Services in this catalog
- apikeys - 4 checks
- artifacts - 1 checks
- bigquery - 3 checks
- cloudsql - 22 checks
- cloudstorage - 10 checks
- compute - 31 checks
- dataproc - 1 checks
- dns - 3 checks
- gcr - 1 checks
- gemini - 1 checks
- gke - 1 checks
- iam - 12 checks
- kms - 2 checks
- logging - 10 checks
apikeys
4 checks.| Check ID | Title | Severity |
|---|---|---|
apikeys_api_restricted_with_gemini_api | API key is restricted to specific Google APIs when the Gemini (Generative Language) API is enabled | HIGH |
apikeys_api_restrictions_configured | API key is restricted to specific Google APIs | HIGH |
apikeys_key_exists | Project has no active API keys | MEDIUM |
apikeys_key_rotated_in_90_days | API key was created within the last 90 days | MEDIUM |
artifacts
1 checks.| Check ID | Title | Severity |
|---|---|---|
artifacts_container_analysis_enabled | GCP project has Artifact Registry Container Analysis API enabled | MEDIUM |
bigquery
3 checks.| Check ID | Title | Severity |
|---|---|---|
bigquery_dataset_cmk_encryption | BigQuery dataset is encrypted with Customer-Managed Keys (CMKs) | HIGH |
bigquery_dataset_public_access | BigQuery dataset is not publicly accessible | HIGH |
bigquery_table_cmk_encryption | BigQuery table is encrypted with a Customer-Managed Key (CMK) | HIGH |
cloudsql
22 checks.| Check ID | Title | Severity |
|---|---|---|
cloudsql_instance_automated_backups | Cloud SQL database instance has automated backups configured | HIGH |
cloudsql_instance_mysql_local_infile_flag | Cloud SQL MySQL instance has the local_infile database flag set to off | HIGH |
cloudsql_instance_mysql_skip_show_database_flag | Cloud SQL MySQL instance has skip_show_database flag set to on | LOW |
cloudsql_instance_postgres_enable_pgaudit_flag | Cloud SQL PostgreSQL instance has ‘cloudsql.enable_pgaudit’ flag set to ‘on’ | HIGH |
cloudsql_instance_postgres_log_connections_flag | Cloud SQL PostgreSQL instance has log_connections flag set to on | MEDIUM |
cloudsql_instance_postgres_log_disconnections_flag | Cloud SQL PostgreSQL instance has log_disconnections flag set to on | MEDIUM |
cloudsql_instance_postgres_log_error_verbosity_flag | Cloud SQL PostgreSQL instance has log_error_verbosity flag set to default | MEDIUM |
cloudsql_instance_postgres_log_min_duration_statement_flag | Cloud SQL PostgreSQL instance has the log_min_duration_statement flag set to -1 | MEDIUM |
cloudsql_instance_postgres_log_min_error_statement_flag | Cloud SQL for PostgreSQL instance has log_min_error_statement set to error | MEDIUM |
cloudsql_instance_postgres_log_min_messages_flag | Cloud SQL PostgreSQL instance has the log_min_messages flag set to WARNING or higher | MEDIUM |
cloudsql_instance_postgres_log_statement_flag | Cloud SQL PostgreSQL instance has ‘log_statement’ flag set to ‘ddl’ | MEDIUM |
cloudsql_instance_private_ip_assignment | Cloud SQL instance has no public IP addresses | HIGH |
cloudsql_instance_public_access | Cloud SQL instance does not allow 0.0.0.0/0 in authorized networks | CRITICAL |
cloudsql_instance_public_ip | Cloud SQL database instance does not have a public IP address | HIGH |
cloudsql_instance_sqlserver_contained_database_authentication_flag | Cloud SQL for SQL Server instance has ‘contained database authentication’ flag set to off | MEDIUM |
cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag | Cloud SQL SQL Server instance has ‘cross db ownership chaining’ flag set to off | HIGH |
cloudsql_instance_sqlserver_external_scripts_enabled_flag | Cloud SQL SQL Server instance has ‘external scripts enabled’ flag set to ‘off’ | HIGH |
cloudsql_instance_sqlserver_remote_access_flag | Cloud SQL SQL Server instance has ‘remote access’ database flag set to ‘off’ | MEDIUM |
cloudsql_instance_sqlserver_trace_flag | Cloud SQL for SQL Server instance has trace flag 3625 set to ‘on’ | MEDIUM |
cloudsql_instance_sqlserver_user_connections_flag | Cloud SQL SQL Server instance has the ‘user connections’ database flag set to 0 | MEDIUM |
cloudsql_instance_sqlserver_user_options_flag | Cloud SQL for SQL Server instance does not have the ‘user options’ flag configured | MEDIUM |
cloudsql_instance_ssl_connections | Cloud SQL database instance requires SSL for all incoming connections | HIGH |
cloudstorage
10 checks.| Check ID | Title | Severity |
|---|---|---|
cloudstorage_audit_logs_enabled | Data Access audit logs are enabled for Cloud Storage | MEDIUM |
cloudstorage_bucket_lifecycle_management_enabled | Cloud Storage bucket has lifecycle management enabled with at least one valid rule | LOW |
cloudstorage_bucket_log_retention_policy_lock | Cloud Storage log sink bucket has a retention policy with Bucket Lock enabled | HIGH |
cloudstorage_bucket_logging_enabled | Cloud Storage buckets have Usage and Storage Logs enabled | MEDIUM |
cloudstorage_bucket_public_access | Cloud Storage bucket is not publicly accessible | CRITICAL |
cloudstorage_bucket_soft_delete_enabled | Cloud Storage bucket has Soft Delete enabled | MEDIUM |
cloudstorage_bucket_sufficient_retention_period | Cloud Storage bucket has a sufficient Retention Policy period | MEDIUM |
cloudstorage_bucket_uniform_bucket_level_access | Cloud Storage bucket has uniform bucket-level access enabled | MEDIUM |
cloudstorage_bucket_versioning_enabled | Cloud Storage bucket has Object Versioning enabled | MEDIUM |
cloudstorage_uses_vpc_service_controls | Cloud Storage services are protected by VPC Service Controls | MEDIUM |
compute
31 checks.| Check ID | Title | Severity |
|---|---|---|
compute_firewall_rdp_access_from_the_internet_allowed | Firewall rule does not allow ingress from 0.0.0.0/0 to TCP port 3389 (RDP) | CRITICAL |
compute_firewall_ssh_access_from_the_internet_allowed | Firewall does not expose TCP port 22 (SSH) to the Internet | CRITICAL |
compute_image_not_publicly_shared | Compute Engine disk image is not publicly shared | MEDIUM |
compute_instance_automatic_restart_enabled | Compute Engine VM instances have Automatic Restart enabled | MEDIUM |
compute_instance_block_project_wide_ssh_keys_disabled | VM instance has Block project-wide SSH keys enabled | MEDIUM |
compute_instance_confidential_computing_enabled | Compute instance has Confidential Computing enabled | MEDIUM |
compute_instance_default_service_account_in_use | Compute Engine instance does not use the default service account | MEDIUM |
compute_instance_default_service_account_in_use_with_full_api_access | Compute Engine instance does not use the default service account with full access to all Cloud APIs | MEDIUM |
compute_instance_deletion_protection_enabled | VM instance has deletion protection enabled | MEDIUM |
compute_instance_disk_auto_delete_disabled | VM instance attached disks have auto-delete disabled | MEDIUM |
compute_instance_encryption_with_csek_enabled | VM instance has all disks encrypted with Customer-Supplied Encryption Keys (CSEK) | HIGH |
compute_instance_group_autohealing_enabled | Managed Instance Group has autohealing enabled with a valid health check | HIGH |
compute_instance_group_load_balancer_attached | Managed Instance Group is attached to a load balancer | LOW |
compute_instance_group_multiple_zones | Managed Instance Groups span multiple zones for high availability | LOW |
compute_instance_ip_forwarding_is_enabled | Compute Engine VM instance has IP forwarding disabled | MEDIUM |
compute_instance_on_host_maintenance_migrate | Compute Engine VM instance has On Host Maintenance set to MIGRATE | MEDIUM |
compute_instance_preemptible_vm_disabled | VM instance is not configured as preemptible or Spot VM | MEDIUM |
compute_instance_public_ip | VM instance does not have a public IP address | HIGH |
compute_instance_serial_ports_in_use | VM instance has ‘Enable Connecting to Serial Ports’ disabled | MEDIUM |
compute_instance_shielded_vm_enabled | Compute instance has vTPM and Integrity Monitoring enabled | MEDIUM |
compute_instance_single_network_interface | VM instance has a single network interface | MEDIUM |
compute_instance_suspended_without_persistent_disks | Suspended VM instance does not have persistent disks attached | MEDIUM |
compute_loadbalancer_logging_enabled | HTTP(S) load balancer has logging enabled | HIGH |
compute_network_default_in_use | Project does not have a default VPC network | MEDIUM |
compute_network_dns_logging_enabled | VPC network has Cloud DNS logging enabled | MEDIUM |
compute_network_not_legacy | VPC network is not legacy | MEDIUM |
compute_project_os_login_2fa_enabled | GCP project has OS Login with 2FA enabled | HIGH |
compute_project_os_login_enabled | Project has OS Login enabled | LOW |
compute_public_address_shodan | Public IP address is not listed in Shodan | MEDIUM |
compute_snapshot_not_outdated | Compute Engine disk snapshot is not outdated | LOW |
compute_subnet_flow_logs_enabled | Subnet has VPC Flow Logs enabled | MEDIUM |
dataproc
1 checks.| Check ID | Title | Severity |
