all Google Cloud Identity users. The rule is COMPLIANT if MFA is enabled.", + "Name": "Google Cloud Identity", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Google Cloud Identity" + } + ] + }, + { + "Id": "8.4.3.3", + "Description": "Checks if your Google Cloud Platform (GCP) account is enabled to use multi-factor authentication (MFA) for the root user. The rule is NON_COMPLIANT if any virtual MFA devices are allowed for signing in with the administrator account.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "8.4.3.4", + "Description": "Checks if the root user of your GCP account requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the Google Cloud Identity root account user does not have multi-factor authentication (MFA) enabled.", + "Name": "Google Cloud Identity", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Google Cloud Identity" + } + ] + }, + { + "Id": "8.4.3.5", + "Description": "Checks if Object Versioning is enabled on Google Cloud Storage (GCS) buckets and requires additional security measures for delete operations. The rule is NON_COMPLIANT if Object Versioning is not enabled.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "8.6.3.1", + "Description": "Checks if active IAM service account keys are rotated (changed) within the number of days specified in maxAccessKeyAge. The rule is NON_COMPLIANT if service account keys are not rotated within the specified time period. The default value is 90 days.", + "Name": "Google Cloud IAM", + "Checks": [ + "iam_sa_user_managed_key_rotate_90_days", + "kms_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "8.6.3.2", + "Description": "Verifies if the organization’s Google Cloud Identity password policy adheres to specified requirements for users. The rule is NON_COMPLIANT if the password policy does not comply with these requirements.", + "Name": "Google Cloud Identity", + "Checks": [], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.", + "Service": "Google Cloud Identity" + } + ] + }, + { + "Id": "8.6.3.3", + "Description": "Checks if Google Cloud Secret Manager secret has rotation enabled. The rule also checks an optional maxRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the specified maxRotationFrequency parameter.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.6.3.4", + "Description": "Checks if Google Cloud Secret Manager secrets are rotated successfully according to the rotation schedule. Secret Manager calculates the date the rotation should happen. The rule is NON_COMPLIANT if the date passes and the secret isn't rotated.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "8.6.3.5", + "Description": "Checks if Google Cloud Secret Manager secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "A1.1.2.1", + "Description": "Checks if a backup vault has an attached IAM policy that prevents deletion of backup recovery points. The rule is NON_COMPLIANT if the Backup Vault does not have IAM policies or has policies lacking a suitable 'Deny' statement for deleting backups.", + "Name": "Google Cloud Backup and DR", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Backup and DR" + } + ] + }, + { + "Id": "A1.1.2.2", + "Description": "Checks if Google Cloud Database Migration Service (GCP DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the 'public' option is set to true.", + "Name": "Google Cloud Database Migration Service", + "Checks": [ + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "A1.1.2.3", + "Description": "Checks if Google Cloud Firestore snapshots are public. The rule is NON_COMPLIANT if any Google Cloud Firestore snapshots are public.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "A1.1.2.4", + "Description": "Checks if Google Cloud Persistent Disk snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots have permissions that allow public access.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.2.5", + "Description": "Checks if Google Kubernetes Engine (GKE) Pods only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem field in the Pod security context is set to 'false'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "A1.1.2.6", + "Description": "Checks if Google Cloud Filestore instances are configured to enforce a root directory. The rule is NON_COMPLIANT if the root directory is set to '/' (default root directory of the file system).", + "Name": "Google Cloud Filestore", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "A1.1.2.7", + "Description": "Checks if Google Cloud Filestore (GCP equivalent of Amazon EFS) access points are configured to enforce a user identity. The rule is NON_COMPLIANT if 'IAM permissions' are not defined or if parameters are provided and there is no match in the corresponding parameter.", + "Name": "Google Cloud Filestore", + "Checks": [ + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "A1.1.2.8", + "Description": "Checks if a Google Cloud account has VPC firewall rules set to block public access. The rule is NON_COMPLIANT if 'allowIngressFromAll' is true, or if true, ports other than Port 22 are open to ingress traffic from any source.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "A1.1.2.9", + "Description": "Checks if the Google Cloud Functions IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "A1.1.2.10", + "Description": "Checks if a Google Cloud SQL database instance snapshot is shared publicly. The rule is NON_COMPLIANT if any existing and new Cloud SQL snapshot is shared publicly.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "A1.1.2.11", + "Description": "Checks if the Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the `ipConfiguration.requireSsl` field is false and there are any public IP addresses assigned to the instance.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment", + "cloudsql_instance_ssl_connections" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "A1.1.2.12", + "Description": "Checks if Google Cloud SQL backups are public. The rule is NON_COMPLIANT if any existing and new Google Cloud SQL backups are public.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "A1.1.2.13", + "Description": "Checks if Google BigQuery datasets do not have public access. The rule is NON_COMPLIANT if the dataset's 'access' configuration includes entries that grant 'allUsers' or 'allAuthenticatedUsers' permissions.", + "Name": "Google BigQuery", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "A1.1.2.14", + "Description": "Checks if Google Cloud Storage (GCS) bucket access settings have uniform bucket-level access enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.2.15", + "Description": "Verifies if the necessary public access prevention settings are applied at the project level. The rule is considered NON_COMPLIANT only when the specified settings do not align with the corresponding settings in the configuration item.