ZCSPM offers a total of 296 security policies for GCP protecting about 30 services:

GCP Core Services

• App Engine
  Category Name

  Policy Title

  GCP - Compute

  Ensure that App Engine applications enforce HTTPS connections

  to of

  Page of

  Close
• BigQuery
  Category Name

  Policy Title

  GCP - Data Analytics

  Ensure that Customer-Managed Encryption Key (CMEK) is used for BigQuery Dataset Tables encryption

  GCP - Data Analytics

  Ensure that retention period is set on BigQuery tables

  GCP - Data Analytics

  Ensure that BigQuery datasets are not anonymously or publicly accessible

  GCP - Storage and Database

  Ensure that a Default Customer-managed encryption key (CMEK) is specified for all BigQuery Data Sets

  to of

  Page of

  Close
• Cloud Bigtable
  Category Name

  Policy Title

  GCP - Data Analytics

  Ensure that Cluster replication feature is enabled for Bigtable Instance

  GCP - Data Analytics

  Ensure that Backup is configured with expiration date for Bigtable Table

  GCP - Storage and Database

  Ensure that Bigtable Instance Cluster is encrypted using Customer Managed Encryption Key

  to of

  Page of

  Close
• Cloud Data Fusion
  Category Name

  Policy Title

  GCP - Data Analytics

  Ensure that Stackdriver Logging is enabled for Data Fusion instances

  GCP - Data Analytics

  Ensure that Data Fusion Instances are not launched within default VPC Network

  GCP - Data Analytics

  Ensure that Stackdriver monitoring is enabled for Data Fusion instances

  GCP - Networking

  Ensure that Data Fusion instances are not using default Dataproc service

  GCP - Storage and Database

  Ensure that Data Fusion instances do not have public IP addresses

  to of

  Page of

  Close
• Cloud DNS
  Category Name

  Policy Title

  GCP - Logging and Monitoring

  Ensure that Cloud DNS logging is enabled for all VPC networks

  GCP - Networking

  Ensure that DNSSEC is enabled for Cloud DNS

  GCP - Networking

  Ensure that RSASHA1 is not used for the key-signing key in Cloud DNS DNSSEC

  GCP - Networking

  Ensure that RSASHA1 is not used for the zone-signing key in Cloud DNS DNSSEC

  to of

  Page of

  Close
• Cloud Functions
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Cloud Function is not using default service account

  GCP - Compute

  Ensure that ingress setting is not set to 'Allow all traffic' for Cloud Function

  GCP - Compute

  Ensure that access to VPC- PRIVATE RANGES ONLY is used for your Cloud Function

  GCP - Compute

  Ensure that all the deployed Cloud Functions are in 'active' mode

  GCP - Compute

  Ensure that 'Require HTTPS' is selected for HTTP Cloud Functions

  GCP - Identity and Access Management

  Ensure that Cloud Functions Invoker role is not assigned to 'allUsers' for Cloud Function

  GCP - Identity and Access Management

  Ensure that Cloud Functions Viewer role is not assigned to 'allUsers' for Cloud Function

  GCP - Identity and Access Management

  Ensure that Cloud Functions Developer role is not assigned to 'allUsers' for Cloud Function

  GCP - Identity and Access Management

  Ensure that Cloud Functions Admin role is not assigned to 'allUsers' for Cloud Function

  GCP - Networking

  Ensure that 'Allow internal traffic and traffic from Cloud Load Balancing' is selected for Cloud Function

  1 to 10 of 10

  Page 1 of 1

  Close
• Cloud Key Management Service
  Category Name

  Policy Title

  GCP - Azure - Key Management

  Ensure that primary key version should be enabled for Symmetric Key

  GCP - Azure - Key Management

  Ensure that atleast one key version should be enabled for Asymmetric Key

  GCP - Identity and Access Management

  Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible

  GCP - Identity and Access Management

  Ensure KMS encryption keys are rotated within a period of 90 days

  to of

  Page of

  Close
• Cloud Logging
  Category Name

  Policy Title

  GCP - Logging and Monitoring

  Ensure log metric filter and alerts exist for project ownership assignments/changes

  GCP - Logging and Monitoring

  Ensure that the log metric filter and alerts exist for Audit Configuration changes

