Security
gcp-sql-public-database
gcp-sql-public-database
Ensure that Cloud SQL database Instances are not open to the world
Likelihood: MEDIUM
Confidence: MEDIUM
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-client-certificate-disabled
gcp-gke-client-certificate-disabled
Ensure client certificate authentication to Kubernetes Engine Clusters is disabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-folder-member-default-service-account-iam-member
gcp-folder-member-default-service-account-iam-member
Ensure Default Service account is not used at a folder level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-enabled-vpc-flow-logs
gcp-gke-enabled-vpc-flow-logs
Enable VPC Flow Logs and Intranode Visibility
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-serial-ports
gcp-compute-serial-ports
Ensure ‘Enable connecting to serial ports’ is not enabled for VM Instance
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-org-member-default-service-account-iam-binding
gcp-org-member-default-service-account-iam-binding
Ensure default service account is not used at an organization level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-sub-network-private-google-enabled
gcp-sub-network-private-google-enabled
Ensure that private_ip_google_access is enabled for Subnet
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-project-member-default-service-account-iam-binding
gcp-project-member-default-service-account-iam-binding
Ensure Default Service account is not used at a project level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-vertexai-private-instance
gcp-vertexai-private-instance
Ensure Vertex AI instances are private
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-insecure-load-balancer-tls-version
gcp-insecure-load-balancer-tls-version
Detected GCP Load Balancer to be using an insecure version of TLS. To fix this set your “min_tls_version” to “TLS_1_2”
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
gcp-gke-pod-security-policy-enabled
gcp-gke-pod-security-policy-enabled
Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-bigtable-instance-encrypted-with-cmk
gcp-bigtable-instance-encrypted-with-cmk
Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-bigquery-dataset-encrypted-with-cmk
gcp-bigquery-dataset-encrypted-with-cmk
Ensure that BigQuery datasets are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-dataproc-cluster-public-ip
gcp-dataproc-cluster-public-ip
Ensure Dataproc Clusters do not have public IPs
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-memory-store-for-redis-intransit-encryption
gcp-memory-store-for-redis-intransit-encryption
Ensure Memorystore for Redis uses intransit encryption
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-folder-member-default-service-account-iam-binding
gcp-folder-member-default-service-account-iam-binding
Ensure Default Service account is not used at a folder level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-dataflow-job-encrypted-with-cmk
gcp-dataflow-job-encrypted-with-cmk
Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-gke-cluster-logging
gcp-gke-cluster-logging
Ensure logging is set to Enabled on Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-gke-legacy-instance-metadata-disabled
gcp-gke-legacy-instance-metadata-disabled
Ensure legacy Compute Engine instance metadata APIs are Disabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-bigquery-table-encrypted-with-cmk
gcp-bigquery-table-encrypted-with-cmk
Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-bigquery-private-table-iam-member
gcp-bigquery-private-table-iam-member
Ensure that BigQuery Tables are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-public-control-plane
gcp-gke-public-control-plane
Ensure GKE Control Plane is not public
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-nodepool-integrity-monitoring
gcp-gke-nodepool-integrity-monitoring
Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-storage-bucket-uniform-access
gcp-storage-bucket-uniform-access
Ensure that Cloud Storage buckets have uniform bucket-level access enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-pubsub-private-topic-iam-member
gcp-pubsub-private-topic-iam-member
Ensure that Pub/Sub Topics are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-boot-disk-encryption
gcp-compute-boot-disk-encryption
Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-311: Missing Encryption of Sensitive Data
OWASP:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
gcp-kms-prevent-destroy
gcp-kms-prevent-destroy
Ensure KMS keys are protected from deletion
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-legacy-auth-enabled
gcp-gke-legacy-auth-enabled
Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-os-login
gcp-compute-os-login
Ensure that no instance in the project overrides the project setting for enabling OSLogin (OSLogin needs to be enabled in project metadata for all instances)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-ip-forward
