GCP Security Checks

79+ GCP Security Checks

Complete list of Google Cloud Platform security checks across 8+ services based on CIS GCP Benchmark v1.3.0, PCI-DSS v4.0, ISO 27001:2022, SOC 2, and 10+ compliance frameworks.

Start GCP Scan GCP CSPM Overview

79+

Security Checks

8+

GCP Services

10+

Compliance Frameworks

v1.3.0

CIS Benchmark

Security Checks by GCP Service

Comprehensive security checks organized by Google Cloud service. Click any check for detailed remediation guidance.

Google Cloud IAM

12 checks

Ensure service account keys are rotated within 90 days

Ensure user-managed service account keys are not used

Ensure primitive roles (Owner, Editor, Viewer) are not used

Ensure service accounts do not have admin privileges

CIS 1.7critical

Ensure MFA is enforced for all users

CIS 1.1critical

Ensure corporate login credentials are used

Ensure Security Key enforcement is enabled for admin users

Ensure API keys are restricted to specific APIs

Ensure API keys are restricted by IP addresses or referrers

Ensure API keys are rotated regularly

Ensure separation of duties for service accounts

Ensure no service account has impersonation permissions

Google Cloud Storage

10 checks

Ensure GCS buckets are not publicly accessible

CIS 5.1critical

Ensure uniform bucket-level access is enabled

Ensure GCS bucket encryption uses CMEK

Ensure GCS bucket logging is enabled

Ensure GCS bucket versioning is enabled

Ensure GCS bucket lifecycle policies are configured

Ensure GCS bucket retention policy is locked

Ensure GCS bucket is not using legacy bucket ACLs

Ensure signed URLs have short expiration times

Ensure GCS bucket does not allow public list operations

Google Compute Engine

10 checks

Ensure instances do not have public IP addresses

Ensure Shielded VM is enabled

Ensure OS Login is enabled

Ensure serial port access is disabled

Ensure IP forwarding is disabled on instances

Ensure disk encryption uses CMEK

Ensure default service account is not used

Ensure full access scopes are not used on instances

Ensure block project-wide SSH keys is enabled

Ensure Confidential Computing is enabled for sensitive workloads

Google Cloud VPC

10 checks

Ensure default VPC network is not used

Ensure legacy networks do not exist

Ensure firewall rules do not allow unrestricted SSH access

CIS 3.6critical

Ensure firewall rules do not allow unrestricted RDP access

CIS 3.7critical

Ensure VPC flow logs are enabled

Ensure Private Google Access is enabled for subnets

Ensure firewall rules do not allow all egress traffic

Ensure DNSSEC is enabled for Cloud DNS zones

Ensure Cloud NAT is used for private instances

Ensure firewall rules are logged

Google Kubernetes Engine

12 checks

Ensure GKE cluster uses private nodes

Ensure GKE cluster uses private endpoint

Ensure master authorized networks are configured

Ensure Workload Identity is enabled

Ensure GKE node auto-upgrade is enabled

CIS 5.5.3medium

Ensure GKE node auto-repair is enabled

CIS 5.5.4medium

Ensure GKE cluster uses Container-Optimized OS

CIS 5.5.1medium

Ensure Network Policies are enabled

Ensure Pod Security Standards are enforced

Ensure Binary Authorization is enabled

Ensure Shielded GKE nodes are enabled

CIS 5.5.5medium

Ensure GKE release channel is configured

CIS 5.5.2medium

Google Cloud SQL

10 checks

Ensure Cloud SQL instances are not publicly accessible

CIS 6.5critical

Ensure Cloud SQL database instances require SSL

Ensure Cloud SQL database instances have backups configured

Ensure Cloud SQL uses CMEK encryption

Ensure Cloud SQL instances have authorized networks configured

Ensure Cloud SQL has point-in-time recovery enabled

Ensure Cloud SQL instances have high availability configured

Ensure Cloud SQL local_infile database flag is off for MySQL

Ensure Cloud SQL log_checkpoints database flag is on for PostgreSQL

CIS 6.2.1medium

Ensure Cloud SQL log_connections database flag is on for PostgreSQL

CIS 6.2.2medium

Google Cloud KMS

7 checks

Ensure KMS cryptokeys are not anonymously accessible

CIS 1.11critical

Ensure KMS key rotation is enabled

Ensure separation of duties for KMS admin and key user roles

Ensure KMS keys are in supported regions

Ensure KMS key destruction is protected

Ensure HSM protection is used for sensitive keys

Ensure External Key Manager is configured for bring-your-own-key scenarios

Google Cloud Logging

8 checks

Ensure Cloud Audit Logging is enabled for all services

Ensure log bucket retention is configured

Ensure log sinks are configured to export logs

Ensure log metric filters and alerts are configured

Ensure alert for VPC network changes is configured

Ensure alert for Cloud Storage IAM changes is configured

Ensure alert for SQL instance configuration changes is configured

Ensure logs are not publicly accessible

Supported Compliance Frameworks

Every check is mapped to relevant compliance framework controls

CIS GCP v1.3.0

CIS GCP v1.2.0

CIS GCP v2.0

PCI-DSS v4.0

SOC 2 Type II

ISO 27001:2022

HIPAA

NIST 800-53

GDPR

ENS RD2022

Run All 79+ GCP Security Checks

Get a comprehensive GCP security assessment in minutes. See all misconfigurations and compliance gaps.

Start GCP Scan Schedule Demo

No credit card required • Free tier available • 14-day trial