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.2.16", + "Description": "Checks if the required public access prevention settings are configured at the project level. The rule is NON_COMPLIANT if the configuration item does not match one or more settings from parameters (or default).", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.2.17", + "Description": "Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and the bucket access control settings allow public access.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "A1.1.2.18", + "Description": "Checks if Object Versioning is enabled and if Object Versioning is configured to require the 'Object Versioning' actions to be performed with the appropriate IAM policies in Google Cloud Storage (GCS). The rule is NON_COMPLIANT if these configurations are not met.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.2.19", + "Description": "Checks if your Google Cloud Storage buckets do not allow public read access. The rule evaluates the Uniform Bucket-Level Access settings, the bucket IAM policies, and ACLs to ensure they are properly configured to prevent public access.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.2.20", + "Description": "Checks if your Google Cloud Storage (GCS) buckets do not allow public write access. The rule checks the Bucket IAM policies, Uniform bucket-level access settings, and the bucket access control list (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.2.21", + "Description": "Checks if direct internet access is disabled for a Google AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.", + "Name": "Google AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google AI Platform Notebooks" + } + ] + }, + { + "Id": "A1.1.2.22", + "Description": "Checks if Google Cloud Platform (GCP) Deployment Manager configurations owned by the account are public. The rule is NON_COMPLIANT if Deployment Manager configurations with the owner 'Self' are public.", + "Name": "Deployment Manager", + "Checks": [ + "compute_instance_public_ip", + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Deployment Manager" + } + ] + }, + { + "Id": "A1.1.3.1", + "Description": "Checks if Google Cloud Endpoints APIs are of the type specified in the rule parameter endpointConfigurationType. The rule returns NON_COMPLIANT if the REST API does not match the endpoint type configured in the rule parameter.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "A1.1.3.2", + "Description": "Checks if a Cloud Endpoints API service uses an SSL certificate. The rule is NON_COMPLIANT if the API service does not have an associated SSL certificate.", + "Name": "Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Cloud Endpoints" + } + ] + }, + { + "Id": "A1.1.3.3", + "Description": "Checks if Google Cloud App Engine services are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT for a Google Cloud App Engine service if it is not associated with a security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "A1.1.3.4", + "Description": "Checks if Google Cloud CDN distributions are associated with Google Cloud Armor security policies. The rule is NON_COMPLIANT if a Cloud CDN distribution is not associated with a Cloud Armor security policy.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "A1.1.3.5", + "Description": "Checks if the SSL certificate associated with a Google Cloud CDN is the default SSL certificate. The rule is NON_COMPLIANT if a Cloud CDN uses the default SSL certificate.", + "Name": "Google Cloud CDN", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "A1.1.3.6", + "Description": "Checks if the Cloud Source Repositories URL contains sign-in credentials or not. The rule is NON_COMPLIANT if the URL contains any sign-in information and COMPLIANT if it doesn't.", + "Name": "Cloud Source Repositories", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Cloud Source Repositories" + } + ] + }, + { + "Id": "A1.1.3.7", + "Description": "Checks if Google Cloud Database Migration Service (GCP DMS) migration jobs are public. The rule is NON_COMPLIANT if the PubliclyAccessible field is set to true.", + "Name": "Google Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Database Migration Service" + } + ] + }, + { + "Id": "A1.1.3.8", + "Description": "Checks if Google Cloud Firestore backups are public. The rule is NON_COMPLIANT if any Google Cloud Firestore backups are public.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "A1.1.3.9", + "Description": "Checks if the Google Cloud VPN's authorization policies allow connection access for all users. The rule is NON_COMPLIANT if 'AllowAll' is present and set to true.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "A1.1.3.10", + "Description": "Checks if the status of the Google Cloud Resource Manager Policy compliance is COMPLIANT or NON_COMPLIANT after the policy execution on the resource. The rule is compliant if the field status is COMPLIANT. For more information about organizations and policies, see Understanding Organization Policies.", + "Name": "Google Cloud Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Resource Manager" + } + ] + }, + { + "Id": "A1.1.3.11", + "Description": "Checks if Google Cloud Platform (GCP) Cloud VPN requires 'auto-accept' for shared attachments to be enabled. The rule is NON_COMPLIANT for a Cloud VPN if 'auto-accept' is set to 'true'.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "A1.1.3.12", + "Description": "Verifies if the Google Kubernetes Engine (GKE) cluster endpoint is not publicly accessible. The rule is NON_COMPLIANT if the endpoint is publicly accessible.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [ + "compute_instance_public_ip" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "A1.1.3.13", + "Description": "Checks if Google Cloud Search (a service similar to Amazon OpenSearch) instances are in Google Virtual Private Cloud (Google VPC). The rule is NON_COMPLIANT if a Google Cloud Search instance is publicly accessible.", + "Name": "Google Cloud Search", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Search" + } + ] + }, + { + "Id": "A1.1.3.14", + "Description": "Checks if Google Cloud HTTP(S) Load Balancers have backend services that are configured to use SSL certificates from Google Cloud Managed Certificates or Google Cloud IAM Certificates. This rule is NON_COMPLIANT if at least 1 load balancer has at least 1 backend service configured without a certificate or is configured with a certificate different from Google Cloud Managed Certificates or IAM certificates.