  GCP - Logging and Monitoring

  Ensure that the log metric filter and alerts exist for Custom Role changes

  GCP - Logging and Monitoring

  Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes

  GCP - Logging and Monitoring

  Ensure that the log metric filter and alerts exist for VPC network route changes

  GCP - Logging and Monitoring

  Ensure that the log metric filter and alerts exist for VPC network changes

  GCP - Logging and Monitoring

  Ensure that the log metric filter and alerts exist for Cloud Storage IAM permission changes

  GCP - Logging and Monitoring

  Ensure that the log metric filter and alerts exist for SQL instance configuration changes

  GCP - Logging and Monitoring

  Ensure that sinks are configured for all log entries

  GCP - Logging and Monitoring

  Ensure that retention policies on log buckets are configured using Bucket Lock

  to of

  Page of

  Close
• Cloud OS Config
  Category Name

  Policy Title

  GCP - Compute

  Ensure that OS Patch Deployment configured with a recurring schedule

  GCP - Compute

  Ensure that OS Patch Deployment not targeted to all VMs

  GCP - Compute

  Ensure that security patches for Red Hat Enterprise Linux (RHEL) and Centos are configured in Patch Deployment

  GCP - Compute

  Ensure that security patches for Windows are configured in Patch Deployment

  GCP - Compute

  Ensure that reboot is enabled for OS Patch Deployment

  GCP - Compute

  Ensure that security patches for SUSE Linux Enterprise Server (SLES) are configured in Patch Deployment

  to of

  Page of

  Close
• Cloud Run
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Cloud Run revision is not configured to use the default service account

  GCP - Compute

  Ensure that Cloud Run Service uses Customer-managed encryption key (CMEK) for encryption

  GCP - Compute

  Ensure that HTTP/2 connections for cloud run revision is enabled

  GCP - Compute

  Ensure that 'Verify container deployment with Binary Authorization' configuration is enbaled for Cloud Run Service

  GCP - Compute

  Ensure that ingress setting is not set to 'Allow all traffic' for Cloud Run Service

  GCP - Compute (PaaS and Serverless)

  Ensure that Secret is used for Cloud Run Revisions

  GCP - Networking

  Ensure that 'Allow internal traffic and traffic from Cloud Load Balancing' configuration is enabled for Cloud Run Service

  to of

  Page of

  Close
• Cloud Spanner
  Category Name

  Policy Title

  GCP - Identity and Access Management

  Ensure that Cloud Spanner Database is encrypted using Customer Managed Encryption Key

  GCP - Networking

  Ensure that Cloud Spanner Database Backup is encrypted using Customer Managed Encryption Key

  GCP - Storage and Database

  Ensure that Backup is configured with expiration date for Cloud Spanner Database

  GCP - Storage and Database

  Ensure that Cloud Spanner Instance is deployed with multi-region configuration

  to of

  Page of

  Close
• Cloud SQL
  Category Name 1

  Policy Title

  GCP - Business Continuity

  Ensure that Cloud SQL Mysql instances have 'point-in-time recovery' enabled

  GCP - Business Continuity

  Ensure that Cloud SQL PostgreSQL instances have 'point-in-time recovery' enabled

  GCP - Compute

  Ensure 'log_planner_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off'

  GCP - Logging and Monitoring

  Ensure 'log_statement_stats' database flag for Cloud SQL PostgreSQL instance is set to 'off'

  GCP - Logging and Monitoring

  Ensure that Query Insights are enabled for Cloud SQL PostgreSQL instance

  GCP - Logging and Monitoring

  Ensure that 'pgaudit.log_catalog' database flag for Cloud SQL PostgreSQL instance is set to 'off'

  GCP - Logging and Monitoring

  Ensure that 'Store client IP addresses' is enabled for Cloud SQL PostgreSQL instance

  GCP - Logging and Monitoring

  Ensure that 'Store application tags' is enabled for Cloud SQL PostgreSQL instance

  GCP - Storage and Database

  Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges

  GCP - Storage and Database

  Ensure that the 'local_infile' database flag for a Cloud SQL Mysql instance is set to 'off'