|---|---|---|
dataproc_encrypted_with_cmks_disabled | Dataproc cluster is encrypted with a customer-managed encryption key (CMEK) | MEDIUM |
dns
3 checks.| Check ID | Title | Severity |
|---|---|---|
dns_dnssec_disabled | Cloud DNS managed zone has DNSSEC enabled | MEDIUM |
dns_rsasha1_in_use_to_key_sign_in_dnssec | Cloud DNS managed zone DNSSEC key-signing key does not use RSASHA1 | MEDIUM |
dns_rsasha1_in_use_to_zone_sign_in_dnssec | Cloud DNS managed zone does not use the RSASHA1 algorithm for the DNSSEC zone-signing key | MEDIUM |
gcr
1 checks.| Check ID | Title | Severity |
|---|---|---|
gcr_container_scanning_enabled | Project has GCR Container Scanning API enabled | MEDIUM |
gemini
1 checks.| Check ID | Title | Severity |
|---|---|---|
gemini_api_disabled | Gemini (Generative Language) API is disabled | MEDIUM |
gke
1 checks.| Check ID | Title | Severity |
|---|---|---|
gke_cluster_no_default_service_account | GKE cluster does not use the Compute Engine default service account | MEDIUM |
iam
12 checks.| Check ID | Title | Severity |
|---|---|---|
iam_account_access_approval_enabled | Project has Access Approval enabled | HIGH |
iam_audit_logs_enabled | GCP project has Cloud Audit Logs enabled | MEDIUM |
iam_cloud_asset_inventory_enabled | Project has Cloud Asset Inventory API enabled | HIGH |
iam_no_service_roles_at_project_level | Project has no IAM users assigned the Service Account User or Service Account Token Creator roles at project l… | MEDIUM |
iam_organization_essential_contacts_configured | Organization has Essential Contacts configured | MEDIUM |
iam_role_kms_enforce_separation_of_duties | Project members are not assigned both Cloud KMS Admin and CryptoKey Encrypter/Decrypter roles | MEDIUM |
iam_role_sa_enforce_separation_of_duties | Project enforces separation of duties for Service Account Admin and Service Account User roles | MEDIUM |
iam_sa_no_administrative_privileges | Service account has no administrative privileges | HIGH |
iam_sa_no_user_managed_keys | Service account has no user-managed keys | MEDIUM |
iam_sa_user_managed_key_rotate_90_days | Service account user-managed key has been rotated within the last 90 days | LOW |
iam_sa_user_managed_key_unused | User-managed service account key was used within the allowed inactivity period | MEDIUM |
iam_service_account_unused | Service account was used within the configured maximum unused period | MEDIUM |
kms
2 checks.| Check ID | Title | Severity |
|---|---|---|
kms_key_not_publicly_accessible | Cloud KMS key has no public IAM access | HIGH |
kms_key_rotation_enabled | KMS key is rotated at least annually | LOW |
logging
10 checks.| Check ID | Title | Severity |
|---|---|---|
logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled | Log metric filter for audit configuration changes has an associated alert policy | MEDIUM |
logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled | Log metric filter for Cloud Storage IAM permission changes has an associated alert policy | MEDIUM |
logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled | Compute Engine configuration changes are monitored with log metric filters and alerts | MEDIUM |
logging_log_metric_filter_and_alert_for_custom_role_changes_enabled | Log metric filter for IAM custom role changes has an associated alert policy | MEDIUM |
logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled | Log metric filter for project ownership assignments/changes has an associated alert policy | MEDIUM |
logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled | Log metric filter for Cloud SQL instance configuration changes has an associated alert policy | MEDIUM |
logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled | Log metric filter for VPC network firewall rule changes has an associated alert policy | MEDIUM |
logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled | Log metric filter for VPC network changes has an associated alert policy | MEDIUM |
logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled | Log metric filter for VPC network route changes has an associated alert policy | MEDIUM |
logging_sink_created | Project has at least one logging sink exporting copies of all log entries | MEDIUM |
What’s next
Cloud Security overview
Connect a provider, see findings end-to-end.
All checks
Index across every provider.
Compliance frameworks
How check IDs map to SOC 2 / PCI / HIPAA / ISO controls.
Reports
Per-framework PDF scorecards.