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "A1.1.3.15", + "Description": "Checks if the Google Cloud Load Balancers use SSL certificates provided by Google Managed SSL Certificates. To use this rule, use an SSL or HTTPS frontend configuration with your Google Cloud Load Balancer. This rule is only applicable to Google Cloud Load Balancers. This rule does not check other types of load balancers.", + "Name": "Google Cloud Load Balancing", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "A1.1.3.16", + "Description": "Checks if a Google Cloud account has public access settings enabled for its Compute Engine instances. The rule is NON_COMPLIANT if 'blockPublicIp' is false, or if true, any firewall rules allow ingress traffic on ports other than Port 22.", + "Name": "Google Cloud Compute Engine", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_instance_public_ip", + "compute_firewall_rdp_access_from_the_internet_allowed", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "A1.1.3.17", + "Description": "In GCP, the equivalent for disabling incoming SSH traffic can be achieved by configuring firewall rules to disallow ingress on port 22, effectively restricting SSH access.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "A1.1.3.18", + "Description": "Checks if the Cloud Router is associated with an authorized Virtual Private Cloud (VPC) in Google Cloud Platform (GCP). The rule is NON_COMPLIANT if the Cloud Router is associated with an unauthorized VPC.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "A1.1.3.19", + "Description": "Checks if the Google Cloud Functions IAM policy attached to the Cloud Function resource prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "A1.1.3.20", + "Description": "Checks if a Cloud Function is allowed access to a Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if the Cloud Function is not VPC enabled.", + "Name": "Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Cloud Functions" + } + ] + }, + { + "Id": "A1.1.3.21", + "Description": "Checks if Google Cloud firewall rules allow unrestricted ingress traffic for SSH (port 22) and RDP (port 3389). The rule is NON_COMPLIANT if a firewall rule allows ingress traffic from any source IP range (0.0.0.0/0) for those ports.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "A1.1.3.22", + "Description": "Checks if a Google Cloud Platform (GCP) firewall policy is configured with a user-defined 'default action' for fragmented packets. The rule is NON_COMPLIANT if the default action for fragmented packets does not match the user-defined default action.", + "Name": "Google Cloud Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "A1.1.3.23", + "Description": "Check GCP Firewall Rule is associated with ingress or egress rules. This rule is NON_COMPLIANT if no ingress or egress rules are associated with the Firewall Rule, else COMPLIANT if any one of the rule types exists.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "A1.1.3.24", + "Description": "Checks if a Google Cloud Platform (GCP) Firewall Rule contains rules. The rule is NON_COMPLIANT if there are no rules in a GCP Firewall Rule.", + "Name": "Google Cloud Firewall", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "A1.1.3.25", + "Description": "Checks if there are public routes in the route table to a Cloud Router or Cloud NAT. The rule is NON_COMPLIANT if a route to a Cloud Router or Cloud NAT has a destination CIDR block of '0.0.0.0/0' or '::/0' or if a destination CIDR block does not match the rule parameter.", + "Name": "Google Cloud Networking", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Networking" + } + ] + }, + { + "Id": "A1.1.3.26", + "Description": "Checks if Google Cloud Elasticsearch (GCE) clusters are within a Google Virtual Private Cloud (VPC). The rule is NON_COMPLIANT if an Elasticsearch cluster endpoint is public.", + "Name": "Google Cloud Elasticsearch (GCE)", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Elasticsearch (GCE)" + } + ] + }, + { + "Id": "A1.1.3.27", + "Description": "Checks if there are any Google Cloud SQL database instances that are not using the default Cloud SQL service account. The rule is NON_COMPLIANT if there are any Cloud SQL instances that are not using the default service account.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_sqlserver_contained_database_authentication_flag", + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_sqlserver_user_options_flag" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "A1.1.3.28", + "Description": "Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'ipAddresses' field contains a public IP address.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment", + "compute_instance_public_ip" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "A1.1.3.29", + "Description": "Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset's access control configuration allows public access.", + "Name": "BigQuery", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "A1.1.3.30", + "Description": "Checks if Google Cloud Storage (GCS) buckets have uniform bucket-level access enabled. The rule is NON_COMPLIANT if uniform bucket-level access is not enabled for GCS buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.3.31", + "Description": "Checks if the required public access options are configured at the project level in Google Cloud Platform (GCP). The rule is only NON_COMPLIANT when the public access settings do not match the configured settings.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "bigquery_dataset_public_access", + "compute_instance_public_ip", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.3.32", + "Description": "Checks if the required public access prevention settings are configured at the project level in Google Cloud Platform. The rule is NON_COMPLIANT if the configuration does not match one or more settings from parameters (or default).", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudsql_instance_public_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "A1.1.3.33", + "Description": "Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket does not meet the exclusion criteria and has bucket-level permissions that allow public access.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.3.34", + "Description": "Checks if your Google Cloud Storage buckets do not allow public read access. The rule verifies the Uniform Bucket-Level Access settings, the bucket IAM policies, and the bucket permissions.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_uniform_bucket_level_access", + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.3.35", + "Description": "Checks if your Google Cloud Storage buckets do not allow public write access by evaluating the Bucket IAM policies and public access prevention settings.