  1 to 10 of 46

  Page 1 of 5

  Close
• Cloud Storage
  Category Name

  Policy Title

  GCP - Storage and Database

  Ensure that Cloud Storage bucket is not anonymously or publicly accessible

  GCP - Storage and Database

  Ensure that Cloud Storage buckets have uniform bucket-level access enabled

  GCP - Storage and Database

  Ensure that Storage Buckets are deployed in multi-region

  GCP - Storage and Database

  Ensure that Storage Bucket is encrypted with Customer-Managed Encryption Key

  GCP - Storage and Database

  Ensures that object versioning is enabled on Storage Buckets

  to of

  Page of

  Close
• Compute Engine - Backend Service
  Category Name 1

  Policy Title

  GCP - Compute

  Ensure that static contents are cached for Backend Bucket

  GCP - Compute

  Ensure that 'stale content' serving is set to 1 day period for Backend Bucket

  GCP - Networking

  Ensure that signed URLs are in use for global HTTP(S) load balancer Backend Service

  GCP - Networking

  Ensure logging and monitoring is enabled for each global HTTPS load balancer Backend Service

  GCP - Networking

  Ensure that Cloud Armor security policy is configured for each Backend Service of global HTTP(S) load balancer

  GCP - Networking

  Ensure cloud CDN is enabled for global HTTP(S) load balancer Backend Service

  to of

  Page of

  Close
• Compute Engine - Disk
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Compute Disk is encrypted with Customer-Supplied Encryption key

  GCP - Compute

  Ensure that Compute Disks are attached with 'Snapshot Schedule' for automated backups

  to of

  Page of

  Close
• Compute Engine - Firewall
  Category Name

  Policy Title

  GCP - Networking

  Ensure that SSH access is restricted from the internet

  GCP - Networking

  Ensure that RDP access is restricted from the Internet

  GCP - Networking

  Ensure that Firewall rules should not allow connections from all IP addresses

  GCP - Networking

  Ensure that logging should be enabled on Firewall Rule

  GCP - Networking

  Ensure that no Firewall Rules allows unrestricted ingress access to TCP port 23 (Telnet)

  GCP - Networking

  Ensure that no Firewall Rules allows unrestricted ingress access to TCP port 25 (SMTP)

  GCP - Networking

  Ensure that no Firewall Rules allows unrestricted ingress access to TCP and UDP port 53 (DNS)

  GCP - Networking

  Ensure that no Firewall Rules allows unrestricted ingress access to TCP port 139 and UDP ports 137 and 138 (NetBIOS)

  GCP - Networking

  Ensure that no Firewall Rules allows unrestricted ingress access to TCP port 4333 or 3306 (MySQL)

  GCP - Networking

  Ensure that no Firewall Rules allows unrestricted ingress access to TCP port 1521 (Oracle)

  1 to 10 of 54

  Page 1 of 6

  Close
• Compute Engine - Global Forwarding
  Category Name

  Policy Title

  GCP - Compute

  Ensure that global forwarding rule is created with reserved IP address

  to of

  Page of

  Close
• Compute Engine - Health Check
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Health Checks for autohealing in managed instance groups have unhealthy-threshold value more than 1

  GCP - Logging and Monitoring

  Ensure that Cloud Logging is enabled for Compute Health Check

  to of

  Page of

  Close
• Compute Engine - Image
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Compute Image is encrypted with either Customer-Managed or Customer-Supplied Encryption key

  GCP - Compute

  Ensure that Compute Image is not publicly accessible

  to of

  Page of

  Close
• Compute Engine - Instance
  Category Name

  Policy Title

  GCP - Compute

  Ensure that instances are not configured to use the default service account with full access to all Cloud APIs

  GCP - Compute

  Ensure that instances are not configured to use the default service account

  GCP - Compute

  Ensure oslogin is enabled for a Project

  GCP - Compute

  Ensure "Block Project-wide SSH keys" is enabled for VM instances

  GCP - Compute

  Ensure that IP forwarding is not enabled on Instances

  GCP - Compute

  Ensure "Enable connecting to serial ports" is not enabled for VM Instance

  GCP - Compute

  Ensure Compute instances are launched with Shielded VM enabled

  GCP - Compute

  Ensure VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys

  GCP - Compute

  Ensure that Compute instances do not have public IP addresses

  GCP - Compute

  Ensure that deletion protection is enabled for VM Instances

  1 to 10 of 13

  Page 1 of 2

  Close
• Compute Engine - Instance Group
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Instance Groups have Health checks defined

  GCP - Compute

  Ensure that instance groups have autoscale enabled for high availability

  to of

  Page of

  Close
• Compute Engine - Instance Template
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Instance Templates are configured with Shielded VM