gcp-compute-ip-forward
Ensure that IP forwarding is not enabled on Instances. This lets the instance act as a traffic router and receive traffic not intended for it, which may route traffic through unintended passages.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-dataproc-cluster-encrypted-with-cmk
gcp-dataproc-cluster-encrypted-with-cmk
Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-vertexai-dataset-encrypted-with-cmk
gcp-vertexai-dataset-encrypted-with-cmk
Ensure Vertex AI datasets uses a CMK (Customer Manager Key)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-compute-template-ip-forward
gcp-compute-template-ip-forward
Ensure that IP forwarding is not enabled on Instances. This lets the instance act as a traffic router and receive traffic not intended for it, which may route traffic through unintended passages.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-monitoring-enabled
gcp-gke-monitoring-enabled
Ensure monitoring is set to Enabled on Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-project-os-login
gcp-compute-project-os-login
Ensure oslogin is enabled for a Project
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-datafusion-private-instance
gcp-datafusion-private-instance
Ensure Data fusion instances are private
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-template-public-ip
gcp-compute-template-public-ip
Ensure that Compute instances do not have public IP addresses
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-artifact-registry-encrypted-with-cmk
gcp-artifact-registry-encrypted-with-cmk
Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-datafusion-stack-driver-monitoring
gcp-datafusion-stack-driver-monitoring
Ensure Datafusion has stack driver monitoring enabled.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
gcp-compute-firewall-unrestricted-ingress-22
gcp-compute-firewall-unrestricted-ingress-22
Ensure Google compute firewall ingress does not allow unrestricted SSH access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-network-policy-enabled
gcp-gke-network-policy-enabled
Ensure Network Policy is enabled on Kubernetes Engine Clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-memory-store-for-redis-auth-enabled
gcp-memory-store-for-redis-auth-enabled
Ensure Memorystore for Redis has AUTH enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-basic-auth
gcp-gke-basic-auth
Ensure GKE basic auth is disabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-project-service-account-user-iam-binding
gcp-project-service-account-user-iam-binding
Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-firewall-unrestricted-ingress-3306
gcp-compute-firewall-unrestricted-ingress-3306
Ensure Google compute firewall ingress does not allow unrestricted MySQL access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-pubsub-encrypted-with-cmk
gcp-pubsub-encrypted-with-cmk
Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-org-member-default-service-account-iam-member
gcp-org-member-default-service-account-iam-member
Ensure default service account is not used at an organization level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-folder-impersonation-roles-iam-member
gcp-folder-impersonation-roles-iam-member
Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-firewall-unrestricted-ingress-21
gcp-compute-firewall-unrestricted-ingress-21
Ensure Google compute firewall ingress does not allow unrestricted FTP access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-kubernetes-rbac-google-groups
gcp-gke-kubernetes-rbac-google-groups
Manage Kubernetes RBAC users with Google Groups for GKE
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-dns-key-specs-rsasha1
gcp-dns-key-specs-rsasha1
Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
gcp-compute-disk-encryption
gcp-compute-disk-encryption
Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-311: Missing Encryption of Sensitive Data
OWASP:
- A03:2017 - Sensitive Data Exposure
- A04:2021 - Insecure Design
gcp-sql-database-require-ssl
gcp-sql-database-require-ssl
Ensure all Cloud SQL database instance requires all incoming connections to use SSL
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
gcp-build-workers-private
gcp-build-workers-private
Ensure Cloud build workers are private
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-private-cluster-config
gcp-gke-private-cluster-config
Ensure Kubernetes Cluster is created with Private cluster enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-public-ip
gcp-compute-public-ip
Ensure that Compute instances do not have public IP addresses
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-spanner-database-encrypted-with-cmk
gcp-spanner-database-encrypted-with-cmk
Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-compute-firewall-unrestricted-ingress-3389
gcp-compute-firewall-unrestricted-ingress-3389
Ensure Google compute firewall ingress does not allow unrestricted RDP access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-firewall-unrestricted-ingress-20
gcp-compute-firewall-unrestricted-ingress-20
Ensure Google compute firewall ingress does not allow unrestricted FTP access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-ssl-policy
gcp-compute-ssl-policy
Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-326: Inadequate Encryption Strength
OWASP:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
gcp-dataflow-private-job
gcp-dataflow-private-job
Ensure Dataflow jobs are private
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-artifact-registry-private-repo-iam-binding
gcp-artifact-registry-private-repo-iam-binding
Ensure that Artifact Registry repositories are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-compute-firewall-unrestricted-ingress-80
gcp-compute-firewall-unrestricted-ingress-80
Ensure Google compute firewall ingress does not allow unrestricted HTTP access
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-project-member-default-service-account-iam-member
gcp-project-member-default-service-account-iam-member
Ensure Default Service account is not used at a project level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-artifact-registry-private-repo-iam-member
gcp-artifact-registry-private-repo-iam-member
Ensure that Artifact Registry repositories are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-vertexai-metadata-store-encrypted-with-cmk
gcp-vertexai-metadata-store-encrypted-with-cmk
Ensure Vertex AI Metadata Store uses a CMK (Customer Manager Key)
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-320: CWE CATEGORY: Key Management Errors
OWASP:
- A03:2017 - Sensitive Data Exposure
gcp-gke-secure-boot-for-shielded-nodes
gcp-gke-secure-boot-for-shielded-nodes
Ensure Secure Boot for Shielded GKE Nodes is Enabled
gcp-cloud-storage-logging
gcp-cloud-storage-logging
Ensure bucket logs access.
Likelihood: LOW
Confidence: MEDIUM
CWE:
- CWE-778: Insufficient Logging
OWASP:
- A10:2017 - Insufficient Logging & Monitoring
- A09:2021 - Security Logging and Monitoring Failures
gcp-storage-bucket-not-public-iam-binding
gcp-storage-bucket-not-public-iam-binding
Ensure that Container Registry repositories are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-dataproc-private-cluster-iam-binding
gcp-dataproc-private-cluster-iam-binding
Ensure that Dataproc clusters are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-project-service-account-user-iam-member
gcp-project-service-account-user-iam-member
Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-project-default-network
gcp-project-default-network
Ensure that the default network does not exist in a project. Set auto_create_network to false
.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-master-authz-networks-enabled
gcp-gke-master-authz-networks-enabled
Ensure master authorized networks is set to enabled in GKE clusters
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-dataproc-private-cluster-iam-member
gcp-dataproc-private-cluster-iam-member
Ensure that Dataproc clusters are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-datafusion-stack-driver-logging
gcp-datafusion-stack-driver-logging
Ensure Datafusion has stack driver logging enabled.
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-org-impersonation-roles-iam-binding
gcp-org-impersonation-roles-iam-binding
Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-run-private-service-iam-binding
gcp-run-private-service-iam-binding
Ensure that GCP Cloud Run services are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-sub-network-logging-enabled
gcp-sub-network-logging-enabled
Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-bigquery-private-table-iam-binding
gcp-bigquery-private-table-iam-binding
Ensure that BigQuery Tables are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-folder-impersonation-roles-iam-binding
gcp-folder-impersonation-roles-iam-binding
Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-pubsub-private-topic-iam-binding
gcp-pubsub-private-topic-iam-binding
Ensure that Pub/Sub Topics are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-storage-bucket-not-public-iam-member
gcp-storage-bucket-not-public-iam-member
Ensure that Container Registry repositories are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-gke-ensure-integrity-monitoring
gcp-gke-ensure-integrity-monitoring
Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-sqlserver-no-public-ip
gcp-sqlserver-no-public-ip
Ensure Cloud SQL database does not have public IP
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-run-private-service-iam-member
gcp-run-private-service-iam-member
Ensure that GCP Cloud Run services are not anonymously or publicly accessible
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control
gcp-org-impersonation-roles-iam-member
gcp-org-impersonation-roles-iam-member
Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level
Likelihood: LOW
Confidence: LOW
CWE:
- CWE-284: Improper Access Control
OWASP:
- A05:2017 - Broken Access Control
- A01:2021 - Broken Access Control