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.1.3.36", + "Description": "Checks if a Google AI Platform Notebooks instance is launched within a VPC or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not launched within a VPC or if its subnet ID is not included in the parameter list.", + "Name": "Google AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google AI Platform Notebooks" + } + ] + }, + { + "Id": "A1.1.3.37", + "Description": "Checks if direct internet access is disabled for a Google Cloud AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.", + "Name": "Google Cloud AI Platform", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud AI Platform" + } + ] + }, + { + "Id": "A1.1.3.38", + "Description": "Checks if Private Service Access for the service specified in the rule parameter is configured for each Google Cloud VPC. The rule is NON_COMPLIANT if a Google Cloud VPC doesn't have a Private Service Access configured for the service.", + "Name": "Google Cloud VPC", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "A1.1.3.39", + "Description": "Checks if there are unused firewall rules in Google Cloud. The rule is COMPLIANT if each firewall rule is associated with a network. The rule is NON_COMPLIANT if a firewall rule is not associated with a network.", + "Name": "Google Cloud VPC Firewall Rules", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud VPC Firewall Rules" + } + ] + }, + { + "Id": "A1.1.3.40", + "Description": "Checks if Google Cloud Firewall rules allowing unrestricted incoming traffic ('0.0.0.0/0' or '::/0') only allow inbound TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if such firewall rules do not have ports specified in the rule parameters.", + "Name": "Google Cloud Firewall", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed", + "compute_firewall_rdp_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "A1.1.3.41", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if there are no rules present within the security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "A1.1.3.42", + "Description": "Checks if a Google Cloud Armor security policy contains any rules. The policy is NON_COMPLIANT if no rules are present within the Google Cloud Armor security policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "A1.1.3.43", + "Description": "Verifies if a Google Cloud Armor Security Policy contains any firewall rules or rule groups. The policy is considered NON_COMPLIANT if it does not include any security rules or rule groups.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "A1.1.3.44", + "Description": "Checks if Cloud Armor security policy rule groups contain any rules. The rule is NON_COMPLIANT if there are no rules present within a Cloud Armor security policy rule group.", + "Name": "Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Cloud Armor" + } + ] + }, + { + "Id": "A1.1.3.45", + "Description": "Checks whether the Google Cloud Armor security policy contains rules with conditions. The rule is COMPLIANT if the security policy contains at least one rule with conditions and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "A1.1.3.46", + "Description": "Checks if a GCP Cloud Armor Security Policy contains any rules. The rule is NON_COMPLIANT if there are no security rules present within a Cloud Armor Security Policy.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "A1.2.1.1", + "Description": "Checks if Google Cloud Endpoints services have access logging enabled. The rule is NON_COMPLIANT if 'accessLogSettings' is not present in the service configuration.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "A1.2.1.2", + "Description": "Checks if all methods in Google Cloud Endpoints have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither ERROR nor INFO.", + "Name": "Google Cloud Endpoints", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "A1.2.1.3", + "Description": "Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "A1.2.1.4", + "Description": "Checks if a Google Cloud API Gateway has logging enabled. The rule is NON_COMPLIANT if logging is not enabled or the 'logLevel' is neither ERROR nor ALL.", + "Name": "Google Cloud API Gateway", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud API Gateway" + } + ] + }, + { + "Id": "A1.2.1.5", + "Description": "Checks if Google Cloud Load Balancers are configured with a user-defined Desync mitigation mode. The rule is NON_COMPLIANT if the Load Balancer's Desync mitigation mode does not match the user-defined Desync mitigation mode.", + "Name": "Google Cloud Load Balancing", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Load Balancing" + } + ] + }, + { + "Id": "A1.2.1.6", + "Description": "Checks if Google Cloud CDN is configured to deliver access logs to a Google Cloud Storage bucket. The rule is NON_COMPLIANT if a Cloud CDN configuration does not have logging enabled.", + "Name": "Google Cloud CDN", + "Checks": [ + "compute_loadbalancer_logging_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud CDN" + } + ] + }, + { + "Id": "A1.2.1.7", + "Description": "Checks if at least one Google Cloud Audit logging configuration is logging read and write events for all Google Cloud Storage buckets. The rule is NON_COMPLIANT if there are no audit logs configured to record Cloud Storage data events.", + "Name": "Google Cloud Storage", + "Checks": [ + "iam_audit_logs_enabled", + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.2.1.8", + "Description": "Checks that there is at least one Google Cloud Audit Logging enabled for a project with security best practices. This rule is COMPLIANT if there is at least one audit log configuration that meets all of the following criteria.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "A1.2.1.9", + "Description": "Checks if Google Cloud Logging Log Buckets are encrypted with any Google Cloud KMS key or a specified Google Cloud KMS key Id. The rule is NON_COMPLIANT if a Log Bucket is not encrypted with a KMS key or is encrypted with a KMS key not supplied in the rule parameter.", + "Name": "Google Cloud Logging", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "A1.2.1.10", + "Description": "In GCP, the equivalent for enabling CloudTrail is enabling Cloud Audit Logs, which tracks API activity for projects and services.", + "Name": "Cloud Audit Logs", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Cloud Audit Logs" + } + ] + }, + { + "Id": "A1.2.1.11", + "Description": "Checks if Google Cloud Logging is configured to use Cloud Key Management Service (Cloud KMS) encryption. The rule is COMPLIANT if the KmsKeyId is defined.", + "Name": "Google Cloud Logging", + "Checks": [ + "kms_key_rotation_enabled", + "kms_key_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "A1.2.1.12", + "Description": "Checks if Google Cloud Audit Logs have integrity validation enabled. Google Cloud recommends that integrity validation should be enabled for all audit logs to ensure their authenticity. The rule is NON_COMPLIANT if the validation is not enabled.", + "Name": "Cloud Audit Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Cloud Audit Logging" + } + ] + }, + { + "Id": "A1.2.1.13", + "Description": "Checks if a Google Cloud Build configuration has at least one logging option enabled. The rule is NON_COMPLIANT if the status of all present logging configurations is set to 'DISABLED'.", + "Name": "Google Cloud Build", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Build" + } + ] + }, + { + "Id": "A1.2.1.14", + "Description": "Checks if logging is enabled with a valid severity level for GCP Data Migration Service replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Google Cloud Data Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Data Migration Service" + } + ] + }, + { + "Id": "A1.2.1.15", + "Description": "Checks if a Google Cloud Firestore (NoSQL document database) instance has Cloud Logging export enabled for audit logs. The rule is NON_COMPLIANT if a Google Cloud Firestore instance does not have Cloud Logging export enabled for audit logs.