  GCP - Compute

  Ensure that “Block Project-wide SSH keys” is enabled for Instance Templates

  GCP - Compute

  Ensure that IP forwarding is not enabled on Instance Templates

  GCP - Compute

  Ensure "Enable connecting to serial ports" is not enabled for Instance Templates

  GCP - Compute

  Ensure that Instance Templates are not launched within default VPC

  GCP - Compute

  Ensure that Instance Templates do not have Public IP Addresses

  GCP - Compute (PaaS and Serverless)

  Ensure that Boot disk for Instance Templates are encrypted with Customer-Managed Encryption Keys

  GCP - Compute (PaaS and Serverless)

  Ensure that Instance Templates are not configured to use the default service account

  GCP - Data in Transit

  Ensure that Instance Templates have Confidential Computing enabled

  to of

  Page of

  Close
• Compute Engine - Forwarding Rule
  Category Name

  Policy Title

  GCP - Compute

  Ensure that regional forwarding rule is created with reserved IP address

  to of

  Page of

  Close
• Compute Engine- Route
  Category Name

  Policy Title

  GCP - Networking

  Ensure that the Route has network tag

  to of

  Page of

  Close
• Compute Engine - Router
  Category Name

  Policy Title

  GCP - Identity and Access Management

  Ensure that Cloud Router is created within non-default VPC Network

  to of

  Page of

  Close
• Compute Engine - Security Policy
  Category Name

  Policy Title

  GCP - Networking

  Ensure that no Cloud Armor Policy allows unrestricted access to internet

  GCP - Networking

  Ensure that Adaptive protection is enabled for Cloud Armor Policy

  to of

  Page of

  Close
• Compute Engine - Snapshot
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Compute Snapshot is created within multi-region

  to of

  Page of

  Close
• Compute Engine - SSL Policy
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Restriced profile is selected for SSL Policy

  GCP - Compute

  Ensure that the latest TLS version is in use for SSL Policy

  to of

  Page of

  Close
• Compute Engine - Subnetwork
  Category Name

  Policy Title

  GCP - Networking

  Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network

  to of

  Page of

  Close
• Compute Engine - Target Pool
  Category Name

  Policy Title

  GCP - Compute

  Ensure that Health Check is configured for Target Pool

  GCP - Compute

  Ensure that 'session affinity' is configured for Target Pool

  to of

  Page of

  Close
• Compute Engine - Target HTTPS Proxy
  Category Name

  Policy Title

  GCP - Compute

  Ensure that HTTPs Target Proxy configured with Google-managed SSL certificate

  GCP - Compute

  Ensure no HTTPS proxy load balancers permit SSL policies with weak cipher suites

  to of

  Page of

  Close
• Compute Engine - Target SSL Proxy
  Category Name

  Policy Title

  GCP - Compute

  Ensure that SSL Target Proxy configured with Google-managed SSL certificate

  GCP - Compute

  Ensure no SSL proxy load balancers permit SSL policies with weak cipher suites

  to of

  Page of

  Close
• Compute Engine - TargetVpn Gateway
  Category Name

  Policy Title

  GCP - Data Analytics

  Ensure that Classic VPN Gateway is not created within a default VPC Network

  to of

  Page of

  Close
• Compute Engine - Virtual Private Cloud (VPC)
  Category Name

  Policy Title

  GCP - Networking

  Ensure that the default network does not exist in a project

  GCP - Networking

  Ensure legacy networks do not exist for a project

  to of

  Page of

  Close
• Compute Engine - Vpn Gateway
  Category Name

  Policy Title

  GCP - Data Analytics

  Ensure that High-availability VPN Gateway is not created within default VPC Network

  to of

  Page of

  Close
• Container Registry
  Category Name

  Policy Title

  GCP - Storage and Database

  Ensure that vulnerability scanning is enabled for Container Registry

  to of

  Page of

  Close
• Dataproc
  Category Name

  Policy Title

  GCP - Data Analytics

  Ensure that Dataproc Cluster is encrypted using Customer-Supplied Encryption Keys

  GCP - Data Analytics

  Ensure that autoscaling policy is configured for Dataproc Clusters

  GCP - Data Analytics

  Ensure that Dataproc Cluster is launched in High Availability mode

  GCP - Data Analytics

  Ensure that Dataproc Cluster is not launched within default VPC Network

  GCP - Data Analytics

  Ensure that Admin role is not assigned to Default Service Account for Dataproc Cluster

  GCP - Data Analytics

  Ensure that Editor role is not assigned to Default Service Account for Dataproc Cluster

