---
title: Google Cloud
url: /docs/reference/pre-built-policy-packs/cmmc/google-cloud/
---
> This [Pulumi Cloud](/docs/iac/concepts/pulumi-cloud/) feature is available in the [Enterprise edition](/pricing/).


This page lists all 59 policies in the **CMMC 2.0** pack for **Google Cloud**, as published in `cmmc-google-cloud` version `1.0.0`.

## Policies by control

**AC.L1-3.1.1 Limit system access to authorized users** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

- [compute-engine-instance-not-publicly-accessible](#compute-engine-instance-not-publicly-accessible)
- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-no-custom-role-excessive-permissions](#iam-no-custom-role-excessive-permissions)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)
- [managed-instance-group-launch-template-public-ip-disabled](#managed-instance-group-launch-template-public-ip-disabled)

**AC.L1-3.1.2 Limit system access to authorized transaction types** — Limit system access to the types of transactions and functions that authorized users are permitted to execute.

- [bucket-iam-least-privilege](#bucket-iam-least-privilege)
- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-no-custom-role-excessive-permissions](#iam-no-custom-role-excessive-permissions)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)

**AC.L1-3.1.22 Control CUI on publicly accessible systems** — Control CUI posted or processed on publicly accessible systems.

- [bigquery-dataset-public-access-check](#bigquery-dataset-public-access-check)
- [bucket-public-read-prohibited](#bucket-public-read-prohibited)
- [cloud-sql-instance-not-publicly-accessible](#cloud-sql-instance-not-publicly-accessible)
- [cloudfunctions-iam-no-public](#cloudfunctions-iam-no-public)
- [compute-engine-instance-not-publicly-accessible](#compute-engine-instance-not-publicly-accessible)
- [dataproc-cluster-master-nodes-no-public-ip](#dataproc-cluster-master-nodes-no-public-ip)
- [gke-private-endpoint](#gke-private-endpoint)
- [managed-instance-group-launch-template-public-ip-disabled](#managed-instance-group-launch-template-public-ip-disabled)

**AC.L2-3.1.3 Control the flow of CUI** — Control the flow of CUI in accordance with approved authorizations.

- [firewall-explicit-target-scoping](#firewall-explicit-target-scoping)
- [firewall-no-public-ingress](#firewall-no-public-ingress)
- [firewall-no-unrestricted-egress](#firewall-no-unrestricted-egress)
- [vpc-flow-logs-enabled](#vpc-flow-logs-enabled)

**AC.L2-3.1.4 Separate the duties of individuals** — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-no-custom-role-excessive-permissions](#iam-no-custom-role-excessive-permissions)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)

**AC.L2-3.1.5 Employ the principle of least privilege** — Employ the principle of least privilege, including for specific security functions and privileged accounts.

- [bucket-iam-least-privilege](#bucket-iam-least-privilege)
- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-no-custom-role-excessive-permissions](#iam-no-custom-role-excessive-permissions)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)
- [kms-key-iam](#kms-key-iam)
- [pubsub-subscription-iam-least-privilege](#pubsub-subscription-iam-least-privilege)
- [pubsub-topic-iam-least-privilege](#pubsub-topic-iam-least-privilege)

**AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions** — Use non-privileged accounts or roles when accessing nonsecurity functions.

- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-no-custom-role-excessive-permissions](#iam-no-custom-role-excessive-permissions)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)

**AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions** — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-no-custom-role-excessive-permissions](#iam-no-custom-role-excessive-permissions)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)

**AC.L2-3.1.12 Monitor and control remote access sessions** — Monitor and control remote access sessions.

- [vpc-flow-logs-enabled](#vpc-flow-logs-enabled)

**AC.L2-3.1.13 Employ cryptographic mechanisms for remote access** — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

- [cloudsql-ssl](#cloudsql-ssl)
- [load-balancer-tls-https-listeners-only](#load-balancer-tls-https-listeners-only)

**AC.L2-3.1.15 Authorize remote execution of privileged commands** — Authorize remote execution of privileged commands and remote access to security-relevant information.

- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-no-custom-role-excessive-permissions](#iam-no-custom-role-excessive-permissions)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)

**AU.L2-3.3.1 Create and retain system audit logs** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

- [bigtable-change-streams](#bigtable-change-streams)
- [bucket-access-logging](#bucket-access-logging)
- [cloud-build-logging](#cloud-build-logging)
- [cloud-logging-retention-period-365](#cloud-logging-retention-period-365)
- [cloud-sql-logging-enabled](#cloud-sql-logging-enabled)
- [load-balancer-logging-enabled](#load-balancer-logging-enabled)
- [vpc-flow-logs-enabled](#vpc-flow-logs-enabled)

**AU.L2-3.3.9 Limit audit logging management to privileged users** — Limit management of audit logging functionality to a subset of privileged users.

- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)

**CM.L2-3.4.2 Establish and enforce security configuration settings** — Establish and enforce security configuration settings for information technology products employed in organizational systems.

- [cloudsql-patching](#cloudsql-patching)
- [os-config-patch-coverage](#os-config-patch-coverage)

**CM.L2-3.4.5 Define access restrictions for system changes** — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.

- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-no-custom-role-excessive-permissions](#iam-no-custom-role-excessive-permissions)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)

**CM.L2-3.4.6 Employ principle of least functionality** — Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

- [firewall-explicit-target-scoping](#firewall-explicit-target-scoping)
- [firewall-no-public-ingress](#firewall-no-public-ingress)

**CM.L2-3.4.7 Restrict nonessential programs and services** — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

- [firewall-explicit-target-scoping](#firewall-explicit-target-scoping)
- [firewall-no-http-ingress](#firewall-no-http-ingress)
- [firewall-no-public-ingress](#firewall-no-public-ingress)

**IA.L1-3.5.2 Authenticate identities of users and devices** — Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

- [cloud-sql-iam-authentication](#cloud-sql-iam-authentication)
- [compute-engine-instance-uses-os-login](#compute-engine-instance-uses-os-login)

**MA.L2-3.7.1 Perform system maintenance** — Perform maintenance on organizational systems.

- [cloudsql-patching](#cloudsql-patching)
- [os-config-patch-coverage](#os-config-patch-coverage)

**MA.L2-3.7.2 Provide controls on maintenance tools and personnel** — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

- [iam-no-broad-roles](#iam-no-broad-roles)
- [iam-no-custom-role-excessive-permissions](#iam-no-custom-role-excessive-permissions)
- [iam-policy-no-statements-with-admin-access](#iam-policy-no-statements-with-admin-access)
- [iam-policy-no-wildcard-permissions](#iam-policy-no-wildcard-permissions)

**MP.L1-3.8.3 Sanitize or destroy system media before disposal** — Sanitize or destroy system media containing CUI before disposal or release for reuse.

- [bucket-lifecycle](#bucket-lifecycle)

**MP.L2-3.8.1 Protect system media containing CUI** — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

- [bucket-cmek](#bucket-cmek)
- [compute-instance-encrypted-boot-disk](#compute-instance-encrypted-boot-disk)
- [persistent-disk-cmek](#persistent-disk-cmek)

**MP.L2-3.8.2 Limit access to CUI on system media** — Limit access to CUI on system media to authorized users.

- [bucket-iam-least-privilege](#bucket-iam-least-privilege)
- [bucket-public-read-prohibited](#bucket-public-read-prohibited)

**MP.L2-3.8.4 Mark media with CUI markings** — Mark media with necessary CUI markings and distribution limitations.

- [resource-labeling](#resource-labeling)

**MP.L2-3.8.9 Protect confidentiality of backup CUI** — Protect the confidentiality of backup CUI at storage locations.

- [bucket-cmek](#bucket-cmek)
- [cloud-sql-storage-encrypted](#cloud-sql-storage-encrypted)

**RA.L2-3.11.2 Scan for vulnerabilities** — Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

- [compute-osconfig-vulnerability](#compute-osconfig-vulnerability)

**RA.L2-3.11.3 Remediate vulnerabilities** — Remediate vulnerabilities in accordance with risk assessments.

- [cloudsql-patching](#cloudsql-patching)
- [os-config-patch-coverage](#os-config-patch-coverage)

**SC.L1-3.13.1 Monitor and control communications at boundaries** — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

- [firewall-explicit-target-scoping](#firewall-explicit-target-scoping)
- [firewall-no-public-ingress](#firewall-no-public-ingress)
- [lb-cloud-armor-attached](#lb-cloud-armor-attached)
- [securitypolicy-has-custom-rules](#securitypolicy-has-custom-rules)
- [vpc-flow-logs-enabled](#vpc-flow-logs-enabled)

**SC.L2-3.13.2 Employ architectural designs promoting security** — Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

- [private-service-connect](#private-service-connect)
- [subnet-private-google-access](#subnet-private-google-access)

**SC.L2-3.13.6 Deny network traffic by default** — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

- [firewall-explicit-target-scoping](#firewall-explicit-target-scoping)
- [firewall-no-public-ingress](#firewall-no-public-ingress)
- [firewall-no-unrestricted-egress](#firewall-no-unrestricted-egress)

**SC.L2-3.13.8 Implement cryptographic mechanisms for transmission** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

- [cloud-cdn-origin-tls](#cloud-cdn-origin-tls)
- [cloudsql-ssl](#cloudsql-ssl)
- [load-balancer-tls-https-listeners-only](#load-balancer-tls-https-listeners-only)

**SC.L2-3.13.10 Establish and manage cryptographic keys** — Establish and manage cryptographic keys for cryptography employed in organizational systems.

- [kms-key-configuration](#kms-key-configuration)
- [kms-key-lifecycle](#kms-key-lifecycle)
- [kms-key-rotation](#kms-key-rotation)

**SC.L2-3.13.11 Employ FIPS-validated cryptography** — Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

- [bucket-cmek](#bucket-cmek)
- [kms-key-configuration](#kms-key-configuration)

**SC.L2-3.13.15 Protect authenticity of communications sessions** — Protect the authenticity of communications sessions.

- [load-balancer-tls-https-listeners-only](#load-balancer-tls-https-listeners-only)

**SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

- [artifactregistry-customer-kms](#artifactregistry-customer-kms)
- [bigquery-dataset-cmek](#bigquery-dataset-cmek)
- [bucket-cmek](#bucket-cmek)
- [cloud-logging-encrypted](#cloud-logging-encrypted)
- [cloud-sql-storage-encrypted](#cloud-sql-storage-encrypted)
- [cloudfunctions-kms-env-vars](#cloudfunctions-kms-env-vars)
- [compute-instance-encrypted-boot-disk](#compute-instance-encrypted-boot-disk)
- [dataflow-kms](#dataflow-kms)
- [filestore-cmek](#filestore-cmek)
- [gke-secrets-encryption](#gke-secrets-encryption)
- [instance-template-disk-cmek](#instance-template-disk-cmek)
- [persistent-disk-cmek](#persistent-disk-cmek)
- [pubsub-encrypted-kms](#pubsub-encrypted-kms)
- [secretmanager-secret-cmek](#secretmanager-secret-cmek)

**SI.L1-3.14.1 Identify and correct system flaws** — Identify, report, and correct system flaws in a timely manner.

- [cloudsql-patching](#cloudsql-patching)
- [compute-osconfig-vulnerability](#compute-osconfig-vulnerability)
- [os-config-patch-coverage](#os-config-patch-coverage)

**SI.L1-3.14.5 Perform periodic and real-time scans** — Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.

- [compute-osconfig-vulnerability](#compute-osconfig-vulnerability)

**SI.L2-3.14.6 Monitor systems to detect attacks** — Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

- [cloud-armor-logging](#cloud-armor-logging)
- [vpc-flow-logs-enabled](#vpc-flow-logs-enabled)

## Policy details

### artifactregistry-customer-kms

**Severity:** high · **Enforcement:** advisory

Require Artifact Registry repositories to use customer-managed Cloud KMS keys for encryption

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

##### Fix: Configure Customer-Managed KMS Key

```typescript
const repository = new gcp.artifactregistry.Repository("my-repository", {
    repositoryId: "my-repo",
    format: "DOCKER",
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Specify customer-managed KMS key
    // ... other config
});
```

### bigquery-dataset-cmek

**Severity:** high · **Enforcement:** advisory

Ensures BigQuery datasets are encrypted with customer-managed keys (CMEK)

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

Configure defaultEncryptionConfiguration with kmsKeyName to use a Cloud KMS key for dataset encryption.

### bigquery-dataset-public-access-check

**Severity:** high · **Enforcement:** advisory

Ensure BigQuery datasets are not publicly accessible

- **AC.L1-3.1.22 Control CUI on publicly accessible systems** — Control CUI posted or processed on publicly accessible systems.

Remediation

Remove public access from BigQuery datasets by ensuring IAM policies do not grant `allUsers` or `allAuthenticatedUsers` permissions. Review dataset `accesses` configuration and IAM bindings/members. Grant access only to specific service accounts, users, or groups based on least privilege principles.

Example TypeScript:
```typescript
import * as gcp from "@pulumi/gcp";

const dataset = new gcp.bigquery.Dataset("secure-dataset", {
    datasetId: "my_dataset",
    location: "US",
    accesses: [
        {
            role: "READER",
            userByEmail: "analyst@example.com"
        },
        {
            role: "roles/bigquery.dataEditor",
            userByEmail: serviceAccount.email
        }
        // Do NOT include allUsers or allAuthenticatedUsers
    ]
});

// Using IAM binding for specific members only
const datasetViewer = new gcp.bigquery.DatasetIamBinding("dataset-viewer", {
    datasetId: dataset.datasetId,
    role: "roles/bigquery.dataViewer",
    members: [
        "user:jane@example.com",
        "serviceAccount:myapp@project.iam.gserviceaccount.com"
        // Do NOT use allUsers or allAuthenticatedUsers
    ]
});
```

### bigtable-change-streams

**Severity:** medium · **Enforcement:** advisory

Require Bigtable tables to have change streams enabled for change tracking

- **AU.L2-3.3.1 Create and retain system audit logs** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Remediation

##### Fix: Enable Change Stream Retention

```typescript
const bigtableTable = new gcp.bigtable.Table("my-table", {
    instanceName: "my-bigtable-instance",
    changeStreamRetention: "72h0m0s",  // Enable change streams with 3-day retention
    // ... other config
});
```

### bucket-access-logging

**Severity:** medium · **Enforcement:** advisory

Ensures Cloud Storage buckets have access logging enabled with a log destination bucket

- **AU.L2-3.3.1 Create and retain system audit logs** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Remediation

##### Fix: Enable Access Logging

Set `logging.logBucket` to the bucket that should receive the access logs. The other settings
are not this policy's concern; they are here so the example also satisfies the sibling policies
its packs register.

```typescript
const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    logging: {
        logBucket: "my-logging-bucket",  // Destination bucket for access logs
        logObjectPrefix: "bucket-logs/", // Optional prefix for log objects
    },
    uniformBucketLevelAccess: true,
    publicAccessPrevention: "enforced",
    versioning: { enabled: true },
    encryption: {
        defaultKmsKeyName: "projects/my-project/locations/us/keyRings/my-ring/cryptoKeys/my-key",
    },
    lifecycleRules: [{
        action: { type: "SetStorageClass", storageClass: "NEARLINE" },
        condition: { age: 30 },
    }],
    labels: { environment: "production", team: "platform", owner: "security" },
});
```

### bucket-cmek

**Severity:** high · **Enforcement:** advisory

Ensures Cloud Storage buckets use customer-managed KMS keys for encryption

- **MP.L2-3.8.1 Protect system media containing CUI** — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
- **MP.L2-3.8.9 Protect confidentiality of backup CUI** — Protect the confidentiality of backup CUI at storage locations.
- **SC.L2-3.13.11 Employ FIPS-validated cryptography** — Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

Configure bucket.encryption.defaultKmsKeyName with a valid customer-managed KMS key in the format: projects/PROJECT/locations/LOCATION/keyRings/RING/cryptoKeys/KEY

### bucket-iam-least-privilege

**Severity:** high · **Enforcement:** advisory

Enforce least privilege access for Cloud Storage bucket IAM policies

- **AC.L1-3.1.2 Limit system access to authorized transaction types** — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- **AC.L2-3.1.5 Employ the principle of least privilege** — Employ the principle of least privilege, including for specific security functions and privileged accounts.
- **MP.L2-3.8.2 Limit access to CUI on system media** — Limit access to CUI on system media to authorized users.

