> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="gcp-sql-public-database">
    Ensure that Cloud SQL database Instances are not open to the world<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-client-certificate-disabled">
    Ensure client certificate authentication to Kubernetes Engine Clusters is disabled<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-folder-member-default-service-account-iam-member">
    Ensure Default Service account is not used at a folder level<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-enabled-vpc-flow-logs">
    Enable VPC Flow Logs and Intranode Visibility<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-serial-ports">
    Ensure 'Enable connecting to serial ports' is not enabled for VM Instance	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-org-member-default-service-account-iam-binding">
    Ensure default service account is not used at an organization level<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-sub-network-private-google-enabled">
    Ensure that private\_ip\_google\_access is enabled for Subnet<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-project-member-default-service-account-iam-binding">
    Ensure Default Service account is not used at a project level<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-vertexai-private-instance">
    Ensure Vertex AI instances are private<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-insecure-load-balancer-tls-version">
    Detected GCP Load Balancer to be using an insecure version of TLS. To fix this set your "min\_tls\_version" to "TLS\_1\_2"<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-326: Inadequate Encryption Strength
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="gcp-gke-pod-security-policy-enabled">
    Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-bigtable-instance-encrypted-with-cmk">
    Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK)	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-bigquery-dataset-encrypted-with-cmk">
    Ensure that BigQuery datasets are not anonymously or publicly accessible	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-dataproc-cluster-public-ip">
    Ensure Dataproc Clusters do not have public IPs<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-memory-store-for-redis-intransit-encryption">
    Ensure Memorystore for Redis uses intransit encryption<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-folder-member-default-service-account-iam-binding">
    Ensure Default Service account is not used at a folder level<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-dataflow-job-encrypted-with-cmk">
    Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK)<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-gke-cluster-logging">
    Ensure logging is set to Enabled on Kubernetes Engine Clusters<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-gke-legacy-instance-metadata-disabled">
    Ensure legacy Compute Engine instance metadata APIs are Disabled<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-bigquery-table-encrypted-with-cmk">
    Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK)	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-bigquery-private-table-iam-member">
    Ensure that BigQuery Tables are not anonymously or publicly accessible		<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-public-control-plane">
    Ensure GKE Control Plane is not public<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-nodepool-integrity-monitoring">
    Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-storage-bucket-uniform-access">
    Ensure that Cloud Storage buckets have uniform bucket-level access enabled<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-pubsub-private-topic-iam-member">
    Ensure that Pub/Sub Topics are not anonymously or publicly accessible<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-boot-disk-encryption">
    Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-311: Missing Encryption of Sensitive Data
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A04:2021 - Insecure Design
  </Accordion>

  <Accordion title="gcp-kms-prevent-destroy">
    Ensure KMS keys are protected from deletion<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-legacy-auth-enabled">
    Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-os-login">
    Ensure that no instance in the project overrides the project setting for enabling OSLogin (OSLogin needs to be enabled in project metadata for all instances)	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-ip-forward">
    Ensure that IP forwarding is not enabled on Instances. This lets the instance act as a traffic router and receive traffic not intended for it, which may route traffic through unintended passages.	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-dataproc-cluster-encrypted-with-cmk">
    Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK)	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-vertexai-dataset-encrypted-with-cmk">
    Ensure Vertex AI datasets uses a CMK (Customer Manager Key)<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-compute-template-ip-forward">
    Ensure that IP forwarding is not enabled on Instances. This lets the instance act as a traffic router and receive traffic not intended for it, which may route traffic through unintended passages.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-monitoring-enabled">
    Ensure monitoring is set to Enabled on Kubernetes Engine Clusters<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-project-os-login">
    Ensure oslogin is enabled for a Project	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-datafusion-private-instance">
    Ensure Data fusion instances are private<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-template-public-ip">
    Ensure that Compute instances do not have public IP addresses	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-artifact-registry-encrypted-with-cmk">
    Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK)<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-datafusion-stack-driver-monitoring">
    Ensure Datafusion has stack driver monitoring enabled.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-326: Inadequate Encryption Strength
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="gcp-compute-firewall-unrestricted-ingress-22">
    Ensure Google compute firewall ingress does not allow unrestricted SSH access<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-network-policy-enabled">
    Ensure Network Policy is enabled on Kubernetes Engine Clusters<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-memory-store-for-redis-auth-enabled">
    Ensure Memorystore for Redis has AUTH enabled<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-basic-auth">
    Ensure GKE basic auth is disabled	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-project-service-account-user-iam-binding">
    Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-firewall-unrestricted-ingress-3306">
    Ensure Google compute firewall ingress does not allow unrestricted MySQL access<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-pubsub-encrypted-with-cmk">
    Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK)<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-org-member-default-service-account-iam-member">
    Ensure default service account is not used at an organization level<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-folder-impersonation-roles-iam-member">
    Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-firewall-unrestricted-ingress-21">
    Ensure Google compute firewall ingress does not allow unrestricted FTP access<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-kubernetes-rbac-google-groups">
    Manage Kubernetes RBAC users with Google Groups for GKE<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-dns-key-specs-rsasha1">
    Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC	<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-326: Inadequate Encryption Strength
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="gcp-compute-disk-encryption">
    Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-311: Missing Encryption of Sensitive Data
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A04:2021 - Insecure Design
  </Accordion>

  <Accordion title="gcp-sql-database-require-ssl">
    Ensure all Cloud SQL database instance requires all incoming connections to use SSL<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-326: Inadequate Encryption Strength
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="gcp-build-workers-private">
    Ensure Cloud build workers are private	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-private-cluster-config">
    Ensure Kubernetes Cluster is created with Private cluster enabled<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-public-ip">
    Ensure that Compute instances do not have public IP addresses	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-spanner-database-encrypted-with-cmk">
    Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK)<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-compute-firewall-unrestricted-ingress-3389">
    Ensure Google compute firewall ingress does not allow unrestricted RDP access<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-firewall-unrestricted-ingress-20">
    Ensure Google compute firewall ingress does not allow unrestricted FTP access<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-ssl-policy">
    Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-326: Inadequate Encryption Strength
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="gcp-dataflow-private-job">
    Ensure Dataflow jobs are private<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-artifact-registry-private-repo-iam-binding">
    Ensure that Artifact Registry repositories are not anonymously or publicly accessible	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-compute-firewall-unrestricted-ingress-80">
    Ensure Google compute firewall ingress does not allow unrestricted HTTP access<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-project-member-default-service-account-iam-member">
    Ensure Default Service account is not used at a project level<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-artifact-registry-private-repo-iam-member">
    Ensure that Artifact Registry repositories are not anonymously or publicly accessible	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-vertexai-metadata-store-encrypted-with-cmk">
    Ensure Vertex AI Metadata Store uses a CMK (Customer Manager Key)<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-320: CWE CATEGORY: Key Management Errors
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
  </Accordion>

  <Accordion title="gcp-gke-secure-boot-for-shielded-nodes">
    Ensure Secure Boot for Shielded GKE Nodes is Enabled
  </Accordion>

  <Accordion title="gcp-cloud-storage-logging">
    Ensure bucket logs access.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-778: Insufficient Logging
    <br />**OWASP**: <br />- A10:2017 - Insufficient Logging & Monitoring
    <br />- A09:2021 - Security Logging and Monitoring Failures
  </Accordion>

  <Accordion title="gcp-storage-bucket-not-public-iam-binding">
    Ensure that Container Registry repositories are not anonymously or publicly accessible<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-dataproc-private-cluster-iam-binding">
    Ensure that Dataproc clusters are not anonymously or publicly accessible<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-project-service-account-user-iam-member">
    Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-project-default-network">
    Ensure that the default network does not exist in a project. Set auto\_create\_network to `false`.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-master-authz-networks-enabled">
    Ensure master authorized networks is set to enabled in GKE clusters<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-dataproc-private-cluster-iam-member">
    Ensure that Dataproc clusters are not anonymously or publicly accessible<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-datafusion-stack-driver-logging">
    Ensure Datafusion has stack driver logging enabled.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-org-impersonation-roles-iam-binding">
    Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-run-private-service-iam-binding">
    Ensure that GCP Cloud Run services are not anonymously or publicly accessible<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-sub-network-logging-enabled">
    Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-bigquery-private-table-iam-binding">
    Ensure that BigQuery Tables are not anonymously or publicly accessible		<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-folder-impersonation-roles-iam-binding">
    Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-pubsub-private-topic-iam-binding">
    Ensure that Pub/Sub Topics are not anonymously or publicly accessible<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-storage-bucket-not-public-iam-member">
    Ensure that Container Registry repositories are not anonymously or publicly accessible<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-gke-ensure-integrity-monitoring">
    Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-sqlserver-no-public-ip">
    Ensure Cloud SQL database does not have public IP<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-run-private-service-iam-member">
    Ensure that GCP Cloud Run services are not anonymously or publicly accessible<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="gcp-org-impersonation-roles-iam-member">
    Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level	<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-284: Improper Access Control
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>
</AccordionGroup>