  GCP - Data Analytics

  Ensure that Dataproc jobs will restart on failure

  GCP - Data Analytics

  Ensure that Dataproc Cluster Nodes have Shielded VM enabled

  GCP - Data Analytics

  Ensure that OS Login is enabled while creating a Dataproc cluster

  GCP - Data Analytics

  Ensure that Kerberos and Hadoop Secure Mode for a cluster are enabled

  1 to 10 of 14

  Page 1 of 2

  Close
• Filestore
  Category Name

  Policy Title

  GCP - Data Analytics

  Ensure that a Filestore instance does not grants root level read and write access to all clients in a VPC network

  GCP - Data Analytics

  Ensure that Filestore Instance are not launched within default VPC Network

  to of

  Page of

  Close
• Google Kubernetes Engine
  Category Name 1

  Policy Title

  GCP - Kubernetes and Container

  Ensure 'Automatic node repair' is enabled for Kubernetes Clusters

  GCP - Kubernetes and Container

  Ensure Automatic node upgrades is enabled on Kubernetes Engine Clusters nodes

  GCP - Kubernetes and Container

  Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters

  GCP - Kubernetes and Container

  Ensure default Service account is not used for Project access in Kubernetes Clusters

  GCP - Kubernetes and Container

  Ensure Kubernetes Cluster is created with Alias IP ranges enabled

  GCP - Kubernetes and Container

  Ensure Kubernetes Cluster is created with Private cluster enabled

  GCP - Kubernetes and Container

  Ensure Master authorized networks is set to Enabled on Kubernetes Engine Clusters

  GCP - Kubernetes and Container

  Ensure Network policy is enabled on Kubernetes Engine Clusters

  GCP - Kubernetes and Container

  Ensure Private Google Access is set on Kubernetes Engine Cluster Subnets

  GCP - Kubernetes and Container

  Ensure GKE Clusters use specific purpose-designed networks instead of the default network

  1 to 10 of 22

  Page 1 of 3

  Close
• Identity and Access Management
  Category Name 1

  Policy Title

  GCP - Identity and Access Management

  Ensure that Service Account has no Admin privileges

  GCP - Identity and Access Management

  Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level

  GCP - Identity and Access Management

  Ensure that Separation of duties is enforced while assigning service account related roles to users

  GCP - Identity and Access Management

  Ensure that Separation of duties is enforced while assigning KMS related roles to users

  GCP - Identity and Access Management

  Ensure that corporate login credentials are used

  GCP - Identity and Access Management

  Ensure that multi-factor authentication is enabled for all non-service accounts

  GCP - Identity and Access Management

  Ensure that Security Key Enforcement is enabled for all admin accounts

  GCP - Identity and Access Management

  Ensure API keys are not created for a project

  GCP - Identity and Access Management

  Ensure API keys are restricted to use by only specified Hosts and Apps

  GCP - Identity and Access Management

  Ensure API keys are restricted to only APIs that application needs access

  1 to 10 of 16

  Page 1 of 2

  Close
• Memory Store
  Category Name

  Policy Title

  GCP - Data in Transit

  Ensure that in-transit encryption is enabled for Redis instance

  GCP - Networking

  Ensure that default VPC Network is not in use for Memorystore Memcached Instance

  GCP - Storage and Database

  Ensure that 'Automatically distribute' or multiple zones are selected for Memorystore Memcached Instance

  GCP - Storage and Database

  Ensure that 'track_sizes' configuration for Memorystore Memcached Instance is set to 'false'

  GCP - Storage and Database

  Ensure that 'maxconns_fast' configuration for Memorystore Memcached Instance is set to 'false'

  GCP - Storage and Database

  Ensure that Standard Tier is selected for Redis instance

  GCP - Storage and Database

  Ensure that Enable AUTH is check marked for Redis instance

  to of

  Page of

  Close
• Managed Service for Microsoft Active Directory
  Category Name

  Policy Title

  GCP - Identity and Access Management

  Ensure that Forest trust type is used when creating a relationship trust with Active directory

  GCP - Identity and Access Management

  Ensure that Selective authentication is enabled on outbound trusts in the resource forest of Active directory

  GCP - Identity and Access Management

  Ensure that Forest trust type is used when creating a relationship trust with Active directory

  to of

  Page of

  Close
• Organization Policy
  Category Name

  Policy Title

  GCP - Governance

  Ensure that 'Disable Source Code Download' constraint is set to enforce

  GCP - Governance

  Ensure that 'Require VPC Connector (Cloud Functions)' constraint is set to enforce

  GCP - Governance

  Ensure that 'Disable Guest Attributes of Compute Engine metadata' constraint is set to enforce

  GCP - Governance

  Ensure that 'Disable Internet Network Endpoint Groups' constraint is set to enforce

  GCP - Governance

  Ensure that 'Disable VM nested virtualization' constraint is set to enforce

  GCP - Governance

  Ensure that 'Skip default network creation' constraint is set to enforce

  GCP - Governance

  Ensure that 'Disable Cloud Logging' constraint is set to enforce

  GCP - Governance

  Ensure that 'Disable Workload Identity Cluster Creation' constraint is set to enforce

  GCP - Governance

  Ensure that 'Restrict shared VPC project lien removal' constraint is set to enforce

  GCP - Governance

  Ensure that 'Disable Automatic IAM Grants for Default Service Accounts' constraint is set to enforce

  GCP - Governance

  Ensure that 'Google Cloud Platform - Detailed Audit Logging Mode' constraint is set to enforce

  to of

  Page of

  Close
• Pub/Sub Topic
  Category Name

  Policy Title

  GCP - Data Analytics

  Ensure that Pub/Sub Topic is encrypted using Customer-Managed Encryption Key (CMEK)

  GCP - Governance

  Ensure that Pub/Sub Subscription is configured with an exponential backoff retry policy

  GCP - Governance

  Ensure that Cloud PubSub Topics are allowed to store messages in any region

  GCP - Governance

  Ensure that 'Retain acknowledged messages' is enabled for Pub/Sub Pull Subscriptions

  GCP - Governance

  Ensure that 'Dead letter topic' should not be configured as source topic in Pub/Sub Subscription

  GCP - Identity and Access Management

  Ensure that authentication is enabled for Pub/Sub Push Subscriptions

  GCP - Identity and Access Management

  Ensure that 'allUsers' is not allowed to publish to Pub/Sub Topic

  GCP - Identity and Access Management

  Ensure that Pub/Sub Topic is not exposed to everyone

  GCP - Identity and Access Management

  Ensure that 'allUsers' is not allowed to subscribe to Pub/Sub Topic

  GCP - Identity and Access Management

  Ensure that 'allUsers' is not allowed to edit Pub/Sub Topic

  GCP - Identity and Access Management

  Ensure that Admin/Owner role is not assigned to 'allUsers' for Pub/Sub Topic

  to of

  Page of

  Close
• Resource Manager
  Category Name

  Policy Title

  GCP - Compute

  Ensure that GCP Project is protected from accidental deletion

  GCP - Identity and Access Management

  Ensure that editor role is not assigned to Compute Engine Default Service Account

  GCP - Identity and Access Management

  Ensure that editor role is not assigned to App Engine Default Service Account

  to of

  Page of

  Close

Kubernetes

ZCSPM offers the following security policies for Kubernetes deployed on Compute Engine instances and Kubernetes worker nodes:

• Kubernetes (worker nodes)
  Category Name

  Policy Title

  Kubernetes - Kubelet

  GKE - Ensure that the --authorization-mode argument is not set to AlwaysAllow for Kubelet

  Kubernetes - Kubelet

  GKE - Ensure that the --anonymous-auth argument is set to false

  Kubernetes - Kubelet

  GKE - Ensure that the --read-only-port argument is set to 0

  Kubernetes - Kubelet

  GKE - Ensure that the --client-ca-file argument is set as appropriate for Kubelet

  Kubernetes - Kubelet

  GKE - Ensure that the --protect-kernel-defaults argument is set to true

  Kubernetes - Kubelet

  GKE - Ensure that the --streaming-connection-idle-timeout argument is not set to 0

  Kubernetes - Kubelet

  GKE - Ensure that the --hostname-override argument is not set

  Kubernetes - Kubelet

  GKE - Ensure that the --make-iptables-util-chains argument is set to true

  Kubernetes - Kubelet

  GKE - Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate for Kubelet

  Kubernetes - Kubelet

  GKE - Ensure that the RotateKubeletServerCertificate argument is set to true for Kubelet Server

  Kubernetes - Kubelet

  GKE - Ensure that the --rotate-certificates argument is not set to false

  to of

  Page of

  Close