Disable Serial Port Access Support at Organization Level
More Info:
Ensure that “Disable VM serial port access” constraint policy is enabled for your Google Cloud Platform (GCP) organizations. Due to security and compliance regulations, the serial port access to your Compute Engine virtual machine (VM) instances must be disabled.Risk Level
MediumAddress
Security, Operational MaturityCompliance Standards
CISGCP, CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Disable Serial Port Access Support at Organization Level” misconfiguration in GCP using the GCP console, follow these steps:
- Open the GCP console and navigate to the “IAM & Admin” section.
- Click on “Organization” and select your organization from the dropdown menu.
- Click on the “Policies” tab and scroll down to the “Compute Engine” section.
- Locate the policy for “Serial Port Access” and click on the “Edit” button next to it.
- In the policy editor, select “Deny” for the “SerialPortAccess” permission.
- Click on “Save” to update the policy.
Using CLI
Using CLI
To remediate the misconfiguration “Disable Serial Port Access Support at Organization Level” for GCP using GCP CLI, follow these steps:This command will display the organization’s details, including the serial port access support status. If the serial port access support is disabled, it will be reflected in the output.Note: The above command is in alpha state and may change in the future. It is recommended to check the latest documentation before executing the command.
- Open the GCP CLI and log in to your GCP account using your credentials.
- Run the following command to disable serial port access support at the organization level:
- Once the command is executed successfully, the serial port access support will be disabled at the organization level.
- Verify the changes by running the following command:
Using Python
Using Python
To disable Serial Port Access Support at the Organization Level in GCP using Python, you can follow these steps:And that’s it! You have successfully remediated the misconfiguration by disabling Serial Port Access Support at the Organization Level in GCP using Python.
- First, you need to authenticate with the GCP API using a Service Account. You can create a Service Account with the necessary permissions in the GCP Console and download the Service Account Key as a JSON file.
- Install the Google Cloud SDK and the necessary Python libraries for interacting with the GCP API. You can do this by running the following command in your terminal:
- Import the necessary libraries and authenticate with the GCP API using the Service Account Key:
- Use the
organizations.patchmethod to update theenableSerialPortAccessfield of the Organization resource. Set the value ofenableSerialPortAccesstoFalseto disable Serial Port Access Support at the Organization Level:
- Verify that Serial Port Access Support has been disabled at the Organization Level by checking the
enableSerialPortAccessfield of the Organization resource: