1.5.0 • Published 12 months ago

@cloudgraph/policy-pack-gcp-pci-dss-3.2.1 v1.5.0

Weekly downloads
-
License
MPL-2.0
Repository
github
Last release
12 months ago

PCI Data Security Standard version 3.2.1

Policy Pack based on the PCI DSS version 3.2.1 benchmark provided by the Payment Card Industry Data Security Standard (PCI DSS)

First Steps

  1. Install Cloud Graph CLI.
  2. Set up the GCP Provider for CG with the cg init gcp command.
  3. Add Policy Pack for GCP PCI DSS benchmark using cg policy add gcp-pci-dss-3.2.1 command.
  4. Execute the ruleset using the scan command cg scan gcp.
  5. Query the findings using the different options:

    5a. Querying findings by provider:

    query {
      querygcpFindings {
        PCIFindings {
          id
          resourceId
          result
        }
      }
    }

    5b. Querying findings by specific benchmark:

    query {
      querygcpCISFindings {
        id
        resourceId
        result
      }
    }

    5c. Querying findings by resource:

    query {
      querygcpIamPolicy {
        id
        PCIFindings {
          id
          resourceId
          result
        }
      }
    }

Available Ruleset

RuleDescription
vm-check-1Compute instance 'block-project-ssh-keys' should be enabled
vm-check-2Compute instances 'Enable connecting to serial ports' should not be enabled
storage-check-1SQL database instances should not permit access from 0.0.0.0/0
vm-check-3Compute instances should not use the default service account
vm-check-4Compute instances should not use the default service account with full access to all Cloud APIs
dns-check-1DNS managed zone DNSSEC key-signing keys should not use RSASHA1
dns-check-2DNS managed zone DNSSEC should be enabled
dns-check-3DNS managed zone DNSSEC zone-signing keys should not use RSASHA1
storage-check-2SQL database instances should require incoming connections to use SSL
iam-check-3User-managed service accounts should not have admin privileges
kms-check-1KMS keys should not be anonymously or publicly accessible
iam-check-4IAM default audit log config should not exempt any users
iam-check-1IAM users should not have both KMS admin and any of the KMS encrypter/decrypter roles
iam-check-2IAM users should not have project-level "Service Account User" or "Service Account Token Creator" roles
monitoring-check-1Logging metric filter and alert for audit configuration changes should be configured
monitoring-check-2Logging metric filter and alert for Custom Role changes should be configured
monitoring-check-3Logging metric filter and alert for network changes should be configured
monitoring-check-4Logging metric filter and alert for network firewall rule changes should be configured
monitoring-check-5Logging metric filter and alert for network route changes should be configured
monitoring-check-6Logging metric filter and alert for project ownership assignments/changes should be configured
monitoring-check-7Logging metric filter and alert for SQL instance configuration changes should be configured
monitoring-check-8Logging metric filter and alert for Storage IAM permission changes should be configured
networking-check-1Network firewall rules should not permit ingress from 0.0.0.0/0 to port 22 (SSH)
networking-check-2Network firewall rules should not permit ingress from 0.0.0.0/0 to port 3389 (RDP)
networking-check-3The default network for a project should be deleted
networking-check-4Load balancer HTTPS or SSL proxy SSL policies should not have weak cipher suites
logging-check-1At least one project-level logging sink should be configured with an empty filter
1.5.1-alpha.2

12 months ago

1.5.1-alpha.1

12 months ago

1.5.0

1 year ago

1.4.1-alpha.1

1 year ago

1.2.0

2 years ago

1.1.0

2 years ago

1.4.0

2 years ago

1.3.1

2 years ago

1.3.0

2 years ago

1.0.0

2 years ago