1.24.0 • Published 12 months ago

@cloudgraph/policy-pack-gcp-cis-1.2.0 v1.24.0

Weekly downloads
-
License
MPL-2.0
Repository
github
Last release
12 months ago

CIS Google Cloud Platform Foundations 1.2.0

Policy Pack based on the GCP Foundations 1.2.0 benchmark provided by the Center for Internet Security (CIS)

First Steps

  1. Install Cloud Graph CLI.
  2. Set up the GCP Provider for CG with the cg init gcp command.
  3. Add Policy Pack for CIS Google Cloud Platform Foundations benchmark using cg policy add gcp-cis-1.2.0 command.
  4. Execute the ruleset using the scan command cg scan gcp.
  5. Query the findings using the different options:

    5a. Querying findings by provider:

    query {
      querygcpFindings {
        CISFindings {
          id
          resourceId
          result
        }
      }
    }

    5b. Querying findings by specific benchmark:

    query {
      querygcpCISFindings {
        id
        resourceId
        result
      }
    }

    5c. Querying findings by resource:

    query {
      querygcpIamPolicy {
        id
        CISFindings {
          id
          resourceId
          result
        }
      }
    }

Available Ruleset

RuleDescription
GCP CIS 1.1Ensure that corporate login credentials are used
GCP CIS 1.2Ensure that multi-factor authentication is enabled for all non-service accounts
GCP CIS 1.3Ensure that Security Key Enforcement is enabled for all admin accounts
GCP CIS 1.4Ensure that there are only GCP-managed service account keys for each service account
GCP CIS 1.5Ensure that Service Account has no Admin privileges
GCP CIS 1.6Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
GCP CIS 1.7Ensure user-managed/external keys for service accounts are rotated every 90 days or less
GCP CIS 1.8Ensure that Separation of duties is enforced while assigning service account related roles to users
GCP CIS 1.9Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible
GCP CIS 1.10Ensure KMS encryption keys are rotated within a period of 90 days
GCP CIS 1.11Ensure that Separation of duties is enforced while assigning KMS related roles to users
GCP CIS 1.12Ensure API keys are not created for a project
GCP CIS 1.13Ensure API keys are restricted to use by only specified Hosts and Apps
GCP CIS 1.14Ensure API keys are restricted to only APIs that application needs access
GCP CIS 1.15Ensure API keys are rotated every 90 days
GCP CIS 2.1Ensure that Cloud Audit Logging is configured properly across all services and all users from a project
GCP CIS 2.2Ensure that sinks are configured for all log entries
GCP CIS 2.3Ensure that retention policies on log buckets are configured using Bucket Lock
GCP CIS 2.4Ensure log metric filter and alerts exist for project ownership assignments/changes
GCP CIS 2.5Ensure that the log metric filter and alerts exist for Audit Configuration changes
GCP CIS 2.6Ensure that the log metric filter and alerts exist for Custom Role changes
GCP CIS 2.7Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes
GCP CIS 2.8Ensure that the log metric filter and alerts exist for VPC network route changes
GCP CIS 2.9Ensure that the log metric filter and alerts exist for VPC network changes
GCP CIS 2.10Ensure that the log metric filter and alerts exist for Cloud Storage IAM permission changes
GCP CIS 2.11Ensure that the log metric filter and alerts exist for SQL instance configuration changes
GCP CIS 2.12Ensure that Cloud DNS logging is enabled for all VPC networks
GCP CIS 3.1Ensure that the default network does not exist in a project
GCP CIS 3.2Ensure legacy networks do not exist for a project
GCP CIS 3.3Ensure that DNSSEC is enabled for Cloud DNS
GCP CIS 3.4Ensure that RSASHA1 is not used for the key-signing key in Cloud DNS DNSSEC
GCP CIS 3.5Ensure that RSASHA1 is not used for the zone-signing key in Cloud DNS DNSSEC
GCP CIS 3.6Ensure that SSH access is restricted from the internet
GCP CIS 3.7Ensure that RDP access is restricted from the internet
GCP CIS 3.8Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network
GCP CIS 3.9Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
GCP CIS 3.10Ensure Firewall Rules for instances behind Identity Aware Proxy (IAP) only allow the traffic from Google Cloud Loadbalancer (GCLB) Health Check and Proxy Addresses
GCP CIS 4.1Ensure that instances are not configured to use the default service account
GCP CIS 4.2Ensure that instances are not configured to use the default service account with full access to all Cloud APIs
GCP CIS 4.3Ensure "Block Project-wide SSH keys" is enabled for VM instances
GCP CIS 4.4Ensure oslogin is enabled for a Project
GCP CIS 4.5Ensure 'Enable connecting to serial ports' is not enabled for VM Instance
GCP CIS 4.6Ensure that IP forwarding is not enabled on Instances
GCP CIS 4.7Ensure VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys (CSEK)
GCP CIS 4.8Ensure Compute instances are launched with Shielded VM enabled
GCP CIS 4.9Ensure that Compute instances do not have public IP addresses
GCP CIS 4.10In order to maintain the highest level of security all connections to an application should be secure by default
GCP CIS 4.11Ensure that Compute instances have Confidential Computing enabled
GCP CIS 5.1Ensure that Cloud Storage bucket is not anonymously or publicly accessible
GCP CIS 5.2Ensure that Cloud Storage buckets have uniform bucket-level access enabled
GCP CIS 6.1.1Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges
GCP CIS 6.1.2Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on'
GCP CIS 6.1.3Ensure that the 'local_infile' database flag for a Cloud SQL Mysql instance is set to 'off'
GCP CIS 6.2.1Ensure that the 'log_checkpoints' database flag for Cloud SQL PostgreSQL instance is set to 'on'
GCP CIS 6.2.2Ensure 'log_error_verbosity' database flag for Cloud SQL PostgreSQL instance is set to 'DEFAULT' or stricter
GCP CIS 6.2.3Ensure that the 'log_connections' database flag for Cloud SQL PostgreSQL instance is set to 'on'
GCP CIS 6.2.4Ensure that the 'log_disconnections' database flag for Cloud SQL PostgreSQL instance is set to 'on'
GCP CIS 6.2.5Ensure 'log_duration' database flag for Cloud SQL PostgreSQL instance is set to 'on'
GCP CIS 6.2.6Ensure that the 'log_lock_waits' database flag for Cloud SQL PostgreSQL instance is set to 'on'
GCP CIS 6.2.7Ensure 'log_statement' database flag for Cloud SQL PostgreSQL instance is set appropriately
GCP CIS 6.2.8Ensure 'log_hostname' database flag for Cloud SQL PostgreSQL instance is set appropriately
GCP CIS 6.2.9Ensure 'log_parser_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off'
GCP CIS 6.2.10Ensure 'log_planner_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off'
GCP CIS 6.2.11Ensure 'log_executor_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off'
GCP CIS 6.2.12Ensure 'log_statement_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off'
GCP CIS 6.2.13Ensure that the 'log_min_messages' database flag for Cloud SQL PostgreSQL instance is set appropriately
GCP CIS 6.2.14Ensure 'log_min_error_statement' database flag for Cloud SQL PostgreSQL instance is set to 'Error' or stricter
GCP CIS 6.2.15Ensure that the 'log_temp_files' database flag for Cloud SQL PostgreSQL instance is set to '0' (on)
GCP CIS 6.2.16Ensure that the 'log_min_duration_statement' database flag for Cloud SQL PostgreSQL instance is set to '-1' (disabled)
GCP CIS 6.3.1Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off'
GCP CIS 6.3.2Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'
GCP CIS 6.3.3Ensure 'user connections' database flag for Cloud SQL SQL Server instance is set as appropriate
GCP CIS 6.3.4Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured
GCP CIS 6.3.5Ensure 'remote access' database flag for Cloud SQL SQL Server instance is set to 'off'
GCP CIS 6.3.6Ensure '3625 (trace flag)' database flag for Cloud SQL SQL Server instance is set to 'off'
GCP CIS 6.3.7Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'
GCP CIS 6.4Ensure that the Cloud SQL database instance requires all incoming connections to use SSL
GCP CIS 6.5Ensure that Cloud SQL database instances are not open to the world
GCP CIS 6.6Ensure that Cloud SQL database instances do not have public IPs
GCP CIS 6.7Ensure that Cloud SQL database instances are configured with automated backups
GCP CIS 7.1Ensure that BigQuery datasets are not anonymously or publicly accessible
GCP CIS 7.2Ensure that all BigQuery Tables are encrypted with Customer-managed encryption key
GCP CIS 7.3Ensure that a Default Customer-managed encryption key (CMEK) is specified for all BigQuery Data Sets
1.24.1-alpha.2

12 months ago

1.24.1-alpha.1

12 months ago

1.24.0

1 year ago

1.23.1-alpha.1

1 year ago

1.21.0

2 years ago

1.22.0

2 years ago

1.21.1

2 years ago

1.23.0

2 years ago

1.22.1

2 years ago

1.20.0

2 years ago

1.19.1

2 years ago

1.19.0

2 years ago

1.18.0

2 years ago

1.17.0

2 years ago

1.16.0

2 years ago

1.15.0

2 years ago

1.14.0

2 years ago

1.13.0

2 years ago

1.12.0

2 years ago

1.11.0

2 years ago

1.10.0

2 years ago

1.9.0

2 years ago

1.8.0

2 years ago

1.7.0

2 years ago

1.6.0

2 years ago

1.5.0

2 years ago

1.4.0

2 years ago

1.3.0

2 years ago

1.2.0

2 years ago

1.1.0

2 years ago

1.0.0

2 years ago