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "A1.2.1.16", + "Description": "Checks if Google Cloud VPN has logging enabled for client connections. The rule is NON_COMPLIANT if 'logging.enabled' is set to false.", + "Name": "Google Cloud VPN", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud VPN" + } + ] + }, + { + "Id": "A1.2.1.17", + "Description": "Checks if logging is configured on active Google Cloud Run services. This rule is NON_COMPLIANT if an active service does not have logging enabled or the logging configuration is not set for at least one revision.", + "Name": "Google Cloud Run", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Run" + } + ] + }, + { + "Id": "A1.2.1.18", + "Description": "Checks if a Google Kubernetes Engine (GKE) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for GKE clusters is not enabled for all log types.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "A1.2.1.19", + "Description": "Checks if Google Cloud App Engine services are configured to send logs to Google Cloud Logging. The rule is NON_COMPLIANT if the value of 'enableStackdriverLogging' is false.", + "Name": "Google Cloud App Engine", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud App Engine" + } + ] + }, + { + "Id": "A1.2.1.20", + "Description": "Checks if the Google Cloud Load Balancer has logging enabled. The rule is NON_COMPLIANT if the 'logging' property is false or the 'logBucket' is not equal to the provided bucket name.", + "Name": "Google Cloud Load Balancer", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Load Balancer" + } + ] + }, + { + "Id": "A1.2.1.21", + "Description": "Checks if Google Cloud Pub/Sub subscriptions have Cloud Logging enabled. The rule is NON_COMPLIANT if a subscription does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "A1.2.1.22", + "Description": "Checks if a Google Cloud Pub/Sub subscription has logging enabled. The rule is NON_COMPLIANT if the subscription does not have logging enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "A1.2.1.23", + "Description": "In GCP, the equivalent of enabling multi-region logging is to ensure that Cloud Logging is set up to collect logs from multiple regions. This ensures that logs are stored and accessible across different geographical locations.", + "Name": "Google Cloud Logging", + "Checks": [ + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "A1.2.1.24", + "Description": "Checks if a Google Cloud Spanner instance has Stackdriver Logging enabled for audit logs. The rule is NON_COMPLIANT if a Spanner instance does not have Stackdriver Logging enabled for audit logs.", + "Name": "Google Cloud Spanner", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Spanner" + } + ] + }, + { + "Id": "A1.2.1.25", + "Description": "Checks if Google Cloud Platform (GCP) firewall rules have logging enabled. The rule is NON_COMPLIANT if logging is not configured. You can specify which logging type you want the rule to check.", + "Name": "Google Cloud Firewall", + "Checks": [ + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", + "compute_loadbalancer_logging_enabled", + "compute_subnet_flow_logs_enabled", + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Firewall" + } + ] + }, + { + "Id": "A1.2.1.26", + "Description": "Checks if Google Cloud SQL instances for MySQL are configured to log audit logs to Google Cloud Logging. The rule is NON_COMPLIANT if Cloud SQL for MySQL instances do not have audit log publishing configured.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_messages_flag", + "cloudsql_instance_postgres_log_error_verbosity_flag" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "A1.2.1.27", + "Description": "Checks if the respective logs of Cloud SQL for PostgreSQL or MySQL are enabled. The rule is NON_COMPLIANT if any log types (like general logs, slow query logs, or audit logs) are not enabled.", + "Name": "Cloud SQL", + "Checks": [ + "cloudsql_instance_postgres_log_connections_flag", + "cloudsql_instance_postgres_log_min_error_statement_flag", + "cloudsql_instance_postgres_log_disconnections_flag", + "cloudsql_instance_postgres_log_min_messages_flag" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Cloud SQL" + } + ] + }, + { + "Id": "A1.2.1.28", + "Description": "Checks if Google BigQuery datasets have audit logging enabled to a specific Cloud Storage bucket. The rule is NON_COMPLIANT if audit logging is not enabled for a BigQuery dataset or if the 'bucketNames' parameter is provided but the audit logging destination does not match.", + "Name": "Google BigQuery", + "Checks": [ + "iam_audit_logs_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google BigQuery" + } + ] + }, + { + "Id": "A1.2.1.29", + "Description": "Checks if Google BigQuery datasets have the specified settings. The rule is NON_COMPLIANT if the BigQuery dataset is not encrypted or encrypted with another key, or if the dataset does not have audit logging enabled.", + "Name": "BigQuery", + "Checks": [ + "bigquery_dataset_public_access", + "bigquery_dataset_cmk_encryption" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "A1.2.1.30", + "Description": "Checks if DNS query logging is enabled for your Google Cloud DNS managed zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Google Cloud DNS managed zones.", + "Name": "Google Cloud DNS", + "Checks": [ + "compute_network_dns_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud DNS" + } + ] + }, + { + "Id": "A1.2.1.31", + "Description": "Checks if Google Cloud Storage (GCS) buckets are publicly accessible. The rule is NON_COMPLIANT if a GCS bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A1.2.1.32", + "Description": "Checks if logging is enabled for your Cloud Storage buckets in GCP. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Cloud Storage", + "Checks": [ + "cloudstorage_bucket_log_retention_policy_lock", + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "compute_loadbalancer_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Cloud Storage" + } + ] + }, + { + "Id": "A1.2.1.33", + "Description": "Checks if Google Cloud Workflow has logging enabled. The rule is NON_COMPLIANT if a Cloud Workflow does not have logging enabled or the logging configuration is not at the minimum level provided.", + "Name": "Google Cloud Workflows", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Workflows" + } + ] + }, + { + "Id": "A1.2.1.34", + "Description": "Checks if Google Cloud Virtual Private Cloud (GCP VPC) flow logs are found and enabled for all GCP VPCs. The rule is NON_COMPLIANT if flow logs are not enabled for at least one GCP VPC.", + "Name": "Google Cloud VPC", + "Checks": [ + "compute_subnet_flow_logs_enabled", + "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", + "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud VPC" + } + ] + }, + { + "Id": "A1.2.1.35", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT if the logging is enabled but the logging destination does not match the specified value.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "A1.2.1.36", + "Description": "Checks if logging is enabled on Google Cloud Armor security policies. The rule is NON_COMPLIANT for a security policy, if it does not have logging enabled.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "A1.2.3.1", + "Description": "Checks if you have provided security contact information for your Google Cloud Platform project. The rule is NON_COMPLIANT if security contact information within the project is not provided.", + "Name": "Google Cloud IAM (Identity and Access Management)", + "Checks": [ + "iam_account_access_approval_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers.", + "Service": "Google Cloud IAM (Identity and Access Management)" + } + ] + }, + { + "Id": "A3.2.5.1.1", + "Description": "Checks if automated sensitive data discovery is enabled for Google Cloud Data Loss Prevention (DLP). The rule is NON_COMPLIANT if automated sensitive data discovery is disabled. The rule is APPLICABLE for administrator accounts and NOT_APPLICABLE for member accounts.", + "Name": "Google Cloud DLP", + "Checks": [], + "Attributes": [ + { + "Section": "A3.2.5.1: PCI DSS scope is documented and validated.", + "Service": "Google Cloud DLP" + } + ] + }, + { + "Id": "A3.2.5.1.2", + "Description": "Checks if Google Cloud Data Loss Prevention (DLP) is enabled in your project. The rule is NON_COMPLIANT if the 'status' attribute is not set to 'ENABLED'.", + "Name": "Google Cloud Data Loss Prevention (DLP)", + "Checks": [], + "Attributes": [ + { + "Section": "A3.2.5.1: PCI DSS scope is documented and validated.", + "Service": "Google Cloud Data Loss Prevention (DLP)" + } + ] + }, + { + "Id": "A3.2.5.1.3", + "Description": "Checks if automated sensitive data discovery is enabled for Google Cloud Data Loss Prevention (DLP). The rule is NON_COMPLIANT if automated sensitive data discovery is disabled. The rule is APPLICABLE for administrator accounts and NOT_APPLICABLE for member accounts.", + "Name": "Google Cloud Data Loss Prevention (DLP)", + "Checks": [], + "Attributes": [ + { + "Section": "A3.2.5.2: PCI DSS scope is documented and validated.", + "Service": "Google Cloud Data Loss Prevention (DLP)" + } + ] + }, + { + "Id": "A3.2.5.1.4", + "Description": "Checks if Google Cloud Data Loss Prevention (DLP) is enabled in your project. The rule is NON_COMPLIANT if the DLP API is not enabled.", + "Name": "Google Cloud DLP", + "Checks": [], + "Attributes": [ + { + "Section": "A3.2.5.2: PCI DSS scope is documented and validated.", + "Service": "Google Cloud DLP" + } + ] + }, + { + "Id": "A3.3.1.1", + "Description": "Checks if Google Cloud Trace tracing is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Trace", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Cloud Trace" + } + ] + }, + { + "Id": "A3.3.1.2", + "Description": "Checks if your Google Cloud Deployment Manager configurations send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager configurations do not send notifications.", + "Name": "Google Cloud Deployment Manager", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Cloud Deployment Manager" + } + ] + }, + { + "Id": "A3.3.1.3", + "Description": "Checks if Google Cloud Monitoring alert policies have notification channels configured for the 'ALERTING', 'PENDING', or 'DISABLED' states. Optionally checks if any channels match a specified notification channel ID. The rule is NON_COMPLIANT if there is no notification channel specified for the alert policy or optional parameter.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "A3.3.1.4", + "Description": "Checks if a resource type has a Cloud Monitoring alert policy for the specified metric. For resource types, you can specify Persistent Disks, Compute Engine instances, Cloud SQL instances, or Cloud Storage buckets. The rule is COMPLIANT if the specified metric has a resource ID and a Cloud Monitoring alert policy.", + "Name": "Cloud Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Cloud Monitoring" + } + ] + }, + { + "Id": "A3.3.1.5", + "Description": "Checks whether Google Cloud Monitoring alerts with the given metric name have the specified settings.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "A3.3.1.6", + "Description": "Checks if Google Cloud Audit Logs are configured to send logs to Google Cloud Logging. The audit logging is NON_COMPLIANT if the log sink is not properly set up or is not sending the audit logs to Google Cloud Logging.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_sink_created" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "A3.3.1.7", + "Description": "Checks if Stackdriver Monitoring is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if Stackdriver Monitoring is not enabled.", + "Name": "Google Compute Engine", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Compute Engine" + } + ] + }, + { + "Id": "A3.3.1.8", + "Description": "Checks if Google Cloud Storage (GCS) Notifications are enabled on a GCS bucket. The rule is NON_COMPLIANT if GCS Notifications are not set on a bucket, or if the event type or destination do not match specified event types and destination parameters.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A3.3.1.9", + "Description": "Checks if Google Cloud Security Command Center is enabled for a Google Cloud project. The rule is NON_COMPLIANT if Google Cloud Security Command Center is not enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "A3.3.1.10", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for delivery status of messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "A3.3.1.11", + "Description": "Checks if Google Cloud Monitoring metrics collection on Google Cloud Armor security policies is enabled. The rule is NON_COMPLIANT if the 'enableMonitoring' field is set to false.