GCP IAM Audit - Security Checks
Checks Performed
- Cryptographic Keys Should Be Rotated
- Define Allowed External IPs for VM Instances
- Disable Automatic IAM Role Grants for Default Service Accounts
- Disable Guest Attributes of Compute Engine Metadata
- Disable Serial Port Access Support at Organization Level
- Disable Service Account Key Upload
- Disable User-Managed Key Creation for Service Accounts
- Disable Workload Identity at Cluster Creation
- Enforce Detailed Audit Logging Mode
- Enforce Uniform Bucket-Level Access at Organization Level
- Ensure API Keys Are Not Created For A Project
- Ensure API Keys Are Restricted To Necessary APIs
- Ensure API Keys Are Restricted To Specific Hosts And Apps
- Ensure API Keys Are Rotated Periodically
- Ensure Dataproc Clusters Encrypted Using CMEK
- Ensure Essential Contacts Configured For Organization
- Keys Should Be Managed By Google
- KMS Admin Roles Should Not Have CryptoKey Role
- KMS Cryptokeys Should Not Be Public
- KMS Encryption Keys Should Be Rotated
- Prevent Service Account Creation for Google Cloud Organizations
- Require OS Login
- Restrict Allowed Google Cloud APIs and Services
- Restrict Authorized Networks on Cloud SQL instances
- Restrict Default Google-Managed Encryption for Cloud SQL Instances
- Restrict Load Balancer Creation Based on Load Balancer Types
- Restrict Public IP Access for Cloud SQL Instances at Organization Level
- Restrict Shared VPC Subnetworks
- Restrict the Creation of Cloud Resources to Specific Locations
- Restrict Virtual Machine IP Forwarding
- Restrict VPC Peering Usage
- Restrict VPN Peer IPs
- Restricting the Use of Images
- Service Account Keys Should Be Rotated
- Service Account User Should Not Have Service Account Token Creator Role
- Service Accounts Admin And User Permissions Should Not Be Assigned At The Same Time
- Skip Default VPC Network Creation
- User Managed Service Account Should Not Have Admin privileges
- Users Should Use Work Email For Access