CodeAnt AI home pagelight logodark logo
  • Support
  • Dashboard
  • Dashboard
Documentation
API Reference
Start Here
  • What is CodeAnt?
  • Join Community
Setup
  • Github
  • GitHub Enterprise
  • Bitbucket
  • Gitlab
  • Azure Devops
Pull Request Review
  • Features
  • Customize Review
  • Quality Gates
  • Integrations
Scan center
  • Code Security
  • Code Quality
  • Cloud Security
  • Engineering Productivity
Integrations
  • Jira
  • Test Coverage
  • Quality gates
  • Automated scans
IDE
  • Setup
  • Review
  • Enhancements
Rule Reference
  • Compliance
  • Anti-Patterns
  • Code Governance
  • Infrastructure Security Database
  • Application Security Database
    • Apex
    • Bash
    • C
    • Clojure
    • Cpp
    • Csharp
    • Dockerfile
    • Elixir
    • Fingerprints
    • Generic
    • Go
    • Html
    • Java
    • Javascript
    • Json
    • Kotlin
    • Ocaml
    • Php
    • Problem-based-packs
    • Python
    • Ruby
    • Rust
    • Scala
    • Solidity
    • Swift
    • Terraform
      • Aws
      • Azure
      • Gcp
        • Best practice
        • Security
      • Lang
    • Typescript
    • Yaml
Resources
  • Open Source
  • Blogs
Gcp

Security

gcp-sql-public-database

Ensure that Cloud SQL database Instances are not open to the world
Likelihood: MEDIUM
Confidence: MEDIUM
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-client-certificate-disabled

Ensure client certificate authentication to Kubernetes Engine Clusters is disabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-folder-member-default-service-account-iam-member

Ensure Default Service account is not used at a folder level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-enabled-vpc-flow-logs

Enable VPC Flow Logs and Intranode Visibility
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-serial-ports

Ensure ‘Enable connecting to serial ports’ is not enabled for VM Instance
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-org-member-default-service-account-iam-binding

Ensure default service account is not used at an organization level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-sub-network-private-google-enabled

Ensure that private_ip_google_access is enabled for Subnet
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-project-member-default-service-account-iam-binding

Ensure Default Service account is not used at a project level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-vertexai-private-instance

Ensure Vertex AI instances are private
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-insecure-load-balancer-tls-version

Detected GCP Load Balancer to be using an insecure version of TLS. To fix this set your “min_tls_version” to “TLS_1_2”
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures

gcp-gke-pod-security-policy-enabled

Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-bigtable-instance-encrypted-with-cmk

Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-bigquery-dataset-encrypted-with-cmk

Ensure that BigQuery datasets are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-dataproc-cluster-public-ip

Ensure Dataproc Clusters do not have public IPs
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-memory-store-for-redis-intransit-encryption

Ensure Memorystore for Redis uses intransit encryption
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-folder-member-default-service-account-iam-binding

Ensure Default Service account is not used at a folder level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-dataflow-job-encrypted-with-cmk

Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-gke-cluster-logging

Ensure logging is set to Enabled on Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-gke-legacy-instance-metadata-disabled

Ensure legacy Compute Engine instance metadata APIs are Disabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-bigquery-table-encrypted-with-cmk

Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-bigquery-private-table-iam-member

Ensure that BigQuery Tables are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-public-control-plane

Ensure GKE Control Plane is not public
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-nodepool-integrity-monitoring

Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-storage-bucket-uniform-access

Ensure that Cloud Storage buckets have uniform bucket-level access enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-pubsub-private-topic-iam-member

Ensure that Pub/Sub Topics are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-boot-disk-encryption

Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-311: Missing Encryption of Sensitive Data
OWASP:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design

gcp-kms-prevent-destroy

Ensure KMS keys are protected from deletion
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-legacy-auth-enabled

Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-os-login

Ensure that no instance in the project overrides the project setting for enabling OSLogin (OSLogin needs to be enabled in project metadata for all instances)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-ip-forward

Ensure that IP forwarding is not enabled on Instances. This lets the instance act as a traffic router and receive traffic not intended for it, which may route traffic through unintended passages.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-dataproc-cluster-encrypted-with-cmk

Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-vertexai-dataset-encrypted-with-cmk

Ensure Vertex AI datasets uses a CMK (Customer Manager Key)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-compute-template-ip-forward

Ensure that IP forwarding is not enabled on Instances. This lets the instance act as a traffic router and receive traffic not intended for it, which may route traffic through unintended passages.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-monitoring-enabled

Ensure monitoring is set to Enabled on Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-project-os-login

Ensure oslogin is enabled for a Project
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-datafusion-private-instance

Ensure Data fusion instances are private
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-template-public-ip

Ensure that Compute instances do not have public IP addresses
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-artifact-registry-encrypted-with-cmk

Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-datafusion-stack-driver-monitoring

Ensure Datafusion has stack driver monitoring enabled.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures

gcp-compute-firewall-unrestricted-ingress-22

Ensure Google compute firewall ingress does not allow unrestricted SSH access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-network-policy-enabled

Ensure Network Policy is enabled on Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-memory-store-for-redis-auth-enabled

Ensure Memorystore for Redis has AUTH enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-basic-auth

Ensure GKE basic auth is disabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-project-service-account-user-iam-binding

Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-firewall-unrestricted-ingress-3306

Ensure Google compute firewall ingress does not allow unrestricted MySQL access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-pubsub-encrypted-with-cmk

Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-org-member-default-service-account-iam-member

Ensure default service account is not used at an organization level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-folder-impersonation-roles-iam-member

Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-firewall-unrestricted-ingress-21

Ensure Google compute firewall ingress does not allow unrestricted FTP access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-kubernetes-rbac-google-groups

Manage Kubernetes RBAC users with Google Groups for GKE
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-dns-key-specs-rsasha1

Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures

gcp-compute-disk-encryption

Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-311: Missing Encryption of Sensitive Data
OWASP:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design

gcp-sql-database-require-ssl

Ensure all Cloud SQL database instance requires all incoming connections to use SSL
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures

gcp-build-workers-private

Ensure Cloud build workers are private
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-private-cluster-config

Ensure Kubernetes Cluster is created with Private cluster enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-public-ip

Ensure that Compute instances do not have public IP addresses
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-spanner-database-encrypted-with-cmk

Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-compute-firewall-unrestricted-ingress-3389

Ensure Google compute firewall ingress does not allow unrestricted RDP access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-firewall-unrestricted-ingress-20

Ensure Google compute firewall ingress does not allow unrestricted FTP access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-ssl-policy

Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures

gcp-dataflow-private-job

Ensure Dataflow jobs are private
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-artifact-registry-private-repo-iam-binding

Ensure that Artifact Registry repositories are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-compute-firewall-unrestricted-ingress-80

Ensure Google compute firewall ingress does not allow unrestricted HTTP access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-project-member-default-service-account-iam-member

Ensure Default Service account is not used at a project level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-artifact-registry-private-repo-iam-member

Ensure that Artifact Registry repositories are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-vertexai-metadata-store-encrypted-with-cmk

Ensure Vertex AI Metadata Store uses a CMK (Customer Manager Key)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure

gcp-gke-secure-boot-for-shielded-nodes

Ensure Secure Boot for Shielded GKE Nodes is Enabled

gcp-cloud-storage-logging

Ensure bucket logs access.
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-778: Insufficient Logging
OWASP:
- A10:2017 - Insufficient Logging & Monitoring
- A09:2021 - Security Logging and Monitoring Failures

gcp-storage-bucket-not-public-iam-binding

Ensure that Container Registry repositories are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-dataproc-private-cluster-iam-binding

Ensure that Dataproc clusters are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-project-service-account-user-iam-member

Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-project-default-network

Ensure that the default network does not exist in a project. Set auto_create_network to false.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-master-authz-networks-enabled

Ensure master authorized networks is set to enabled in GKE clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-dataproc-private-cluster-iam-member

Ensure that Dataproc clusters are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-datafusion-stack-driver-logging

Ensure Datafusion has stack driver logging enabled.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-org-impersonation-roles-iam-binding

Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-run-private-service-iam-binding

Ensure that GCP Cloud Run services are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-sub-network-logging-enabled

Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-bigquery-private-table-iam-binding

Ensure that BigQuery Tables are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-folder-impersonation-roles-iam-binding

Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-pubsub-private-topic-iam-binding

Ensure that Pub/Sub Topics are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-storage-bucket-not-public-iam-member

Ensure that Container Registry repositories are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-gke-ensure-integrity-monitoring

Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-sqlserver-no-public-ip

Ensure Cloud SQL database does not have public IP
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-run-private-service-iam-member

Ensure that GCP Cloud Run services are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control

gcp-org-impersonation-roles-iam-member

Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
Best practiceSecurity
twitterlinkedin
Powered by Mintlify
Assistant
Responses are generated using AI and may contain mistakes.