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.", + "Service": "Google Cloud Armor" + } + ] + }, + { + "Id": "A3.4.1.1", + "Description": "Checks if a Cloud Storage bucket has an attached IAM policy which prevents deletion of objects. The rule is NON_COMPLIANT if the Cloud Storage bucket does not have IAM policies or has policies without a suitable 'Deny' statement (statement with storage.objects.delete permission).", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A3.4.1.2", + "Description": "Checks if Google Cloud Database Migration Service (Cloud DMS) connection profiles are public. The rule is NON_COMPLIANT if the 'public' property is set to true.", + "Name": "Cloud Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Cloud Database Migration Service" + } + ] + }, + { + "Id": "A3.4.1.3", + "Description": "Checks if Google Cloud Firestore database snapshots are public. The rule is NON_COMPLIANT if any Firestore database snapshots are public.", + "Name": "Google Cloud Firestore", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Firestore" + } + ] + }, + { + "Id": "A3.4.1.4", + "Description": "Checks if Google Cloud Persistent Disk snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots have permissions that allow public access, indicating that Google Cloud Persistent Disk snapshots are public.", + "Name": "Google Cloud Compute Engine", + "Checks": [ + "cloudstorage_bucket_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "A3.4.1.5", + "Description": "Checks if Google Kubernetes Engine (GKE) Containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the securityContext.privileged parameter in the container specification is set to 'false' or the readOnlyRootFilesystem parameter is not set to 'true'.", + "Name": "Google Kubernetes Engine (GKE)", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Kubernetes Engine (GKE)" + } + ] + }, + { + "Id": "A3.4.1.6", + "Description": "Checks if Google Cloud Filestore instances are configured to enforce a root directory. The rule is NON_COMPLIANT if the root path is accessible without restrictions.", + "Name": "Google Cloud Filestore", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "A3.4.1.7", + "Description": "Checks if Google Cloud Filestore access control is configured to enforce a user identity. The rule is NON_COMPLIANT if 'identity' is not defined or if parameters are provided and there is no match in the corresponding parameter.", + "Name": "Google Cloud Filestore", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Filestore" + } + ] + }, + { + "Id": "A3.4.1.8", + "Description": "Checks if a Google Cloud account has block public access settings enabled. The rule is NON_COMPLIANT if 'BlockPublicAccess' is false, or if true, firewall rules allowing traffic on ports other than Port 22 are listed in 'AllowedFirewallRules'.", + "Name": "Google Cloud Firewalls", + "Checks": [ + "compute_firewall_ssh_access_from_the_internet_allowed" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Firewalls" + } + ] + }, + { + "Id": "A3.4.1.9", + "Description": "Checks if IAM groups in Google Cloud have at least one IAM user assigned.", + "Name": "Identity and Access Management (IAM)", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Identity and Access Management (IAM)" + } + ] + }, + { + "Id": "A3.4.1.10", + "Description": "Checks if your Google Cloud IAM users have passwords or active access keys that have not been used within the specified number of days you provided. The rule is NON_COMPLIANT if there are inactive accounts not recently used.", + "Name": "Google Cloud IAM", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud IAM" + } + ] + }, + { + "Id": "A3.4.1.11", + "Description": "Checks if the Google Cloud Functions IAM policy attached to the Cloud Function prohibits public access. If the Cloud Function IAM policy allows public access it is NON_COMPLIANT.", + "Name": "Google Cloud Functions", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Functions" + } + ] + }, + { + "Id": "A3.4.1.12", + "Description": "Checks if a Google Cloud SQL instance snapshot is public. The rule is NON_COMPLIANT if any existing and new Cloud SQL instance snapshots are public.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_ip", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "A3.4.1.13", + "Description": "Checks if Google Cloud SQL instances are not publicly accessible. The rule is NON_COMPLIANT if the 'publicIp' field is enabled in the instance configuration.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_private_ip_assignment", + "compute_instance_public_ip" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "A3.4.1.14", + "Description": "Checks if Google Cloud SQL backups are public. The rule is NON_COMPLIANT if any existing and new Google Cloud SQL backups are public.", + "Name": "Google Cloud SQL", + "Checks": [ + "cloudsql_instance_public_access", + "cloudsql_instance_public_ip", + "cloudsql_instance_automated_backups" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud SQL" + } + ] + }, + { + "Id": "A3.4.1.15", + "Description": "Checks if Google BigQuery datasets are not publicly accessible. The rule is NON_COMPLIANT if the dataset's defaultAccessEntry has a role of 'READER' granted to 'allUsers'.", + "Name": "BigQuery", + "Checks": [ + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "BigQuery" + } + ] + }, + { + "Id": "A3.4.1.16", + "Description": "Checks if Google Cloud Storage bucket IAM policies have public access prevention settings enabled. The rule is NON_COMPLIANT if public access prevention settings are not enabled for Google Cloud Storage buckets.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "bigquery_dataset_public_access", + "cloudstorage_bucket_log_retention_policy_lock" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A3.4.1.17", + "Description": "Verifies that the required public access prevention settings are configured at the project level. The status is considered NON_COMPLIANT when the specified settings do not match the corresponding fields in the project configuration.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A3.4.1.18", + "Description": "Checks if the required public access prevention settings are configured at the project level. The rule is NON_COMPLIANT if the configuration item does not match one or more settings from parameters (or default).", + "Name": "Google Cloud Storage (GCS)", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Storage (GCS)" + } + ] + }, + { + "Id": "A3.4.1.19", + "Description": "Checks if Google Cloud Storage buckets are publicly accessible. The rule is NON_COMPLIANT if a Cloud Storage bucket is not listed in the excludedPublicBuckets parameter and the bucket's permissions settings allow public access.", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access", + "bigquery_dataset_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A3.4.1.20", + "Description": "Checks if Object Versioning is enabled and if it requires additional authentication for critical actions in Google Cloud Storage buckets. The rule is NON_COMPLIANT if additional authentication is not required.