Skip to main content
Pulumi logo Pulumi logo
25.8K Contact us Sign in Dashboard Get started
  1. Docs
  2. Reference
  3. Pre-built Policy Packs
  4. CMMC
  5. Google Cloud

CMMC 2.0 - Google Cloud

This Pulumi Cloud feature is available in the Enterprise edition.

    This page lists all 59 policies in the CMMC 2.0 pack for Google Cloud, as published in cmmc-google-cloud version 1.0.0.

    Policies by control

    AC.L1-3.1.1 Limit system access to authorized users — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

    AC.L1-3.1.2 Limit system access to authorized transaction types — Limit system access to the types of transactions and functions that authorized users are permitted to execute.

    AC.L1-3.1.22 Control CUI on publicly accessible systems — Control CUI posted or processed on publicly accessible systems.

    AC.L2-3.1.3 Control the flow of CUI — Control the flow of CUI in accordance with approved authorizations.

    AC.L2-3.1.4 Separate the duties of individuals — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

    AC.L2-3.1.5 Employ the principle of least privilege — Employ the principle of least privilege, including for specific security functions and privileged accounts.

    AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions — Use non-privileged accounts or roles when accessing nonsecurity functions.

    AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

    AC.L2-3.1.12 Monitor and control remote access sessions — Monitor and control remote access sessions.

    AC.L2-3.1.13 Employ cryptographic mechanisms for remote access — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

    AC.L2-3.1.15 Authorize remote execution of privileged commands — Authorize remote execution of privileged commands and remote access to security-relevant information.

    AU.L2-3.3.1 Create and retain system audit logs — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

    AU.L2-3.3.9 Limit audit logging management to privileged users — Limit management of audit logging functionality to a subset of privileged users.

    CM.L2-3.4.2 Establish and enforce security configuration settings — Establish and enforce security configuration settings for information technology products employed in organizational systems.

    CM.L2-3.4.5 Define access restrictions for system changes — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.

    CM.L2-3.4.6 Employ principle of least functionality — Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

    CM.L2-3.4.7 Restrict nonessential programs and services — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

    IA.L1-3.5.2 Authenticate identities of users and devices — Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

    MA.L2-3.7.1 Perform system maintenance — Perform maintenance on organizational systems.

    MA.L2-3.7.2 Provide controls on maintenance tools and personnel — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

    MP.L1-3.8.3 Sanitize or destroy system media before disposal — Sanitize or destroy system media containing CUI before disposal or release for reuse.

    MP.L2-3.8.1 Protect system media containing CUI — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

    MP.L2-3.8.2 Limit access to CUI on system media — Limit access to CUI on system media to authorized users.

    MP.L2-3.8.4 Mark media with CUI markings — Mark media with necessary CUI markings and distribution limitations.

    MP.L2-3.8.9 Protect confidentiality of backup CUI — Protect the confidentiality of backup CUI at storage locations.

    RA.L2-3.11.2 Scan for vulnerabilities — Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

    RA.L2-3.11.3 Remediate vulnerabilities — Remediate vulnerabilities in accordance with risk assessments.

    SC.L1-3.13.1 Monitor and control communications at boundaries — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

    SC.L2-3.13.2 Employ architectural designs promoting security — Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

    SC.L2-3.13.6 Deny network traffic by default — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

    SC.L2-3.13.8 Implement cryptographic mechanisms for transmission — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

    SC.L2-3.13.10 Establish and manage cryptographic keys — Establish and manage cryptographic keys for cryptography employed in organizational systems.

    SC.L2-3.13.11 Employ FIPS-validated cryptography — Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

    SC.L2-3.13.15 Protect authenticity of communications sessions — Protect the authenticity of communications sessions.

    SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.

    SI.L1-3.14.1 Identify and correct system flaws — Identify, report, and correct system flaws in a timely manner.

    SI.L1-3.14.5 Perform periodic and real-time scans — Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.

    SI.L2-3.14.6 Monitor systems to detect attacks — Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

    Policy details

    artifactregistry-customer-kms

    Severity: high · Enforcement: advisory

    Require Artifact Registry repositories to use customer-managed Cloud KMS keys for encryption

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation
    Fix: Configure Customer-Managed KMS Key
    const repository = new gcp.artifactregistry.Repository("my-repository", {
    repositoryId: "my-repo",
    format: "DOCKER",
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Specify customer-managed KMS key
    // ... other config
});

    bigquery-dataset-cmek

    Severity: high · Enforcement: advisory

    Ensures BigQuery datasets are encrypted with customer-managed keys (CMEK)

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation

    Configure defaultEncryptionConfiguration with kmsKeyName to use a Cloud KMS key for dataset encryption.

    bigquery-dataset-public-access-check

    Severity: high · Enforcement: advisory

    Ensure BigQuery datasets are not publicly accessible

    • AC.L1-3.1.22 Control CUI on publicly accessible systems — Control CUI posted or processed on publicly accessible systems.
    Remediation

    Remove public access from BigQuery datasets by ensuring IAM policies do not grant allUsers or allAuthenticatedUsers permissions. Review dataset accesses configuration and IAM bindings/members. Grant access only to specific service accounts, users, or groups based on least privilege principles.

    Example TypeScript:

    import * as gcp from "@pulumi/gcp";

const dataset = new gcp.bigquery.Dataset("secure-dataset", {
    datasetId: "my_dataset",
    location: "US",
    accesses: [
        {
            role: "READER",
            userByEmail: "analyst@example.com"
        },
        {
            role: "roles/bigquery.dataEditor",
            userByEmail: serviceAccount.email
        }
        // Do NOT include allUsers or allAuthenticatedUsers
    ]
});

// Using IAM binding for specific members only
const datasetViewer = new gcp.bigquery.DatasetIamBinding("dataset-viewer", {
    datasetId: dataset.datasetId,
    role: "roles/bigquery.dataViewer",
    members: [
        "user:jane@example.com",
        "serviceAccount:myapp@project.iam.gserviceaccount.com"
        // Do NOT use allUsers or allAuthenticatedUsers
    ]
});

    bigtable-change-streams

    Severity: medium · Enforcement: advisory

    Require Bigtable tables to have change streams enabled for change tracking

    • AU.L2-3.3.1 Create and retain system audit logs — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
    Remediation
    Fix: Enable Change Stream Retention
    const bigtableTable = new gcp.bigtable.Table("my-table", {
    instanceName: "my-bigtable-instance",
    changeStreamRetention: "72h0m0s",  // Enable change streams with 3-day retention
    // ... other config
});

    bucket-access-logging

    Severity: medium · Enforcement: advisory

    Ensures Cloud Storage buckets have access logging enabled with a log destination bucket

    • AU.L2-3.3.1 Create and retain system audit logs — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
    Remediation
    Fix: Enable Access Logging

    Set logging.logBucket to the bucket that should receive the access logs. The other settings are not this policy’s concern; they are here so the example also satisfies the sibling policies its packs register.

    const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    logging: {
        logBucket: "my-logging-bucket",  // Destination bucket for access logs
        logObjectPrefix: "bucket-logs/", // Optional prefix for log objects
    },
    uniformBucketLevelAccess: true,
    publicAccessPrevention: "enforced",
    versioning: { enabled: true },
    encryption: {
        defaultKmsKeyName: "projects/my-project/locations/us/keyRings/my-ring/cryptoKeys/my-key",
    },
    lifecycleRules: [{
        action: { type: "SetStorageClass", storageClass: "NEARLINE" },
        condition: { age: 30 },
    }],
    labels: { environment: "production", team: "platform", owner: "security" },
});

    bucket-cmek

    Severity: high · Enforcement: advisory

    Ensures Cloud Storage buckets use customer-managed KMS keys for encryption

    • MP.L2-3.8.1 Protect system media containing CUI — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
    • MP.L2-3.8.9 Protect confidentiality of backup CUI — Protect the confidentiality of backup CUI at storage locations.
    • SC.L2-3.13.11 Employ FIPS-validated cryptography — Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation

    Configure bucket.encryption.defaultKmsKeyName with a valid customer-managed KMS key in the format: projects/PROJECT/locations/LOCATION/keyRings/RING/cryptoKeys/KEY

    bucket-iam-least-privilege

    Severity: high · Enforcement: advisory

    Enforce least privilege access for Cloud Storage bucket IAM policies

    • AC.L1-3.1.2 Limit system access to authorized transaction types — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
    • AC.L2-3.1.5 Employ the principle of least privilege — Employ the principle of least privilege, including for specific security functions and privileged accounts.
    • MP.L2-3.8.2 Limit access to CUI on system media — Limit access to CUI on system media to authorized users.
    Remediation
    Fix: Use Specific Least Privilege Roles
    // Instead of overly broad roles like storage.admin or storage.objectAdmin
// Use specific roles based on actual needs:

// For read-only access
const viewerBinding = new gcp.storage.BucketIAMBinding("viewer-binding", {
    bucket: bucket.name,
    role: "roles/storage.objectViewer",  // Read-only access to objects
    members: ["user:viewer@example.com"],
});

// For write-only access
const creatorBinding = new gcp.storage.BucketIAMBinding("creator-binding", {
    bucket: bucket.name,
    role: "roles/storage.objectCreator",  // Write-only access (no read)
    members: ["serviceAccount:app@project.iam.gserviceaccount.com"],
});

// Avoid these overly broad roles:
// - roles/storage.admin
// - roles/storage.objectAdmin
// - roles/owner
// - roles/editor

    bucket-lifecycle

    Severity: medium · Enforcement: advisory

    Require Cloud Storage buckets to have lifecycle management policies configured

    • MP.L1-3.8.3 Sanitize or destroy system media before disposal — Sanitize or destroy system media containing CUI before disposal or release for reuse.
    Remediation
    Fix: Configure Lifecycle Rules
    const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    lifecycleRules: [
        {
            action: {
                type: "Delete",  // Delete old objects
            },
            condition: {
                age: 365,  // After 365 days
            },
        },
        {
            action: {
                type: "SetStorageClass",
                storageClass: "NEARLINE",  // Archive to cheaper storage
            },
            condition: {
                age: 90,  // After 90 days
            },
        },
    ],
    // ... other config
});

    bucket-public-read-prohibited

    Severity: high · Enforcement: advisory

    Ensure Cloud Storage bucket public read is prohibited

    • AC.L1-3.1.22 Control CUI on publicly accessible systems — Control CUI posted or processed on publicly accessible systems.
    • MP.L2-3.8.2 Limit access to CUI on system media — Limit access to CUI on system media to authorized users.
    Remediation

    Remove public read access from Cloud Storage buckets by ensuring IAM policies and ACLs do not grant allUsers or allAuthenticatedUsers read permissions. Set ‘publicAccessPrevention’ to ’enforced’ to prevent public access.

    cloud-armor-logging

    Severity: medium · Enforcement: advisory

    Ensure Cloud Armor security policies are attached to backend services with logging enabled

    • SI.L2-3.14.6 Monitor systems to detect attacks — Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
    Remediation

    Enable logging on backend services that use Cloud Armor security policies. Cloud Armor events are logged through the backend service’s access logs, not the security policy itself.

    import * as gcp from "@pulumi/gcp";

// Step 1: Create Cloud Armor security policy
const securityPolicy = new gcp.compute.SecurityPolicy("security-policy", {
    name: "my-security-policy",
    rules: [{
        action: "deny(403)",
        priority: 1000,
        match: {
            versionedExpr: "SRC_IPS_V1",
            config: {
                srcIpRanges: ["192.168.1.0/24"]
            }
        }
    }]
});

// Step 2: CRITICAL - Attach to backend service with logging enabled
const backend = new gcp.compute.BackendService("backend", {
    name: "backend-service",
    securityPolicy: securityPolicy.selfLink,
    logConfig: {
        enable: true,        // REQUIRED for Cloud Armor logging
        sampleRate: 1.0      // 1.0 = 100% logging, 0.5 = 50% sampling
    }
});

    cloud-build-logging

    Severity: medium · Enforcement: advisory

    Require Cloud Build triggers to have secure logging configurations

    • AU.L2-3.3.1 Create and retain system audit logs — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
    Remediation
    Fix: Configure Secure Logging
    const trigger = new cloudbuild.Trigger("my-trigger", {
    build: {
        logsBucket: "gs://my-logs-bucket/build-logs",  // Configure centralized logs bucket
        options: {
            logging: "CLOUD_LOGGING_ONLY",  // Use Cloud Logging for audit trails
        },
        // ... other config
    },
    // ... other config
});

    cloud-cdn-origin-tls

    Severity: high · Enforcement: advisory

    Require Cloud CDN to use secure TLS to origin

    • SC.L2-3.13.8 Implement cryptographic mechanisms for transmission — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
    Remediation
    Fix: Enable HTTPS Protocol for CDN Backend Service
    const backendService = new gcp.compute.BackendService("cdn-backend", {
    enableCdn: true,
    protocol: "HTTPS",  // Use HTTPS for secure communication to origin
    // ... other config
});

    cloud-logging-encrypted

    Severity: high · Enforcement: advisory

    Ensure Cloud Logging is encrypted

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation

    Configure Cloud Logging buckets with customer-managed encryption keys (CMEK) for enhanced security. On gcp.logging.LogBucket or gcp.logging.ProjectBucketConfig resources, set cmekSettings with a kmsKeyName pointing to a Cloud KMS key. While GCP encrypts all log data by default with Google-managed keys, CMEK provides additional control and compliance capabilities.

    cloud-logging-retention-period-365

    Severity: high · Enforcement: advisory

    Ensure Cloud Logging log retention is 365 days or more

    • AU.L2-3.3.1 Create and retain system audit logs — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
    Remediation

    Configure Cloud Logging buckets with retentionDays set to at least 365 days. Update gcp.logging.ProjectBucketConfig, gcp.logging.OrganizationBucketConfig, gcp.logging.FolderBucketConfig, or gcp.logging.BillingAccountBucketConfig resources to specify ‘retentionDays: 365’ or higher to maintain adequate audit trails for security investigations and compliance.

    cloud-sql-iam-authentication

    Severity: high · Enforcement: advisory

    Require Cloud SQL instances to enable IAM authentication and Cloud SQL users to use IAM-based user types

    • IA.L1-3.5.2 Authenticate identities of users and devices — Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
    Remediation
    Fix: Use IAM Authentication
    // For Cloud SQL instance: Enable IAM authentication
const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        databaseFlags: [
            {
                name: "cloudsql_iam_authentication",
                value: "on",  // Enable IAM authentication
            },
        ],
        // ... other config
    },
});

// For Cloud SQL users: Use IAM-based authentication
const sqlUser = new gcp.sql.User("my-sql-user", {
    instance: sqlInstance.name,
    name: "user@example.com",
    type: "CLOUD_IAM_USER",  // Use IAM user type instead of built-in
});

    cloud-sql-instance-not-publicly-accessible

    Severity: high · Enforcement: advisory

    Restrict public access for Cloud SQL instances

    • AC.L1-3.1.22 Control CUI on publicly accessible systems — Control CUI posted or processed on publicly accessible systems.
    Remediation

    Disable public IP by setting ipv4Enabled to false and configure privateNetwork in ipConfiguration. Remove authorized networks that allow 0.0.0.0/0 access.

    Example Pulumi TypeScript:

    import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        ipConfiguration: {
            ipv4Enabled: false,
            privateNetwork: "projects/my-project/global/networks/my-vpc",
        },
    },
});

    cloud-sql-logging-enabled

    Severity: high · Enforcement: advisory

    Enable Cloud SQL logging for monitoring

    • AU.L2-3.3.1 Create and retain system audit logs — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
    Remediation

    Enable database logging flags via databaseFlags. For PostgreSQL: set log_connections, log_disconnections, log_checkpoints to ‘on’. For MySQL: enable general_log or slow_query_log.

    Example Pulumi TypeScript:

    import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("db-with-logging", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        databaseFlags: [
            { name: "log_connections", value: "on" },
            { name: "log_disconnections", value: "on" },
            { name: "log_checkpoints", value: "on" },
        ],
    },
});

    cloud-sql-storage-encrypted

    Severity: high · Enforcement: advisory

    Ensure Cloud SQL storage is encrypted

    • MP.L2-3.8.9 Protect confidentiality of backup CUI — Protect the confidentiality of backup CUI at storage locations.
    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation

    Configure customer-managed encryption keys (CMEK) by setting encryptionKeyName to a Cloud KMS key for enhanced security and key management control.

    Example Pulumi TypeScript:

    import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    encryptionKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",
    settings: {
        tier: "db-f1-micro",
    },
});

    cloudfunctions-iam-no-public

    Severity: high · Enforcement: advisory

    Require Cloud Functions IAM bindings to not grant public access

    • AC.L1-3.1.22 Control CUI on publicly accessible systems — Control CUI posted or processed on publicly accessible systems.
    Remediation
    Fix: Use Specific IAM Members
    const iamMember = new gcp.cloudfunctions.FunctionIamMember("my-function-invoker", {
    cloudFunction: myFunction.name,
    role: "roles/cloudfunctions.invoker",
    member: "serviceAccount:my-service@project.iam.gserviceaccount.com",
    // ... other config
});

    cloudfunctions-kms-env-vars

    Severity: medium · Enforcement: advisory

    Require Cloud Functions environment variables to be encrypted with Cloud KMS

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation
    Fix: Encrypt Environment Variables with KMS
    const func = new gcp.cloudfunctions.Function("my-function", {
    environmentVariables: {
        API_KEY: "sensitive-value",
        DATABASE_URL: "postgres://...",
    },
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Add KMS key for encryption
    // ... other config
});

    cloudsql-patching

    Severity: medium · Enforcement: advisory

    Require Cloud SQL instances to use managed service patching

    • CM.L2-3.4.2 Establish and enforce security configuration settings — Establish and enforce security configuration settings for information technology products employed in organizational systems.
    • MA.L2-3.7.1 Perform system maintenance — Perform maintenance on organizational systems.
    • RA.L2-3.11.3 Remediate vulnerabilities — Remediate vulnerabilities in accordance with risk assessments.
    • SI.L1-3.14.1 Identify and correct system flaws — Identify, report, and correct system flaws in a timely manner.
    Remediation
    Fix: Configure Maintenance Window for Automatic Patching
    const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        maintenanceWindow: {
            updateTrack: "stable",  // Use stable update track for patching
            day: 7,  // Saturday (1=Sunday, 7=Saturday)
            hour: 3,  // 3 AM
        },
        // ... other config
    },
});

    cloudsql-ssl

    Severity: high · Enforcement: advisory

    Require Cloud SQL connections to use SSL/TLS encryption

    • AC.L2-3.1.13 Employ cryptographic mechanisms for remote access — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
    • SC.L2-3.13.8 Implement cryptographic mechanisms for transmission — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
    Remediation
    Fix: Require SSL/TLS for All Connections
    const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        ipConfiguration: {
            sslMode: "ENCRYPTED_ONLY",  // Require SSL/TLS for all connections
            // ... other config
        },
    },
});

    compute-engine-instance-not-publicly-accessible

    Severity: high · Enforcement: advisory

    Ensure Compute Engine instances are not publicly accessible

    • AC.L1-3.1.1 Limit system access to authorized users — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
    • AC.L1-3.1.22 Control CUI on publicly accessible systems — Control CUI posted or processed on publicly accessible systems.
    Remediation

    Remove accessConfigs from networkInterfaces to disable external IP assignment:

    new gcp.compute.Instance("my-instance", {
  networkInterfaces: [{
    network: "my-vpc",
    subnetwork: "my-subnet",
    // accessConfigs: [], // Remove or set to empty array
  }],
  canIpForward: false,
});

    Use Cloud NAT or load balancers for controlled external access.

    compute-engine-instance-uses-os-login

    Severity: high · Enforcement: advisory

    Ensure Compute Engine instances enforce OS Login

    • IA.L1-3.5.2 Authenticate identities of users and devices — Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
    Remediation

    Add metadata keys to enable OS Login:

    new gcp.compute.Instance("my-instance", {
  metadata: {
    "enable-oslogin": "TRUE",
    "block-project-ssh-keys": "TRUE",
    "enable-oslogin-2fa": "TRUE", // For production instances
  },
  // ... other config
});

    This enables centralized SSH authentication via IAM.

    compute-instance-encrypted-boot-disk

    Severity: medium · Enforcement: advisory

    Require Compute Engine instances to have encrypted boot disks

    • MP.L2-3.8.1 Protect system media containing CUI — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation
    Fix: Enable Boot Disk Encryption with CMEK
    const instance = new compute.Instance("my-instance", {
    bootDisk: {
        initializeParams: {
            image: "debian-cloud/debian-11",
        },
        kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use customer-managed encryption key
    },
    // ... other config
});

    compute-osconfig-vulnerability

    Severity: medium · Enforcement: advisory

    Require OS Config agent for vulnerability management on compute instances

    • RA.L2-3.11.2 Scan for vulnerabilities — Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
    • SI.L1-3.14.1 Identify and correct system flaws — Identify, report, and correct system flaws in a timely manner.
    • SI.L1-3.14.5 Perform periodic and real-time scans — Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
    Remediation
    Fix: Enable OS Config Agent
    const instance = new compute.Instance("my-instance", {
    metadata: {
        "enable-osconfig": "TRUE",  // Enable OS Config for vulnerability scanning
        "enable-guest-attributes": "TRUE",  // Enable guest attributes for older agent versions
    },
    // ... other config
});

    dataflow-kms

    Severity: high · Enforcement: advisory

    Require Dataflow jobs and pipelines to use customer-managed Cloud KMS keys

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation
    Fix: Configure KMS Encryption for Dataflow
    const job = new dataflow.Job("my-job", {
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use CMEK for data encryption
    // ... other config
});

// For Dataflow Pipeline
const pipeline = new dataflow.Pipeline("my-pipeline", {
    workload: {
        dataflowFlexTemplateRequest: {
            launchParameter: {
                environment: {
                    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use CMEK for data encryption
                },
            },
        },
    },
    // ... other config
});

    dataproc-cluster-master-nodes-no-public-ip

    Severity: high · Enforcement: advisory

    Restrict public access for Dataproc clusters by ensuring master nodes use internal IP addresses only

    • AC.L1-3.1.22 Control CUI on publicly accessible systems — Control CUI posted or processed on publicly accessible systems.
    Remediation

    Set clusterConfig.gceClusterConfig.internalIpOnly: true for the Dataproc cluster. Enable Private Google Access on the VPC subnet. Use Cloud NAT or VPN/Interconnect for required external connectivity. Configure firewall rules for internal communication.

    import * as gcp from "@pulumi/gcp";

const privateDataprocCluster = new gcp.dataproc.Cluster("private-dataproc", {
    name: "private-dataproc-cluster",
    region: "us-central1",
    clusterConfig: {
        gceClusterConfig: {
            // Disable external IPs for all nodes including master
            internalIpOnly: true,
            network: "projects/my-project/global/networks/my-vpc",
            subnetwork: "projects/my-project/regions/us-central1/subnetworks/my-subnet",
            zone: "us-central1-a",
            // Optional: Configure service account with necessary permissions
            serviceAccount: "dataproc-sa@my-project.iam.gserviceaccount.com",
            serviceAccountScopes: [
                "https://www.googleapis.com/auth/cloud-platform",
            ],
        },
        masterConfig: {
            numInstances: 1,
            machineType: "n2-standard-4",
            diskConfig: {
                bootDiskSizeGb: 100,
                bootDiskType: "pd-standard",
            },
        },
        workerConfig: {
            numInstances: 2,
            machineType: "n2-standard-4",
        },
    },
});

    filestore-cmek

    Severity: high · Enforcement: advisory

    Ensure Cloud Filestore is encrypted

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.

    firewall-explicit-target-scoping

    Severity: high · Enforcement: advisory

    Require firewall rules to specify explicit targets (targetTags, targetServiceAccounts, or destinationRanges)

    • AC.L2-3.1.3 Control the flow of CUI — Control the flow of CUI in accordance with approved authorizations.
    • CM.L2-3.4.6 Employ principle of least functionality — Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
    • CM.L2-3.4.7 Restrict nonessential programs and services — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
    • SC.L1-3.13.1 Monitor and control communications at boundaries — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
    • SC.L2-3.13.6 Deny network traffic by default — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
    Remediation
    Fix: Specify Explicit Firewall Rule Targets
    const firewallRule = new gcp.compute.Firewall("scoped-firewall-rule", {
    network: network.id,
    direction: "INGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],
    }],
    sourceRanges: ["10.0.0.0/24"],
    targetTags: ["web-servers"],  // Specify explicit targets
    // ... other config
});

    firewall-no-http-ingress

    Severity: critical · Enforcement: advisory

    Require firewall rules to disallow inbound HTTP traffic from unauthorized sources

    • CM.L2-3.4.7 Restrict nonessential programs and services — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
    Remediation
    Fix: Use HTTPS Instead of HTTP
    const firewallRule = new gcp.compute.Firewall("allow-https", {
    network: network.id,
    direction: "INGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],  // Use HTTPS (port 443) instead of HTTP (port 80)
    }],
    sourceRanges: ["0.0.0.0/0"],
    // ... other config
});

    firewall-no-public-ingress

    Severity: critical · Enforcement: advisory

    Require firewall rules to disallow public internet ingress unless specifically authorized

    • AC.L2-3.1.3 Control the flow of CUI — Control the flow of CUI in accordance with approved authorizations.
    • CM.L2-3.4.6 Employ principle of least functionality — Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
    • CM.L2-3.4.7 Restrict nonessential programs and services — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
    • SC.L1-3.13.1 Monitor and control communications at boundaries — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
    • SC.L2-3.13.6 Deny network traffic by default — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
    Remediation
    Fix: Use Private Network Ranges or Source Tags
    const firewallRule = new gcp.compute.Firewall("allow-private-ingress", {
    network: network.id,
    direction: "INGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],
    }],
    sourceRanges: ["10.0.0.0/8", "192.168.0.0/16"],  // Use private ranges instead of 0.0.0.0/0
    // Or use source tags for internal traffic control:
    // sourceTags: ["web-tier"],
    // ... other config
});

    firewall-no-unrestricted-egress

    Severity: high · Enforcement: advisory

    Prohibit EGRESS firewall rules that allow all ports to 0.0.0.0/0

    • AC.L2-3.1.3 Control the flow of CUI — Control the flow of CUI in accordance with approved authorizations.
    • SC.L2-3.13.6 Deny network traffic by default — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
    Remediation
    Fix: Restrict EGRESS Firewall Rules to Explicit Ports and Destinations
    const egressRule = new gcp.compute.Firewall("restricted-egress-rule", {
    network: network.id,
    direction: "EGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],  // Specify explicit ports, not all ports
    }],
    destinationRanges: ["10.0.0.0/24"],  // Prefer explicit destinations over 0.0.0.0/0
    // ... other config
});

    gke-private-endpoint

    Severity: high · Enforcement: advisory

    Restrict public access for GKE clusters by enabling private endpoint or configuring master authorized networks

    • AC.L1-3.1.22 Control CUI on publicly accessible systems — Control CUI posted or processed on publicly accessible systems.
    Remediation

    Enable private endpoint by setting privateClusterConfig.enablePrivateEndpoint: true, or configure masterAuthorizedNetworksConfig.cidrBlocks with specific IP ranges (avoid 0.0.0.0/0).

    gke-secrets-encryption

    Severity: high · Enforcement: advisory

    Require GKE clusters to have Application-layer Secrets Encryption enabled

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation
    Fix: Enable Application-layer Secrets Encryption
    const cluster = new gcp.container.Cluster("my-cluster", {
    databaseEncryption: {
        state: "ENCRYPTED",  // Enable secrets encryption
        keyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Specify KMS key
    },
    // ... other config
});

    iam-no-broad-roles

    Severity: critical · Enforcement: advisory

    Prohibit overly broad IAM roles on projects, organizations, folders, and service accounts

    • AC.L1-3.1.1 Limit system access to authorized users — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
    • AC.L1-3.1.2 Limit system access to authorized transaction types — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
    • AC.L2-3.1.4 Separate the duties of individuals — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
    • AC.L2-3.1.5 Employ the principle of least privilege — Employ the principle of least privilege, including for specific security functions and privileged accounts.
    • AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions — Use non-privileged accounts or roles when accessing nonsecurity functions.
    • AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
    • AC.L2-3.1.15 Authorize remote execution of privileged commands — Authorize remote execution of privileged commands and remote access to security-relevant information.
    • AU.L2-3.3.9 Limit audit logging management to privileged users — Limit management of audit logging functionality to a subset of privileged users.
    • CM.L2-3.4.5 Define access restrictions for system changes — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
    • MA.L2-3.7.2 Provide controls on maintenance tools and personnel — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
    Remediation
    Fix: Use Specific Least-Privilege Roles
    const binding = new gcp.projects.IAMBinding("service-binding", {
    project: "my-project",
    role: "roles/storage.objectViewer",
    members: ["serviceAccount:my-app@my-project.iam.gserviceaccount.com"],
});

    Replace broad roles such as roles/owner or roles/editor with the most specific role that grants only the permissions needed.

    iam-no-custom-role-excessive-permissions

    Severity: high · Enforcement: advisory

    Prevent IAM custom roles with excessive permissions for enhanced data access control.

    • AC.L1-3.1.1 Limit system access to authorized users — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
    • AC.L1-3.1.2 Limit system access to authorized transaction types — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
    • AC.L2-3.1.4 Separate the duties of individuals — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
    • AC.L2-3.1.5 Employ the principle of least privilege — Employ the principle of least privilege, including for specific security functions and privileged accounts.
    • AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions — Use non-privileged accounts or roles when accessing nonsecurity functions.
    • AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
    • AC.L2-3.1.15 Authorize remote execution of privileged commands — Authorize remote execution of privileged commands and remote access to security-relevant information.
    • CM.L2-3.4.5 Define access restrictions for system changes — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
    • MA.L2-3.7.2 Provide controls on maintenance tools and personnel — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
    Remediation

    Review and refine custom role permissions. Remove excessive administrative permissions like setIamPolicy, admin-level permissions, and owner permissions. Follow the principle of least privilege by granting only the minimum permissions required for the role’s intended purpose. Consider breaking up roles with too many permissions.

    Example - Create custom role with limited permissions:

    import * as gcp from "@pulumi/gcp";

const role = new gcp.projects.IAMCustomRole("limited-role", {
    roleId: "limitedViewer",
    title: "Limited Viewer",
    permissions: [
        "compute.instances.get",
        "compute.instances.list",
    ],
});

    iam-policy-no-statements-with-admin-access

    Severity: critical · Enforcement: advisory

    Prevent IAM policy bindings with administrative access permissions for secure configuration.

    • AC.L1-3.1.1 Limit system access to authorized users — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
    • AC.L1-3.1.2 Limit system access to authorized transaction types — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
    • AC.L2-3.1.4 Separate the duties of individuals — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
    • AC.L2-3.1.5 Employ the principle of least privilege — Employ the principle of least privilege, including for specific security functions and privileged accounts.
    • AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions — Use non-privileged accounts or roles when accessing nonsecurity functions.
    • AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
    • AC.L2-3.1.15 Authorize remote execution of privileged commands — Authorize remote execution of privileged commands and remote access to security-relevant information.
    • AU.L2-3.3.9 Limit audit logging management to privileged users — Limit management of audit logging functionality to a subset of privileged users.
    • CM.L2-3.4.5 Define access restrictions for system changes — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
    • MA.L2-3.7.2 Provide controls on maintenance tools and personnel — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
    Remediation

    Review and refine IAM policy bindings. Replace service-specific administrative roles like ‘roles/compute.admin’, ‘roles/storage.admin’, ‘roles/bigquery.admin’ with specific, granular roles. Use predefined roles with minimal permissions required for the task. Follow the principle of least privilege by granting only necessary permissions for operations, not administrative control over entire services.

    Example - Replace admin role with specific permissions:

    import * as gcp from "@pulumi/gcp";

// Instead of roles/compute.admin, use specific roles
const binding = new gcp.projects.IAMMember("compute-viewer", {
    project: "my-project",
    role: "roles/compute.viewer",
    member: "serviceAccount:sa@project.iam.gserviceaccount.com",
});

    iam-policy-no-wildcard-permissions

    Severity: critical · Enforcement: advisory

    Prevent IAM custom roles with wildcard permissions to enforce least privilege access control.

    • AC.L1-3.1.1 Limit system access to authorized users — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
    • AC.L1-3.1.2 Limit system access to authorized transaction types — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
    • AC.L2-3.1.4 Separate the duties of individuals — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
    • AC.L2-3.1.5 Employ the principle of least privilege — Employ the principle of least privilege, including for specific security functions and privileged accounts.
    • AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions — Use non-privileged accounts or roles when accessing nonsecurity functions.
    • AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
    • AC.L2-3.1.15 Authorize remote execution of privileged commands — Authorize remote execution of privileged commands and remote access to security-relevant information.
    • AU.L2-3.3.9 Limit audit logging management to privileged users — Limit management of audit logging functionality to a subset of privileged users.
    • CM.L2-3.4.5 Define access restrictions for system changes — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
    • MA.L2-3.7.2 Provide controls on maintenance tools and personnel — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
    Remediation

    Review and refine custom IAM roles. Remove wildcard () permissions and replace them with specific, granular permissions. Instead of using ‘compute.’ or ‘storage.*’, explicitly list the required permissions such as ‘compute.instances.get’, ‘compute.instances.list’, ‘storage.buckets.get’, etc. Follow the principle of least privilege by granting only the exact permissions needed for the role’s intended purpose.

    Example - Create custom role with specific permissions:

    import * as gcp from "@pulumi/gcp";

const customRole = new gcp.organizations.IAMCustomRole("custom-role", {
    roleId: "computeViewer",
    orgId: "123456789",
    title: "Compute Viewer",
    permissions: [
        "compute.instances.get",
        "compute.instances.list",
    ],
});

    instance-template-disk-cmek

    Severity: high · Enforcement: advisory

    Require instance template disks to have customer-managed (CMEK) or customer-supplied (CSEK) encryption keys

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation
    Fix: Configure CMEK or CSEK Disk Encryption
    const template = new gcp.compute.InstanceTemplate("my-template", {
    disks: [{
        boot: true,
        sourceImage: "debian-cloud/debian-11",
        diskEncryptionKey: {
            kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key",
        },
    }],
});

    kms-key-configuration

    Severity: low · Enforcement: advisory

    Require proper Cloud KMS key creation and configuration

    • SC.L2-3.13.10 Establish and manage cryptographic keys — Establish and manage cryptographic keys for cryptography employed in organizational systems.
    • SC.L2-3.13.11 Employ FIPS-validated cryptography — Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
    Remediation
    Fix: Configure KMS Key with Version Template
    const cryptoKey = new gcp.kms.CryptoKey("my-crypto-key", {
    name: "my-key",
    keyRing: keyRing.id,
    versionTemplate: {
        algorithm: "GOOGLE_SYMMETRIC_ENCRYPTION",  // Specify cryptographic algorithm
        protectionLevel: "HSM",  // Set protection level (SOFTWARE, HSM, EXTERNAL, EXTERNAL_VPC)
    },
    rotationPeriod: "7776000s",  // Optional: Configure 90-day rotation period
    purpose: "ENCRYPT_DECRYPT",  // Optional: Explicitly set key purpose
    // ... other config
});

    kms-key-iam

    Severity: high · Enforcement: advisory

    Require proper access controls for Cloud KMS key IAM policies

    • AC.L2-3.1.5 Employ the principle of least privilege — Employ the principle of least privilege, including for specific security functions and privileged accounts.
    Remediation
    Fix: Use Least-Privilege IAM Roles
    // Use specific roles instead of overprivileged roles
const cryptoKeyBinding = new gcp.kms.CryptoKeyIAMBinding("key-access", {
    cryptoKeyId: cryptoKey.id,
    role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",  // Use specific role
    members: [
        "serviceAccount:my-service@project.iam.gserviceaccount.com",  // Use specific service accounts
        "group:security-team@example.com",  // Or specific groups
    ],
    // Avoid: roles/owner, roles/editor, roles/cloudkms.admin
    // Avoid: allUsers, allAuthenticatedUsers, domain-wide access
    // ... other config
});

    kms-key-lifecycle

    Severity: low · Enforcement: advisory

    Require proper Cloud KMS key deletion and lifecycle management

    • SC.L2-3.13.10 Establish and manage cryptographic keys — Establish and manage cryptographic keys for cryptography employed in organizational systems.
    Remediation
    Fix: Configure Key Lifecycle Management
    const cryptoKey = new kms.CryptoKey("my-crypto-key", {
    name: "my-key",
    keyRing: keyRing.id,
    destroyScheduledDuration: "2592000s",  // Set 30-day scheduled destruction period
    skipInitialVersionCreation: false,  // Create initial key version
    versionTemplate: {
        algorithm: "GOOGLE_SYMMETRIC_ENCRYPTION",
        protectionLevel: "SOFTWARE",
    },
    // ... other config
});

    kms-key-rotation

    Severity: high · Enforcement: advisory

    Ensure Cloud KMS key rotation is enabled

    • SC.L2-3.13.10 Establish and manage cryptographic keys — Establish and manage cryptographic keys for cryptography employed in organizational systems.
    Remediation

    Enable automatic key rotation for Cloud KMS crypto keys by setting ‘rotationPeriod’. Key rotation limits the lifetime of encryption keys and reduces cryptographic risk.

    Example - Enable automatic key rotation:

    import * as gcp from "@pulumi/gcp";

const key = new gcp.kms.CryptoKey("my-key", {
    name: "crypto-key",
    keyRing: "projects/my-project/locations/us-central1/keyRings/my-ring",
    rotationPeriod: "7776000s", // 90 days (configurable)
});

    Periods this policy accepts out of the box: 2592000s (30 days), 5184000s (60 days) and 7776000s (90 days, the maxRotationPeriod default). Anything longer needs maxRotationPeriod raised to match, or it is reported again.

    lb-cloud-armor-attached

    Severity: high · Enforcement: advisory

    Ensures external backend services have Cloud Armor security policy attached

    • SC.L1-3.13.1 Monitor and control communications at boundaries — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
    Remediation

    Attach a Cloud Armor security policy to external backend services using the securityPolicy property for DDoS protection and threat detection.

    load-balancer-logging-enabled

    Severity: high · Enforcement: advisory

    Enable Load Balancer logging for monitoring

    • AU.L2-3.3.1 Create and retain system audit logs — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
    Remediation

    Enable logging on backend services by configuring logConfig.enable: true and set logConfig.sampleRate (1.0 for full logging, lower values for sampling). Ensure logs are retained in Cloud Logging for security analysis and troubleshooting.

    Pulumi TypeScript Example:

    import * as gcp from "@pulumi/gcp";

// For global backend service
const backendService = new gcp.compute.BackendService("my-backend", {
    logConfig: {
        enable: true,
        sampleRate: 1.0  // 1.0 = 100% logging, 0.5 = 50% sampling
    },
    // ... other configuration
});

// For regional backend service
const regionBackendService = new gcp.compute.RegionBackendService("my-region-backend", {
    logConfig: {
        enable: true,
        sampleRate: 1.0
    },
    // ... other configuration
});

    load-balancer-tls-https-listeners-only

    Severity: high · Enforcement: advisory

    Ensure Load Balancer uses TLS/HTTPS listeners only

    • AC.L2-3.1.13 Employ cryptographic mechanisms for remote access — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
    • SC.L2-3.13.8 Implement cryptographic mechanisms for transmission — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
    • SC.L2-3.13.15 Protect authenticity of communications sessions — Protect the authenticity of communications sessions.
    Remediation

    Configure forwarding rules to use port 443 for HTTPS traffic. Use TargetHttpsProxy instead of TargetHttpProxy. For HTTP listeners, ensure they redirect to HTTPS via URL map configuration. Remove standalone HTTP listeners without HTTPS redirection.

    Pulumi TypeScript Example:

    import * as gcp from "@pulumi/gcp";

// Create SSL certificate (or use existing)
const sslCert = new gcp.compute.ManagedSslCertificate("my-cert", {
    managed: {
        domains: ["example.com"]
    }
});

// Create HTTPS target proxy
const httpsProxy = new gcp.compute.TargetHttpsProxy("https-proxy", {
    urlMap: urlMap.id,
    sslCertificates: [sslCert.id]
});

// Create forwarding rule on port 443
const httpsForwardingRule = new gcp.compute.GlobalForwardingRule("https-rule", {
    target: httpsProxy.id,
    portRange: "443",
    ipProtocol: "TCP",
    loadBalancingScheme: "EXTERNAL"
});

// Optional: HTTP to HTTPS redirect
const httpProxy = new gcp.compute.TargetHttpProxy("http-proxy", {
    urlMap: redirectUrlMap.id  // URL map configured for redirect
});

const httpForwardingRule = new gcp.compute.GlobalForwardingRule("http-rule", {
    target: httpProxy.id,
    portRange: "80",
    ipProtocol: "TCP",
    loadBalancingScheme: "EXTERNAL"
});

    managed-instance-group-launch-template-public-ip-disabled

    Severity: high · Enforcement: advisory

    Ensure Managed Instance Group launch templates have public IP addresses disabled

    • AC.L1-3.1.1 Limit system access to authorized users — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
    • AC.L1-3.1.22 Control CUI on publicly accessible systems — Control CUI posted or processed on publicly accessible systems.
    Remediation

    Disable public IP in instance template:

    new gcp.compute.InstanceTemplate("my-template", {
  networkInterfaces: [{
    network: "my-vpc",
    subnetwork: "my-subnet",
    accessConfigs: [], // Empty array disables public IP
  }],
  // ... other config
});

    This prevents unintended public accessibility.

    os-config-patch-coverage

    Severity: high · Enforcement: advisory

    Ensure Compute Engine instances are covered by OS Config patch management

    • CM.L2-3.4.2 Establish and enforce security configuration settings — Establish and enforce security configuration settings for information technology products employed in organizational systems.
    • MA.L2-3.7.1 Perform system maintenance — Perform maintenance on organizational systems.
    • RA.L2-3.11.3 Remediate vulnerabilities — Remediate vulnerabilities in accordance with risk assessments.
    • SI.L1-3.14.1 Identify and correct system flaws — Identify, report, and correct system flaws in a timely manner.
    Remediation

    Enable OS Config on instances by setting metadata ’enable-osconfig: TRUE’. Create patch deployment policies so instances receive automated patch management.

    Example Pulumi TypeScript:

    import * as gcp from "@pulumi/gcp";

const instance = new gcp.compute.Instance("managed-instance", {
    // ... other config
    metadata: {
        "enable-osconfig": "TRUE",
    },
});

const patchDeployment = new gcp.osconfig.PatchDeployment("weekly-patch", {
    patchDeploymentId: "weekly-patches",
    instanceFilter: {
        all: true,
    },
    recurringSchedule: {
        timeZone: { id: "UTC" },
        weekly: { dayOfWeek: "SUNDAY" },
    },
    patchConfig: {
        rebootConfig: "DEFAULT",
    },
});

    persistent-disk-cmek

    Severity: high · Enforcement: advisory

    Ensures persistent disks have customer-managed (CMEK) or customer-supplied (CSEK) encryption keys

    • MP.L2-3.8.1 Protect system media containing CUI — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation

    Configure diskEncryptionKey with either kmsKeySelfLink (CMEK), rawKey, or rsaEncryptedKey (CSEK).

    private-service-connect

    Severity: high · Enforcement: advisory

    Require Private Service Connect endpoints to have restrictive security policies

    • SC.L2-3.13.2 Employ architectural designs promoting security — Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
    Remediation
    Fix: Configure Secure Private Service Connect
    // Create Service Attachment with manual connection approval
const serviceAttachment = new gcp.compute.ServiceAttachment("psc-service", {
    connectionPreference: "ACCEPT_MANUAL",  // Require manual approval for connections
    consumerAcceptLists: [{
        projectIdOrNum: "consumer-project-123",
        connectionLimit: 10,  // Limit connections to minimize attack surface
    }],
    targetService: backendService.id,
    // ... other config
});

// Create Forwarding Rule for PSC with internal load balancing
const forwardingRule = new gcp.compute.ForwardingRule("psc-endpoint", {
    network: network.id,  // Specify network for proper isolation
    loadBalancingScheme: "INTERNAL",  // Use internal scheme for private connectivity
    target: serviceAttachment.id,
    // ... other config
});

    pubsub-encrypted-kms

    Severity: medium · Enforcement: advisory

    Ensure Pub/Sub is encrypted with Cloud KMS

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation

    Configure kmsKeyName property when creating Pub/Sub topics to use customer-managed encryption keys (CMEK) for enhanced security and key management control.

    Example - Pub/Sub Topic with Customer-Managed Encryption:

    import * as gcp from "@pulumi/gcp";

// Create KMS KeyRing and CryptoKey for encryption
const keyRing = new gcp.kms.KeyRing("pubsub-keyring", {
    name: "pubsub-keyring",
    location: "us-central1"
});

const cryptoKey = new gcp.kms.CryptoKey("pubsub-key", {
    name: "pubsub-encryption-key",
    keyRing: keyRing.id,
    rotationPeriod: "7776000s"  // 90 days
});

// Grant Pub/Sub service account access to the key
const binding = new gcp.kms.CryptoKeyIAMBinding("pubsub-key-binding", {
    cryptoKeyId: cryptoKey.id,
    role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
    members: ["serviceAccount:service-PROJECT_NUMBER@gcp-sa-pubsub.iam.gserviceaccount.com"]
});

// COMPLIANT: Topic with customer-managed encryption key
const topicCompliant = new gcp.pubsub.Topic("encrypted-topic", {
    name: "secure-topic",
    kmsKeyName: cryptoKey.id,  // Compliant: CMEK configured
    messageRetentionDuration: "86400s"
});

// NON-COMPLIANT: Topic without CMEK (uses Google-managed keys)
const topicNonCompliant = new gcp.pubsub.Topic("default-topic", {
    name: "insecure-topic"
    // Missing kmsKeyName - uses default Google-managed encryption
});

    pubsub-subscription-iam-least-privilege

    Severity: high · Enforcement: advisory

    Enforce least privilege IAM policies for Pub/Sub subscriptions

    • AC.L2-3.1.5 Employ the principle of least privilege — Employ the principle of least privilege, including for specific security functions and privileged accounts.
    Remediation
    Fix: Use Least Privilege IAM Roles
    const subscriptionIamBinding = new gcp.pubsub.SubscriptionIAMBinding("subscription-subscriber-binding", {
    subscription: subscription.id,
    role: "roles/pubsub.subscriber",  // Use specific role instead of admin/owner/editor
    members: [
        "serviceAccount:app-service@project.iam.gserviceaccount.com",  // Use specific service accounts instead of allUsers
    ],
});

    pubsub-topic-iam-least-privilege

    Severity: high · Enforcement: advisory

    Enforce least privilege IAM policies for Pub/Sub topics

    • AC.L2-3.1.5 Employ the principle of least privilege — Employ the principle of least privilege, including for specific security functions and privileged accounts.
    Remediation
    Fix: Use Least Privilege IAM Roles
    const topicIamBinding = new gcp.pubsub.TopicIAMBinding("topic-publisher-binding", {
    topic: topic.id,
    role: "roles/pubsub.publisher",  // Use specific role instead of admin/owner/editor
    members: [
        "serviceAccount:app-service@project.iam.gserviceaccount.com",  // Use specific service accounts instead of allUsers
    ],
});

    resource-labeling

    Severity: low · Enforcement: advisory

    Require all GCP resources to have proper labeling for change tracking

    • MP.L2-3.8.4 Mark media with CUI markings — Mark media with necessary CUI markings and distribution limitations.
    Remediation
    Fix: Add Required Labels for Change Tracking

    Add the required labels (environment, team, owner) to your GCP resources:

    const instance = new gcp.compute.Instance("my-instance", {
    labels: {
        environment: "production",  // Required: environment label
        team: "platform",           // Required: team label
        owner: "john-doe",          // Required: owner label
        // ... other labels
    },
    // ... other config
});

// For Cloud SQL instances, use userLabels within settings
const sqlInstance = new gcp.sql.DatabaseInstance("my-database", {
    settings: {
        userLabels: {
            environment: "production",  // Required: environment label
            team: "data",               // Required: team label
            owner: "jane-smith",        // Required: owner label
        },
        // ... other settings
    },
    // ... other config
});

// For GKE clusters, use resourceLabels
const cluster = new gcp.container.Cluster("my-cluster", {
    resourceLabels: {
        environment: "production",  // Required: environment label
        team: "infrastructure",     // Required: team label
        owner: "ops-team",          // Required: owner label
    },
    // ... other config
});

    secretmanager-secret-cmek

    Severity: high · Enforcement: advisory

    Require Secret Manager secrets to use customer-managed Cloud KMS keys

    • SC.L2-3.13.16 Protect confidentiality of CUI at rest — Protect the confidentiality of CUI at rest.
    Remediation
    Fix: Configure Customer-Managed KMS Encryption
    import * as gcp from "@pulumi/gcp";

// Create a KMS KeyRing and CryptoKey
const keyRing = new gcp.kms.KeyRing("my-keyring", {
    name: "secret-keyring",
    location: "us-central1",
});

const cryptoKey = new gcp.kms.CryptoKey("my-key", {
    name: "secret-encryption-key",
    keyRing: keyRing.id,
    rotationPeriod: "7776000s",  // 90 days
});

// Option 1: Auto-replication with customer-managed encryption
const secretAuto = new gcp.secretmanager.Secret("my-secret-auto", {
    secretId: "my-cmek-secret",
    replication: {
        auto: {
            customerManagedEncryption: {
                kmsKeyName: cryptoKey.id,  // Use customer-managed KMS key
            },
        },
    },
});

// Option 2: User-managed replication with customer-managed encryption
const secretUserManaged = new gcp.secretmanager.Secret("my-secret-user", {
    secretId: "my-cmek-secret-regional",
    replication: {
        userManaged: {
            replicas: [
                {
                    location: "us-central1",
                    customerManagedEncryption: {
                        kmsKeyName: cryptoKey.id,  // Use customer-managed KMS key
                    },
                },
                {
                    location: "us-east1",
                    customerManagedEncryption: {
                        kmsKeyName: cryptoKey.id,  // Specify for each replica
                    },
                },
            ],
        },
    },
});

    securitypolicy-has-custom-rules

    Severity: high · Enforcement: advisory

    Ensures Cloud Armor security policies have custom protection rules

    • SC.L1-3.13.1 Monitor and control communications at boundaries — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
    Remediation

    Add custom protection rules to the Cloud Armor security policy for DDoS protection, SQL injection prevention, XSS protection, or other security policies.

    subnet-private-google-access

    Severity: medium · Enforcement: advisory

    Ensure Private Google Access is enabled on VPC subnets

    • SC.L2-3.13.2 Employ architectural designs promoting security — Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
    Remediation

    Enable Private Google Access on subnets by setting privateIpGoogleAccess: true. This allows instances without external IP addresses to access Google APIs and services. Use Cloud NAT for internet access without public IPs.

    Pulumi TypeScript Example:

    import * as gcp from "@pulumi/gcp";

// Enable Private Google Access on subnet
const subnet = new gcp.compute.Subnetwork("my-subnet", {
    ipCidrRange: "10.0.0.0/24",
    network: network.id,
    region: "us-central1",
    privateIpGoogleAccess: true  // Allow instances without external IPs to access Google APIs
});

// Optional: Create Cloud NAT for outbound internet access
const router = new gcp.compute.Router("my-router", {
    network: network.id,
    region: "us-central1"
});

const nat = new gcp.compute.RouterNat("my-nat", {
    router: router.name,
    region: router.region,
    natIpAllocateOption: "AUTO_ONLY",
    sourceSubnetworkIpRangesToNat: "ALL_SUBNETWORKS_ALL_IP_RANGES"
});

    vpc-flow-logs-enabled

    Severity: high · Enforcement: advisory

    Ensure VPC subnets have Flow Logs enabled for audit and monitoring

    • AC.L2-3.1.3 Control the flow of CUI — Control the flow of CUI in accordance with approved authorizations.
    • AC.L2-3.1.12 Monitor and control remote access sessions — Monitor and control remote access sessions.
    • AU.L2-3.3.1 Create and retain system audit logs — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
    • SC.L1-3.13.1 Monitor and control communications at boundaries — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
    • SI.L2-3.14.6 Monitor systems to detect attacks — Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
    Remediation

    Enable VPC Flow Logs on subnets by configuring logConfig with aggregationInterval (e.g., INTERVAL_5_SEC) and flowSampling (0.5 for 50% or 1.0 for 100%). Ensure flowSampling is greater than 0 to collect traffic logs.

    Pulumi TypeScript Example:

    import * as gcp from "@pulumi/gcp";

const subnet = new gcp.compute.Subnetwork("my-subnet", {
    ipCidrRange: "10.0.0.0/24",
    network: network.id,
    region: "us-central1",
    logConfig: {
        aggregationInterval: "INTERVAL_5_SEC",  // or INTERVAL_30_SEC, INTERVAL_1_MIN, etc.
        flowSampling: 1.0,  // 1.0 = 100% sampling, 0.5 = 50%
        metadata: "INCLUDE_ALL_METADATA"
    },
    privateIpGoogleAccess: true
});

    Valid aggregationInterval values: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN

      The infrastructure as code platform for any cloud.

      Contact us Get started