Remediation

##### Fix: Use Specific Least Privilege Roles

```typescript
// Instead of overly broad roles like storage.admin or storage.objectAdmin
// Use specific roles based on actual needs:

// For read-only access
const viewerBinding = new gcp.storage.BucketIAMBinding("viewer-binding", {
    bucket: bucket.name,
    role: "roles/storage.objectViewer",  // Read-only access to objects
    members: ["user:viewer@example.com"],
});

// For write-only access
const creatorBinding = new gcp.storage.BucketIAMBinding("creator-binding", {
    bucket: bucket.name,
    role: "roles/storage.objectCreator",  // Write-only access (no read)
    members: ["serviceAccount:app@project.iam.gserviceaccount.com"],
});

// Avoid these overly broad roles:
// - roles/storage.admin
// - roles/storage.objectAdmin
// - roles/owner
// - roles/editor
```

### bucket-lifecycle

**Severity:** medium · **Enforcement:** advisory

Require Cloud Storage buckets to have lifecycle management policies configured

- **MP.L1-3.8.3 Sanitize or destroy system media before disposal** — Sanitize or destroy system media containing CUI before disposal or release for reuse.

Remediation

##### Fix: Configure Lifecycle Rules

```typescript
const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    lifecycleRules: [
        {
            action: {
                type: "Delete",  // Delete old objects
            },
            condition: {
                age: 365,  // After 365 days
            },
        },
        {
            action: {
                type: "SetStorageClass",
                storageClass: "NEARLINE",  // Archive to cheaper storage
            },
            condition: {
                age: 90,  // After 90 days
            },
        },
    ],
    // ... other config
});
```

### bucket-public-read-prohibited

**Severity:** high · **Enforcement:** advisory

Ensure Cloud Storage bucket public read is prohibited

- **AC.L1-3.1.22 Control CUI on publicly accessible systems** — Control CUI posted or processed on publicly accessible systems.
- **MP.L2-3.8.2 Limit access to CUI on system media** — Limit access to CUI on system media to authorized users.

Remediation

Remove public read access from Cloud Storage buckets by ensuring IAM policies and ACLs do not grant allUsers or allAuthenticatedUsers read permissions. Set 'publicAccessPrevention' to 'enforced' to prevent public access.

### cloud-armor-logging

**Severity:** medium · **Enforcement:** advisory

Ensure Cloud Armor security policies are attached to backend services with logging enabled

- **SI.L2-3.14.6 Monitor systems to detect attacks** — Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

Remediation

Enable logging on backend services that use Cloud Armor security policies. Cloud Armor events are logged through the backend service's access logs, not the security policy itself.

```typescript
import * as gcp from "@pulumi/gcp";

// Step 1: Create Cloud Armor security policy
const securityPolicy = new gcp.compute.SecurityPolicy("security-policy", {
    name: "my-security-policy",
    rules: [{
        action: "deny(403)",
        priority: 1000,
        match: {
            versionedExpr: "SRC_IPS_V1",
            config: {
                srcIpRanges: ["192.168.1.0/24"]
            }
        }
    }]
});

// Step 2: CRITICAL - Attach to backend service with logging enabled
const backend = new gcp.compute.BackendService("backend", {
    name: "backend-service",
    securityPolicy: securityPolicy.selfLink,
    logConfig: {
        enable: true,        // REQUIRED for Cloud Armor logging
        sampleRate: 1.0      // 1.0 = 100% logging, 0.5 = 50% sampling
    }
});
```

### cloud-build-logging

**Severity:** medium · **Enforcement:** advisory

Require Cloud Build triggers to have secure logging configurations

- **AU.L2-3.3.1 Create and retain system audit logs** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Remediation

##### Fix: Configure Secure Logging

```typescript
const trigger = new cloudbuild.Trigger("my-trigger", {
    build: {
        logsBucket: "gs://my-logs-bucket/build-logs",  // Configure centralized logs bucket
        options: {
            logging: "CLOUD_LOGGING_ONLY",  // Use Cloud Logging for audit trails
        },
        // ... other config
    },
    // ... other config
});
```

### cloud-cdn-origin-tls

**Severity:** high · **Enforcement:** advisory

Require Cloud CDN to use secure TLS to origin

- **SC.L2-3.13.8 Implement cryptographic mechanisms for transmission** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

Remediation

##### Fix: Enable HTTPS Protocol for CDN Backend Service

```typescript
const backendService = new gcp.compute.BackendService("cdn-backend", {
    enableCdn: true,
    protocol: "HTTPS",  // Use HTTPS for secure communication to origin
    // ... other config
});
```

### cloud-logging-encrypted

**Severity:** high · **Enforcement:** advisory

Ensure Cloud Logging is encrypted

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

Configure Cloud Logging buckets with customer-managed encryption keys (CMEK) for enhanced security. On gcp.logging.LogBucket or gcp.logging.ProjectBucketConfig resources, set cmekSettings with a kmsKeyName pointing to a Cloud KMS key. While GCP encrypts all log data by default with Google-managed keys, CMEK provides additional control and compliance capabilities.

### cloud-logging-retention-period-365

**Severity:** high · **Enforcement:** advisory

Ensure Cloud Logging log retention is 365 days or more

- **AU.L2-3.3.1 Create and retain system audit logs** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Remediation

Configure Cloud Logging buckets with retentionDays set to at least 365 days. Update gcp.logging.ProjectBucketConfig, gcp.logging.OrganizationBucketConfig, gcp.logging.FolderBucketConfig, or gcp.logging.BillingAccountBucketConfig resources to specify 'retentionDays: 365' or higher to maintain adequate audit trails for security investigations and compliance.

### cloud-sql-iam-authentication

**Severity:** high · **Enforcement:** advisory

Require Cloud SQL instances to enable IAM authentication and Cloud SQL users to use IAM-based user types

- **IA.L1-3.5.2 Authenticate identities of users and devices** — Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

Remediation

##### Fix: Use IAM Authentication

```typescript
// For Cloud SQL instance: Enable IAM authentication
const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        databaseFlags: [
            {
                name: "cloudsql_iam_authentication",
                value: "on",  // Enable IAM authentication
            },
        ],
        // ... other config
    },
});

// For Cloud SQL users: Use IAM-based authentication
const sqlUser = new gcp.sql.User("my-sql-user", {
    instance: sqlInstance.name,
    name: "user@example.com",
    type: "CLOUD_IAM_USER",  // Use IAM user type instead of built-in
});
```

### cloud-sql-instance-not-publicly-accessible

**Severity:** high · **Enforcement:** advisory

Restrict public access for Cloud SQL instances

- **AC.L1-3.1.22 Control CUI on publicly accessible systems** — Control CUI posted or processed on publicly accessible systems.

Remediation

Disable public IP by setting ipv4Enabled to false and configure privateNetwork in ipConfiguration. Remove authorized networks that allow 0.0.0.0/0 access.

Example Pulumi TypeScript:
```typescript
import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        ipConfiguration: {
            ipv4Enabled: false,
            privateNetwork: "projects/my-project/global/networks/my-vpc",
        },
    },
});
```

### cloud-sql-logging-enabled

**Severity:** high · **Enforcement:** advisory

Enable Cloud SQL logging for monitoring

- **AU.L2-3.3.1 Create and retain system audit logs** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Remediation

Enable database logging flags via databaseFlags. For PostgreSQL: set log_connections, log_disconnections, log_checkpoints to 'on'. For MySQL: enable general_log or slow_query_log.

Example Pulumi TypeScript:
```typescript
import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("db-with-logging", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        databaseFlags: [
            { name: "log_connections", value: "on" },
            { name: "log_disconnections", value: "on" },
            { name: "log_checkpoints", value: "on" },
        ],
    },
});
```

### cloud-sql-storage-encrypted

**Severity:** high · **Enforcement:** advisory

Ensure Cloud SQL storage is encrypted

- **MP.L2-3.8.9 Protect confidentiality of backup CUI** — Protect the confidentiality of backup CUI at storage locations.
- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

Configure customer-managed encryption keys (CMEK) by setting encryptionKeyName to a Cloud KMS key for enhanced security and key management control.

Example Pulumi TypeScript:
```typescript
import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    encryptionKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",
    settings: {
        tier: "db-f1-micro",
    },
});
```

### cloudfunctions-iam-no-public

**Severity:** high · **Enforcement:** advisory

Require Cloud Functions IAM bindings to not grant public access

- **AC.L1-3.1.22 Control CUI on publicly accessible systems** — Control CUI posted or processed on publicly accessible systems.

Remediation

##### Fix: Use Specific IAM Members

```typescript
const iamMember = new gcp.cloudfunctions.FunctionIamMember("my-function-invoker", {
    cloudFunction: myFunction.name,
    role: "roles/cloudfunctions.invoker",
    member: "serviceAccount:my-service@project.iam.gserviceaccount.com",
    // ... other config
});
```

### cloudfunctions-kms-env-vars

**Severity:** medium · **Enforcement:** advisory

Require Cloud Functions environment variables to be encrypted with Cloud KMS

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

##### Fix: Encrypt Environment Variables with KMS

```typescript
const func = new gcp.cloudfunctions.Function("my-function", {
    environmentVariables: {
        API_KEY: "sensitive-value",
        DATABASE_URL: "postgres://...",
    },
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Add KMS key for encryption
    // ... other config
});
```

### cloudsql-patching

**Severity:** medium · **Enforcement:** advisory

Require Cloud SQL instances to use managed service patching

- **CM.L2-3.4.2 Establish and enforce security configuration settings** — Establish and enforce security configuration settings for information technology products employed in organizational systems.
- **MA.L2-3.7.1 Perform system maintenance** — Perform maintenance on organizational systems.
- **RA.L2-3.11.3 Remediate vulnerabilities** — Remediate vulnerabilities in accordance with risk assessments.
- **SI.L1-3.14.1 Identify and correct system flaws** — Identify, report, and correct system flaws in a timely manner.

Remediation

##### Fix: Configure Maintenance Window for Automatic Patching

```typescript
const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        maintenanceWindow: {
            updateTrack: "stable",  // Use stable update track for patching
            day: 7,  // Saturday (1=Sunday, 7=Saturday)
            hour: 3,  // 3 AM
        },
        // ... other config
    },
});
```

### cloudsql-ssl

**Severity:** high · **Enforcement:** advisory

Require Cloud SQL connections to use SSL/TLS encryption

- **AC.L2-3.1.13 Employ cryptographic mechanisms for remote access** — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
- **SC.L2-3.13.8 Implement cryptographic mechanisms for transmission** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

Remediation

##### Fix: Require SSL/TLS for All Connections

```typescript
const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        ipConfiguration: {
            sslMode: "ENCRYPTED_ONLY",  // Require SSL/TLS for all connections
            // ... other config
        },
    },
});
```

### compute-engine-instance-not-publicly-accessible

**Severity:** high · **Enforcement:** advisory

Ensure Compute Engine instances are not publicly accessible

- **AC.L1-3.1.1 Limit system access to authorized users** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- **AC.L1-3.1.22 Control CUI on publicly accessible systems** — Control CUI posted or processed on publicly accessible systems.

Remediation

Remove accessConfigs from networkInterfaces to disable external IP assignment:

```typescript
new gcp.compute.Instance("my-instance", {
  networkInterfaces: [{
    network: "my-vpc",
    subnetwork: "my-subnet",
    // accessConfigs: [], // Remove or set to empty array
  }],
  canIpForward: false,
});
```

Use Cloud NAT or load balancers for controlled external access.

### compute-engine-instance-uses-os-login

**Severity:** high · **Enforcement:** advisory

Ensure Compute Engine instances enforce OS Login

- **IA.L1-3.5.2 Authenticate identities of users and devices** — Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

Remediation

Add metadata keys to enable OS Login:

```typescript
new gcp.compute.Instance("my-instance", {
  metadata: {
    "enable-oslogin": "TRUE",
    "block-project-ssh-keys": "TRUE",
    "enable-oslogin-2fa": "TRUE", // For production instances
  },
  // ... other config
});
```

This enables centralized SSH authentication via IAM.

### compute-instance-encrypted-boot-disk

**Severity:** medium · **Enforcement:** advisory

Require Compute Engine instances to have encrypted boot disks

- **MP.L2-3.8.1 Protect system media containing CUI** — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

##### Fix: Enable Boot Disk Encryption with CMEK

```typescript
const instance = new compute.Instance("my-instance", {
    bootDisk: {
        initializeParams: {
            image: "debian-cloud/debian-11",
        },
        kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use customer-managed encryption key
    },
    // ... other config
});
```

### compute-osconfig-vulnerability

**Severity:** medium · **Enforcement:** advisory

Require OS Config agent for vulnerability management on compute instances

- **RA.L2-3.11.2 Scan for vulnerabilities** — Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
- **SI.L1-3.14.1 Identify and correct system flaws** — Identify, report, and correct system flaws in a timely manner.
- **SI.L1-3.14.5 Perform periodic and real-time scans** — Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.

Remediation

##### Fix: Enable OS Config Agent

```typescript
const instance = new compute.Instance("my-instance", {
    metadata: {
        "enable-osconfig": "TRUE",  // Enable OS Config for vulnerability scanning
        "enable-guest-attributes": "TRUE",  // Enable guest attributes for older agent versions
    },
    // ... other config
});
```

### dataflow-kms

**Severity:** high · **Enforcement:** advisory

Require Dataflow jobs and pipelines to use customer-managed Cloud KMS keys

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

##### Fix: Configure KMS Encryption for Dataflow

```typescript
const job = new dataflow.Job("my-job", {
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use CMEK for data encryption
    // ... other config
});

// For Dataflow Pipeline
const pipeline = new dataflow.Pipeline("my-pipeline", {
    workload: {
        dataflowFlexTemplateRequest: {
            launchParameter: {
                environment: {
                    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use CMEK for data encryption
                },
            },
        },
    },
    // ... other config
});
```

### dataproc-cluster-master-nodes-no-public-ip

**Severity:** high · **Enforcement:** advisory

Restrict public access for Dataproc clusters by ensuring master nodes use internal IP addresses only

- **AC.L1-3.1.22 Control CUI on publicly accessible systems** — Control CUI posted or processed on publicly accessible systems.

Remediation

Set `clusterConfig.gceClusterConfig.internalIpOnly: true` for the Dataproc cluster. Enable Private Google Access on the VPC subnet. Use Cloud NAT or VPN/Interconnect for required external connectivity. Configure firewall rules for internal communication.

```typescript
import * as gcp from "@pulumi/gcp";

const privateDataprocCluster = new gcp.dataproc.Cluster("private-dataproc", {
    name: "private-dataproc-cluster",
    region: "us-central1",
    clusterConfig: {
        gceClusterConfig: {
            // Disable external IPs for all nodes including master
            internalIpOnly: true,
            network: "projects/my-project/global/networks/my-vpc",
            subnetwork: "projects/my-project/regions/us-central1/subnetworks/my-subnet",
            zone: "us-central1-a",
            // Optional: Configure service account with necessary permissions
            serviceAccount: "dataproc-sa@my-project.iam.gserviceaccount.com",
            serviceAccountScopes: [
                "https://www.googleapis.com/auth/cloud-platform",
            ],
        },
        masterConfig: {
            numInstances: 1,
            machineType: "n2-standard-4",
            diskConfig: {
                bootDiskSizeGb: 100,
                bootDiskType: "pd-standard",
            },
        },
        workerConfig: {
            numInstances: 2,
            machineType: "n2-standard-4",
        },
    },
});
```

### filestore-cmek

**Severity:** high · **Enforcement:** advisory

Ensure Cloud Filestore is encrypted

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

### firewall-explicit-target-scoping

**Severity:** high · **Enforcement:** advisory

Require firewall rules to specify explicit targets (targetTags, targetServiceAccounts, or destinationRanges)

- **AC.L2-3.1.3 Control the flow of CUI** — Control the flow of CUI in accordance with approved authorizations.
- **CM.L2-3.4.6 Employ principle of least functionality** — Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
- **CM.L2-3.4.7 Restrict nonessential programs and services** — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
- **SC.L1-3.13.1 Monitor and control communications at boundaries** — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- **SC.L2-3.13.6 Deny network traffic by default** — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Remediation

##### Fix: Specify Explicit Firewall Rule Targets

```typescript
const firewallRule = new gcp.compute.Firewall("scoped-firewall-rule", {
    network: network.id,
    direction: "INGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],
    }],
    sourceRanges: ["10.0.0.0/24"],
    targetTags: ["web-servers"],  // Specify explicit targets
    // ... other config
});
```

### firewall-no-http-ingress

**Severity:** critical · **Enforcement:** advisory

Require firewall rules to disallow inbound HTTP traffic from unauthorized sources

- **CM.L2-3.4.7 Restrict nonessential programs and services** — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

Remediation

##### Fix: Use HTTPS Instead of HTTP

```typescript
const firewallRule = new gcp.compute.Firewall("allow-https", {
    network: network.id,
    direction: "INGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],  // Use HTTPS (port 443) instead of HTTP (port 80)
    }],
    sourceRanges: ["0.0.0.0/0"],
    // ... other config
});
```

### firewall-no-public-ingress

**Severity:** critical · **Enforcement:** advisory

Require firewall rules to disallow public internet ingress unless specifically authorized

- **AC.L2-3.1.3 Control the flow of CUI** — Control the flow of CUI in accordance with approved authorizations.
- **CM.L2-3.4.6 Employ principle of least functionality** — Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
- **CM.L2-3.4.7 Restrict nonessential programs and services** — Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
- **SC.L1-3.13.1 Monitor and control communications at boundaries** — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- **SC.L2-3.13.6 Deny network traffic by default** — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Remediation

##### Fix: Use Private Network Ranges or Source Tags

```typescript
const firewallRule = new gcp.compute.Firewall("allow-private-ingress", {
    network: network.id,
    direction: "INGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],
    }],
    sourceRanges: ["10.0.0.0/8", "192.168.0.0/16"],  // Use private ranges instead of 0.0.0.0/0
    // Or use source tags for internal traffic control:
    // sourceTags: ["web-tier"],
    // ... other config
});
```

### firewall-no-unrestricted-egress

**Severity:** high · **Enforcement:** advisory

Prohibit EGRESS firewall rules that allow all ports to 0.0.0.0/0

- **AC.L2-3.1.3 Control the flow of CUI** — Control the flow of CUI in accordance with approved authorizations.
- **SC.L2-3.13.6 Deny network traffic by default** — Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Remediation

##### Fix: Restrict EGRESS Firewall Rules to Explicit Ports and Destinations

```typescript
const egressRule = new gcp.compute.Firewall("restricted-egress-rule", {
    network: network.id,
    direction: "EGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],  // Specify explicit ports, not all ports
    }],
    destinationRanges: ["10.0.0.0/24"],  // Prefer explicit destinations over 0.0.0.0/0
    // ... other config
});
```

### gke-private-endpoint

**Severity:** high · **Enforcement:** advisory

Restrict public access for GKE clusters by enabling private endpoint or configuring master authorized networks

- **AC.L1-3.1.22 Control CUI on publicly accessible systems** — Control CUI posted or processed on publicly accessible systems.

Remediation

Enable private endpoint by setting `privateClusterConfig.enablePrivateEndpoint: true`, or configure `masterAuthorizedNetworksConfig.cidrBlocks` with specific IP ranges (avoid 0.0.0.0/0).

### gke-secrets-encryption

**Severity:** high · **Enforcement:** advisory

Require GKE clusters to have Application-layer Secrets Encryption enabled

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

##### Fix: Enable Application-layer Secrets Encryption

```typescript
const cluster = new gcp.container.Cluster("my-cluster", {
    databaseEncryption: {
        state: "ENCRYPTED",  // Enable secrets encryption
        keyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Specify KMS key
    },
    // ... other config
});
```

### iam-no-broad-roles

**Severity:** critical · **Enforcement:** advisory

Prohibit overly broad IAM roles on projects, organizations, folders, and service accounts

- **AC.L1-3.1.1 Limit system access to authorized users** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- **AC.L1-3.1.2 Limit system access to authorized transaction types** — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- **AC.L2-3.1.4 Separate the duties of individuals** — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- **AC.L2-3.1.5 Employ the principle of least privilege** — Employ the principle of least privilege, including for specific security functions and privileged accounts.
- **AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions** — Use non-privileged accounts or roles when accessing nonsecurity functions.
- **AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions** — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
- **AC.L2-3.1.15 Authorize remote execution of privileged commands** — Authorize remote execution of privileged commands and remote access to security-relevant information.
- **AU.L2-3.3.9 Limit audit logging management to privileged users** — Limit management of audit logging functionality to a subset of privileged users.
- **CM.L2-3.4.5 Define access restrictions for system changes** — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
- **MA.L2-3.7.2 Provide controls on maintenance tools and personnel** — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

Remediation

##### Fix: Use Specific Least-Privilege Roles

```typescript
const binding = new gcp.projects.IAMBinding("service-binding", {
    project: "my-project",
    role: "roles/storage.objectViewer",
    members: ["serviceAccount:my-app@my-project.iam.gserviceaccount.com"],
});
```

Replace broad roles such as `roles/owner` or `roles/editor` with the most
specific role that grants only the permissions needed.

### iam-no-custom-role-excessive-permissions

**Severity:** high · **Enforcement:** advisory

Prevent IAM custom roles with excessive permissions for enhanced data access control.

- **AC.L1-3.1.1 Limit system access to authorized users** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- **AC.L1-3.1.2 Limit system access to authorized transaction types** — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- **AC.L2-3.1.4 Separate the duties of individuals** — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- **AC.L2-3.1.5 Employ the principle of least privilege** — Employ the principle of least privilege, including for specific security functions and privileged accounts.
- **AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions** — Use non-privileged accounts or roles when accessing nonsecurity functions.
- **AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions** — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
- **AC.L2-3.1.15 Authorize remote execution of privileged commands** — Authorize remote execution of privileged commands and remote access to security-relevant information.
- **CM.L2-3.4.5 Define access restrictions for system changes** — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
- **MA.L2-3.7.2 Provide controls on maintenance tools and personnel** — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

Remediation

Review and refine custom role permissions. Remove excessive administrative permissions like setIamPolicy, admin-level permissions, and owner permissions. Follow the principle of least privilege by granting only the minimum permissions required for the role's intended purpose. Consider breaking up roles with too many permissions.

Example - Create custom role with limited permissions:
```typescript
import * as gcp from "@pulumi/gcp";

const role = new gcp.projects.IAMCustomRole("limited-role", {
    roleId: "limitedViewer",
    title: "Limited Viewer",
    permissions: [
        "compute.instances.get",
        "compute.instances.list",
    ],
});
```

### iam-policy-no-statements-with-admin-access

**Severity:** critical · **Enforcement:** advisory

Prevent IAM policy bindings with administrative access permissions for secure configuration.

- **AC.L1-3.1.1 Limit system access to authorized users** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- **AC.L1-3.1.2 Limit system access to authorized transaction types** — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- **AC.L2-3.1.4 Separate the duties of individuals** — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- **AC.L2-3.1.5 Employ the principle of least privilege** — Employ the principle of least privilege, including for specific security functions and privileged accounts.
- **AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions** — Use non-privileged accounts or roles when accessing nonsecurity functions.
- **AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions** — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
- **AC.L2-3.1.15 Authorize remote execution of privileged commands** — Authorize remote execution of privileged commands and remote access to security-relevant information.
- **AU.L2-3.3.9 Limit audit logging management to privileged users** — Limit management of audit logging functionality to a subset of privileged users.
- **CM.L2-3.4.5 Define access restrictions for system changes** — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
- **MA.L2-3.7.2 Provide controls on maintenance tools and personnel** — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

Remediation

Review and refine IAM policy bindings. Replace service-specific administrative roles like 'roles/compute.admin', 'roles/storage.admin', 'roles/bigquery.admin' with specific, granular roles. Use predefined roles with minimal permissions required for the task. Follow the principle of least privilege by granting only necessary permissions for operations, not administrative control over entire services.

Example - Replace admin role with specific permissions:
```typescript
import * as gcp from "@pulumi/gcp";

// Instead of roles/compute.admin, use specific roles
const binding = new gcp.projects.IAMMember("compute-viewer", {
    project: "my-project",
    role: "roles/compute.viewer",
    member: "serviceAccount:sa@project.iam.gserviceaccount.com",
});
```

### iam-policy-no-wildcard-permissions

**Severity:** critical · **Enforcement:** advisory

Prevent IAM custom roles with wildcard permissions to enforce least privilege access control.

- **AC.L1-3.1.1 Limit system access to authorized users** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- **AC.L1-3.1.2 Limit system access to authorized transaction types** — Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- **AC.L2-3.1.4 Separate the duties of individuals** — Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- **AC.L2-3.1.5 Employ the principle of least privilege** — Employ the principle of least privilege, including for specific security functions and privileged accounts.
- **AC.L2-3.1.6 Use non-privileged accounts for nonsecurity functions** — Use non-privileged accounts or roles when accessing nonsecurity functions.
- **AC.L2-3.1.7 Prevent non-privileged users from executing privileged functions** — Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
- **AC.L2-3.1.15 Authorize remote execution of privileged commands** — Authorize remote execution of privileged commands and remote access to security-relevant information.
- **AU.L2-3.3.9 Limit audit logging management to privileged users** — Limit management of audit logging functionality to a subset of privileged users.
- **CM.L2-3.4.5 Define access restrictions for system changes** — Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
- **MA.L2-3.7.2 Provide controls on maintenance tools and personnel** — Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

Remediation

Review and refine custom IAM roles. Remove wildcard (*) permissions and replace them with specific, granular permissions. Instead of using 'compute.*' or 'storage.*', explicitly list the required permissions such as 'compute.instances.get', 'compute.instances.list', 'storage.buckets.get', etc. Follow the principle of least privilege by granting only the exact permissions needed for the role's intended purpose.

Example - Create custom role with specific permissions:
```typescript
import * as gcp from "@pulumi/gcp";

const customRole = new gcp.organizations.IAMCustomRole("custom-role", {
    roleId: "computeViewer",
    orgId: "123456789",
    title: "Compute Viewer",
    permissions: [
        "compute.instances.get",
        "compute.instances.list",
    ],
});
```

### instance-template-disk-cmek

**Severity:** high · **Enforcement:** advisory

Require instance template disks to have customer-managed (CMEK) or customer-supplied (CSEK) encryption keys

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

##### Fix: Configure CMEK or CSEK Disk Encryption

```typescript
const template = new gcp.compute.InstanceTemplate("my-template", {
    disks: [{
        boot: true,
        sourceImage: "debian-cloud/debian-11",
        diskEncryptionKey: {
            kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key",
        },
    }],
});
```

### kms-key-configuration

**Severity:** low · **Enforcement:** advisory

Require proper Cloud KMS key creation and configuration

- **SC.L2-3.13.10 Establish and manage cryptographic keys** — Establish and manage cryptographic keys for cryptography employed in organizational systems.
- **SC.L2-3.13.11 Employ FIPS-validated cryptography** — Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

Remediation

##### Fix: Configure KMS Key with Version Template

```typescript
const cryptoKey = new gcp.kms.CryptoKey("my-crypto-key", {
    name: "my-key",
    keyRing: keyRing.id,
    versionTemplate: {
        algorithm: "GOOGLE_SYMMETRIC_ENCRYPTION",  // Specify cryptographic algorithm
        protectionLevel: "HSM",  // Set protection level (SOFTWARE, HSM, EXTERNAL, EXTERNAL_VPC)
    },
    rotationPeriod: "7776000s",  // Optional: Configure 90-day rotation period
    purpose: "ENCRYPT_DECRYPT",  // Optional: Explicitly set key purpose
    // ... other config
});
```

### kms-key-iam

**Severity:** high · **Enforcement:** advisory

Require proper access controls for Cloud KMS key IAM policies

- **AC.L2-3.1.5 Employ the principle of least privilege** — Employ the principle of least privilege, including for specific security functions and privileged accounts.

Remediation

##### Fix: Use Least-Privilege IAM Roles

```typescript
// Use specific roles instead of overprivileged roles
const cryptoKeyBinding = new gcp.kms.CryptoKeyIAMBinding("key-access", {
    cryptoKeyId: cryptoKey.id,
    role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",  // Use specific role
    members: [
        "serviceAccount:my-service@project.iam.gserviceaccount.com",  // Use specific service accounts
        "group:security-team@example.com",  // Or specific groups
    ],
    // Avoid: roles/owner, roles/editor, roles/cloudkms.admin
    // Avoid: allUsers, allAuthenticatedUsers, domain-wide access
    // ... other config
});
```

### kms-key-lifecycle

**Severity:** low · **Enforcement:** advisory

Require proper Cloud KMS key deletion and lifecycle management

- **SC.L2-3.13.10 Establish and manage cryptographic keys** — Establish and manage cryptographic keys for cryptography employed in organizational systems.

Remediation

##### Fix: Configure Key Lifecycle Management

```typescript
const cryptoKey = new kms.CryptoKey("my-crypto-key", {
    name: "my-key",
    keyRing: keyRing.id,
    destroyScheduledDuration: "2592000s",  // Set 30-day scheduled destruction period
    skipInitialVersionCreation: false,  // Create initial key version
    versionTemplate: {
        algorithm: "GOOGLE_SYMMETRIC_ENCRYPTION",
        protectionLevel: "SOFTWARE",
    },
    // ... other config
});
```

### kms-key-rotation

**Severity:** high · **Enforcement:** advisory

Ensure Cloud KMS key rotation is enabled

- **SC.L2-3.13.10 Establish and manage cryptographic keys** — Establish and manage cryptographic keys for cryptography employed in organizational systems.

Remediation

Enable automatic key rotation for Cloud KMS crypto keys by setting 'rotationPeriod'. Key rotation limits the lifetime of encryption keys and reduces cryptographic risk.

Example - Enable automatic key rotation:
```typescript
import * as gcp from "@pulumi/gcp";

const key = new gcp.kms.CryptoKey("my-key", {
    name: "crypto-key",
    keyRing: "projects/my-project/locations/us-central1/keyRings/my-ring",
    rotationPeriod: "7776000s", // 90 days (configurable)
});
```

Periods this policy accepts out of the box: `2592000s` (30 days), `5184000s` (60 days) and
`7776000s` (90 days, the `maxRotationPeriod` default). Anything longer needs
`maxRotationPeriod` raised to match, or it is reported again.

### lb-cloud-armor-attached

**Severity:** high · **Enforcement:** advisory

Ensures external backend services have Cloud Armor security policy attached

- **SC.L1-3.13.1 Monitor and control communications at boundaries** — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

Remediation

Attach a Cloud Armor security policy to external backend services using the securityPolicy property for DDoS protection and threat detection.

### load-balancer-logging-enabled

**Severity:** high · **Enforcement:** advisory

Enable Load Balancer logging for monitoring

- **AU.L2-3.3.1 Create and retain system audit logs** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Remediation

Enable logging on backend services by configuring `logConfig.enable: true` and set `logConfig.sampleRate` (1.0 for full logging, lower values for sampling). Ensure logs are retained in Cloud Logging for security analysis and troubleshooting.

**Pulumi TypeScript Example:**

```typescript
import * as gcp from "@pulumi/gcp";

// For global backend service
const backendService = new gcp.compute.BackendService("my-backend", {
    logConfig: {
        enable: true,
        sampleRate: 1.0  // 1.0 = 100% logging, 0.5 = 50% sampling
    },
    // ... other configuration
});

// For regional backend service
const regionBackendService = new gcp.compute.RegionBackendService("my-region-backend", {
    logConfig: {
        enable: true,
        sampleRate: 1.0
    },
    // ... other configuration
});
```

### load-balancer-tls-https-listeners-only

**Severity:** high · **Enforcement:** advisory

Ensure Load Balancer uses TLS/HTTPS listeners only

- **AC.L2-3.1.13 Employ cryptographic mechanisms for remote access** — Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
- **SC.L2-3.13.8 Implement cryptographic mechanisms for transmission** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- **SC.L2-3.13.15 Protect authenticity of communications sessions** — Protect the authenticity of communications sessions.

Remediation

Configure forwarding rules to use port 443 for HTTPS traffic. Use `TargetHttpsProxy` instead of `TargetHttpProxy`. For HTTP listeners, ensure they redirect to HTTPS via URL map configuration. Remove standalone HTTP listeners without HTTPS redirection.

**Pulumi TypeScript Example:**

```typescript
import * as gcp from "@pulumi/gcp";

// Create SSL certificate (or use existing)
const sslCert = new gcp.compute.ManagedSslCertificate("my-cert", {
    managed: {
        domains: ["example.com"]
    }
});

// Create HTTPS target proxy
const httpsProxy = new gcp.compute.TargetHttpsProxy("https-proxy", {
    urlMap: urlMap.id,
    sslCertificates: [sslCert.id]
});

// Create forwarding rule on port 443
const httpsForwardingRule = new gcp.compute.GlobalForwardingRule("https-rule", {
    target: httpsProxy.id,
    portRange: "443",
    ipProtocol: "TCP",
    loadBalancingScheme: "EXTERNAL"
});

// Optional: HTTP to HTTPS redirect
const httpProxy = new gcp.compute.TargetHttpProxy("http-proxy", {
    urlMap: redirectUrlMap.id  // URL map configured for redirect
});

const httpForwardingRule = new gcp.compute.GlobalForwardingRule("http-rule", {
    target: httpProxy.id,
    portRange: "80",
    ipProtocol: "TCP",
    loadBalancingScheme: "EXTERNAL"
});
```

### managed-instance-group-launch-template-public-ip-disabled

**Severity:** high · **Enforcement:** advisory

Ensure Managed Instance Group launch templates have public IP addresses disabled

- **AC.L1-3.1.1 Limit system access to authorized users** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- **AC.L1-3.1.22 Control CUI on publicly accessible systems** — Control CUI posted or processed on publicly accessible systems.

Remediation

Disable public IP in instance template:

```typescript
new gcp.compute.InstanceTemplate("my-template", {
  networkInterfaces: [{
    network: "my-vpc",
    subnetwork: "my-subnet",
    accessConfigs: [], // Empty array disables public IP
  }],
  // ... other config
});
```

This prevents unintended public accessibility.

### os-config-patch-coverage

**Severity:** high · **Enforcement:** advisory

Ensure Compute Engine instances are covered by OS Config patch management

- **CM.L2-3.4.2 Establish and enforce security configuration settings** — Establish and enforce security configuration settings for information technology products employed in organizational systems.
- **MA.L2-3.7.1 Perform system maintenance** — Perform maintenance on organizational systems.
- **RA.L2-3.11.3 Remediate vulnerabilities** — Remediate vulnerabilities in accordance with risk assessments.
- **SI.L1-3.14.1 Identify and correct system flaws** — Identify, report, and correct system flaws in a timely manner.

Remediation

Enable OS Config on instances by setting metadata 'enable-osconfig: TRUE'. Create patch deployment policies so instances receive automated patch management.

Example Pulumi TypeScript:
```typescript
import * as gcp from "@pulumi/gcp";

const instance = new gcp.compute.Instance("managed-instance", {
    // ... other config
    metadata: {
        "enable-osconfig": "TRUE",
    },
});

const patchDeployment = new gcp.osconfig.PatchDeployment("weekly-patch", {
    patchDeploymentId: "weekly-patches",
    instanceFilter: {
        all: true,
    },
    recurringSchedule: {
        timeZone: { id: "UTC" },
        weekly: { dayOfWeek: "SUNDAY" },
    },
    patchConfig: {
        rebootConfig: "DEFAULT",
    },
});
```

### persistent-disk-cmek

**Severity:** high · **Enforcement:** advisory

Ensures persistent disks have customer-managed (CMEK) or customer-supplied (CSEK) encryption keys

- **MP.L2-3.8.1 Protect system media containing CUI** — Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

Configure diskEncryptionKey with either kmsKeySelfLink (CMEK), rawKey, or rsaEncryptedKey (CSEK).

### private-service-connect

**Severity:** high · **Enforcement:** advisory

Require Private Service Connect endpoints to have restrictive security policies

- **SC.L2-3.13.2 Employ architectural designs promoting security** — Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

Remediation

##### Fix: Configure Secure Private Service Connect

```typescript
// Create Service Attachment with manual connection approval
const serviceAttachment = new gcp.compute.ServiceAttachment("psc-service", {
    connectionPreference: "ACCEPT_MANUAL",  // Require manual approval for connections
    consumerAcceptLists: [{
        projectIdOrNum: "consumer-project-123",
        connectionLimit: 10,  // Limit connections to minimize attack surface
    }],
    targetService: backendService.id,
    // ... other config
});

// Create Forwarding Rule for PSC with internal load balancing
const forwardingRule = new gcp.compute.ForwardingRule("psc-endpoint", {
    network: network.id,  // Specify network for proper isolation
    loadBalancingScheme: "INTERNAL",  // Use internal scheme for private connectivity
    target: serviceAttachment.id,
    // ... other config
});
```

### pubsub-encrypted-kms

**Severity:** medium · **Enforcement:** advisory

Ensure Pub/Sub is encrypted with Cloud KMS

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

Configure kmsKeyName property when creating Pub/Sub topics to use customer-managed encryption keys (CMEK) for enhanced security and key management control.

Example - Pub/Sub Topic with Customer-Managed Encryption:
```typescript
import * as gcp from "@pulumi/gcp";

// Create KMS KeyRing and CryptoKey for encryption
const keyRing = new gcp.kms.KeyRing("pubsub-keyring", {
    name: "pubsub-keyring",
    location: "us-central1"
});

const cryptoKey = new gcp.kms.CryptoKey("pubsub-key", {
    name: "pubsub-encryption-key",
    keyRing: keyRing.id,
    rotationPeriod: "7776000s"  // 90 days
});

// Grant Pub/Sub service account access to the key
const binding = new gcp.kms.CryptoKeyIAMBinding("pubsub-key-binding", {
    cryptoKeyId: cryptoKey.id,
    role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
    members: ["serviceAccount:service-PROJECT_NUMBER@gcp-sa-pubsub.iam.gserviceaccount.com"]
});

// COMPLIANT: Topic with customer-managed encryption key
const topicCompliant = new gcp.pubsub.Topic("encrypted-topic", {
    name: "secure-topic",
    kmsKeyName: cryptoKey.id,  // Compliant: CMEK configured
    messageRetentionDuration: "86400s"
});

// NON-COMPLIANT: Topic without CMEK (uses Google-managed keys)
const topicNonCompliant = new gcp.pubsub.Topic("default-topic", {
    name: "insecure-topic"
    // Missing kmsKeyName - uses default Google-managed encryption
});
```

### pubsub-subscription-iam-least-privilege

**Severity:** high · **Enforcement:** advisory

Enforce least privilege IAM policies for Pub/Sub subscriptions

- **AC.L2-3.1.5 Employ the principle of least privilege** — Employ the principle of least privilege, including for specific security functions and privileged accounts.

Remediation

##### Fix: Use Least Privilege IAM Roles

```typescript
const subscriptionIamBinding = new gcp.pubsub.SubscriptionIAMBinding("subscription-subscriber-binding", {
    subscription: subscription.id,
    role: "roles/pubsub.subscriber",  // Use specific role instead of admin/owner/editor
    members: [
        "serviceAccount:app-service@project.iam.gserviceaccount.com",  // Use specific service accounts instead of allUsers
    ],
});
```

### pubsub-topic-iam-least-privilege

**Severity:** high · **Enforcement:** advisory

Enforce least privilege IAM policies for Pub/Sub topics

- **AC.L2-3.1.5 Employ the principle of least privilege** — Employ the principle of least privilege, including for specific security functions and privileged accounts.

Remediation

##### Fix: Use Least Privilege IAM Roles

```typescript
const topicIamBinding = new gcp.pubsub.TopicIAMBinding("topic-publisher-binding", {
    topic: topic.id,
    role: "roles/pubsub.publisher",  // Use specific role instead of admin/owner/editor
    members: [
        "serviceAccount:app-service@project.iam.gserviceaccount.com",  // Use specific service accounts instead of allUsers
    ],
});
```

### resource-labeling

**Severity:** low · **Enforcement:** advisory

Require all GCP resources to have proper labeling for change tracking

- **MP.L2-3.8.4 Mark media with CUI markings** — Mark media with necessary CUI markings and distribution limitations.

Remediation

##### Fix: Add Required Labels for Change Tracking

Add the required labels (environment, team, owner) to your GCP resources:

```typescript
const instance = new gcp.compute.Instance("my-instance", {
    labels: {
        environment: "production",  // Required: environment label
        team: "platform",           // Required: team label
        owner: "john-doe",          // Required: owner label
        // ... other labels
    },
    // ... other config
});

// For Cloud SQL instances, use userLabels within settings
const sqlInstance = new gcp.sql.DatabaseInstance("my-database", {
    settings: {
        userLabels: {
            environment: "production",  // Required: environment label
            team: "data",               // Required: team label
            owner: "jane-smith",        // Required: owner label
        },
        // ... other settings
    },
    // ... other config
});

// For GKE clusters, use resourceLabels
const cluster = new gcp.container.Cluster("my-cluster", {
    resourceLabels: {
        environment: "production",  // Required: environment label
        team: "infrastructure",     // Required: team label
        owner: "ops-team",          // Required: owner label
    },
    // ... other config
});
```

### secretmanager-secret-cmek

**Severity:** high · **Enforcement:** advisory

Require Secret Manager secrets to use customer-managed Cloud KMS keys

- **SC.L2-3.13.16 Protect confidentiality of CUI at rest** — Protect the confidentiality of CUI at rest.

Remediation

##### Fix: Configure Customer-Managed KMS Encryption

```typescript
import * as gcp from "@pulumi/gcp";

// Create a KMS KeyRing and CryptoKey
const keyRing = new gcp.kms.KeyRing("my-keyring", {
    name: "secret-keyring",
    location: "us-central1",
});

const cryptoKey = new gcp.kms.CryptoKey("my-key", {
    name: "secret-encryption-key",
    keyRing: keyRing.id,
    rotationPeriod: "7776000s",  // 90 days
});

// Option 1: Auto-replication with customer-managed encryption
const secretAuto = new gcp.secretmanager.Secret("my-secret-auto", {
    secretId: "my-cmek-secret",
    replication: {
        auto: {
            customerManagedEncryption: {
                kmsKeyName: cryptoKey.id,  // Use customer-managed KMS key
            },
        },
    },
});

// Option 2: User-managed replication with customer-managed encryption
const secretUserManaged = new gcp.secretmanager.Secret("my-secret-user", {
    secretId: "my-cmek-secret-regional",
    replication: {
        userManaged: {
            replicas: [
                {
                    location: "us-central1",
                    customerManagedEncryption: {
                        kmsKeyName: cryptoKey.id,  // Use customer-managed KMS key
                    },
                },
                {
                    location: "us-east1",
                    customerManagedEncryption: {
                        kmsKeyName: cryptoKey.id,  // Specify for each replica
                    },
                },
            ],
        },
    },
});
```

### securitypolicy-has-custom-rules

**Severity:** high · **Enforcement:** advisory

Ensures Cloud Armor security policies have custom protection rules

- **SC.L1-3.13.1 Monitor and control communications at boundaries** — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

Remediation

Add custom protection rules to the Cloud Armor security policy for DDoS protection, SQL injection prevention, XSS protection, or other security policies.

### subnet-private-google-access

**Severity:** medium · **Enforcement:** advisory

Ensure Private Google Access is enabled on VPC subnets

- **SC.L2-3.13.2 Employ architectural designs promoting security** — Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

Remediation

Enable Private Google Access on subnets by setting `privateIpGoogleAccess: true`. This allows instances without external IP addresses to access Google APIs and services. Use Cloud NAT for internet access without public IPs.

**Pulumi TypeScript Example:**

```typescript
import * as gcp from "@pulumi/gcp";

// Enable Private Google Access on subnet
const subnet = new gcp.compute.Subnetwork("my-subnet", {
    ipCidrRange: "10.0.0.0/24",
    network: network.id,
    region: "us-central1",
    privateIpGoogleAccess: true  // Allow instances without external IPs to access Google APIs
});

// Optional: Create Cloud NAT for outbound internet access
const router = new gcp.compute.Router("my-router", {
    network: network.id,
    region: "us-central1"
});

const nat = new gcp.compute.RouterNat("my-nat", {
    router: router.name,
    region: router.region,
    natIpAllocateOption: "AUTO_ONLY",
    sourceSubnetworkIpRangesToNat: "ALL_SUBNETWORKS_ALL_IP_RANGES"
});
```

### vpc-flow-logs-enabled

**Severity:** high · **Enforcement:** advisory

Ensure VPC subnets have Flow Logs enabled for audit and monitoring

- **AC.L2-3.1.3 Control the flow of CUI** — Control the flow of CUI in accordance with approved authorizations.
- **AC.L2-3.1.12 Monitor and control remote access sessions** — Monitor and control remote access sessions.
- **AU.L2-3.3.1 Create and retain system audit logs** — Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
- **SC.L1-3.13.1 Monitor and control communications at boundaries** — Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- **SI.L2-3.14.6 Monitor systems to detect attacks** — Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

Remediation

Enable VPC Flow Logs on subnets by configuring `logConfig` with `aggregationInterval` (e.g., INTERVAL_5_SEC) and `flowSampling` (0.5 for 50% or 1.0 for 100%). Ensure `flowSampling` is greater than 0 to collect traffic logs.

**Pulumi TypeScript Example:**

```typescript
import * as gcp from "@pulumi/gcp";

const subnet = new gcp.compute.Subnetwork("my-subnet", {
    ipCidrRange: "10.0.0.0/24",
    network: network.id,
    region: "us-central1",
    logConfig: {
        aggregationInterval: "INTERVAL_5_SEC",  // or INTERVAL_30_SEC, INTERVAL_1_MIN, etc.
        flowSampling: 1.0,  // 1.0 = 100% sampling, 0.5 = 50%
        metadata: "INCLUDE_ALL_METADATA"
    },
    privateIpGoogleAccess: true
});
```

Valid `aggregationInterval` values: INTERVAL_5_SEC, INTERVAL_30_SEC, INTERVAL_1_MIN, INTERVAL_5_MIN, INTERVAL_10_MIN, INTERVAL_15_MIN