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A3.4.1.21", + "Description": "Checks if your Google Cloud Storage buckets do not allow public read access. The rule checks the Uniform Bucket-Level Access settings, the bucket policy, and the bucket access control list (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A3.4.1.22", + "Description": "Checks if your Google Cloud Storage buckets do not allow public write access. The rule checks the Uniform bucket-level access settings, the bucket IAM policies, and the bucket access control list (ACL).", + "Name": "Google Cloud Storage", + "Checks": [ + "cloudstorage_bucket_public_access", + "cloudstorage_bucket_uniform_bucket_level_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A3.4.1.23", + "Description": "Checks if direct internet access is disabled for a Google Cloud AI Platform Notebook instance. The rule is NON_COMPLIANT if an AI Platform Notebook instance is internet-enabled.", + "Name": "Google Cloud AI Platform Notebooks", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud AI Platform Notebooks" + } + ] + }, + { + "Id": "A3.4.1.24", + "Description": "Checks if Google Cloud Secret Manager secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in 'unusedForDays' number of days. The default value is 90 days.", + "Name": "Google Cloud Secret Manager", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Secret Manager" + } + ] + }, + { + "Id": "A3.4.1.25", + "Description": "Checks if Google Cloud Compute Engine instance templates owned by the account are public. The rule is NON_COMPLIANT if instance templates with the owner 'Self' are set to allow public access.", + "Name": "Google Cloud Compute Engine", + "Checks": [ + "compute_instance_public_ip", + "cloudstorage_bucket_public_access", + "cloudsql_instance_public_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed.", + "Service": "Google Cloud Compute Engine" + } + ] + }, + { + "Id": "A3.5.1.1", + "Description": "Checks if Google Cloud Trace is enabled on Google Cloud Endpoints. The rule is COMPLIANT if Cloud Trace is enabled and NON_COMPLIANT otherwise.", + "Name": "Google Cloud Endpoints", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Endpoints" + } + ] + }, + { + "Id": "A3.5.1.2", + "Description": "Checks if your Google Cloud deployments (using Deployment Manager) send event notifications to a Google Cloud Pub/Sub topic. Optionally checks if specified Pub/Sub topics are used. The rule is NON_COMPLIANT if Deployment Manager deployments do not send notifications.", + "Name": "Google Cloud Deployment Manager", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Deployment Manager" + } + ] + }, + { + "Id": "A3.5.1.3", + "Description": "Checks if Cloud Monitoring alerts have notification channels configured for ALERTING, PENDING, or NO_DATA states. Optionally checks if any notification channels match a specific resource name (ARN). The rule is NON_COMPLIANT if there is no action specified for the alert or optional parameter.", + "Name": "Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Cloud Monitoring" + } + ] + }, + { + "Id": "A3.5.1.4", + "Description": "Checks if a Google Cloud resource type has a Google Cloud Monitoring alert policy for the specified metric. For resource types, you can specify Compute Engine instances, Cloud Storage buckets, Cloud SQL instances, or Persistent Disks. The rule is COMPLIANT if the specified metric has a resource ID and an alert policy.", + "Name": "Google Cloud Monitoring", + "Checks": [ + "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "A3.5.1.5", + "Description": "Checks whether Google Cloud Monitoring alerts with the given metric name have the specified settings.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "A3.5.1.6", + "Description": "Checks if Google Cloud Audit Logging is configured to send logs to Cloud Logging. The audit log configuration is NON_COMPLIANT if the log sink is not properly set to export logs.", + "Name": "Google Cloud Logging", + "Checks": [ + "iam_audit_logs_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", + "logging_sink_created" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Logging" + } + ] + }, + { + "Id": "A3.5.1.7", + "Description": "Checks if Stackdriver Monitoring is enabled for Google Compute Engine instances. The rule is NON_COMPLIANT if Stackdriver Monitoring is not enabled.", + "Name": "Google Cloud Monitoring", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Monitoring" + } + ] + }, + { + "Id": "A3.5.1.8", + "Description": "Checks if Google Cloud Storage (GCS) notifications are enabled on a GCS bucket. The rule is NON_COMPLIANT if GCS notifications are not set on a bucket, or if the event type or destination do not match the specified event types and destination parameters.", + "Name": "Google Cloud Storage", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Storage" + } + ] + }, + { + "Id": "A3.5.1.9", + "Description": "Checks if Google Cloud Security Command Center is enabled for a Google Cloud Project. The rule is NON_COMPLIANT if Security Command Center is not enabled.", + "Name": "Google Cloud Security Command Center", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Security Command Center" + } + ] + }, + { + "Id": "A3.5.1.10", + "Description": "Checks if Google Cloud Pub/Sub logging is enabled for the delivery status of messages sent to a topic. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Google Cloud Pub/Sub", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Pub/Sub" + } + ] + }, + { + "Id": "A3.5.1.11", + "Description": "Checks if Google Cloud Monitoring (formerly Stackdriver) security metrics collection on Google Cloud Armor rule sets is enabled. The rule is NON_COMPLIANT if the 'enableMonitoring' field is set to false.", + "Name": "Google Cloud Armor", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to.", + "Service": "Google Cloud Armor" + } + ] + } + ] +} diff --git a/prowler/lib/outputs/compliance/generic/generic_table.py b/prowler/lib/outputs/compliance/generic/generic_table.py index bede199eae..9136cf19e2 100644 --- a/prowler/lib/outputs/compliance/generic/generic_table.py +++ b/prowler/lib/outputs/compliance/generic/generic_table.py @@ -23,7 +23,7 @@ def get_generic_compliance_table( compliance.Framework.upper() in compliance_framework.upper().replace("_", "-") and compliance.Version in compliance_framework.upper() - and compliance.Provider in compliance_framework.upper() + and compliance.Provider.upper() in compliance_framework.upper() ): if finding.muted: if index not in muted_count: