Project: Terrascan (Provisioning / Security & Compliance)
File: gcp.md

| Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Security Best Practices | gcp | LOW | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters. | accurics.gcp.OPS.101 | ACGCP0017 | | Compliance Validation | gcp | HIGH | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image. | accurics.gcp.OPS.114 | ACGCP0016 | | Security Best Practices | gcp | LOW | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters. | accurics.gcp.OPS.144 | ACGCP0015 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Identity and Access Management | gcp | HIGH | BigQuery datasets may be anonymously or publicly accessible. | accurics.gcp.IAM.106 | ACGCP0230 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Identity and Access Management | gcp | HIGH | Ensure oslogin is enabled for a Project | accurics.gcp.IAM.127 | ACGCP0291 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | gcp | MEDIUM | Service Attachment with connectionpreference ACCEPTAUTOMATIC allow any project to connect. | accurics.gcp.NS.134 | ACGCP0296 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Logging and Monitoring | gcp | MEDIUM | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network. | accurics.gcp.LOG.118 | ACGCP0033 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Logging and Monitoring | gcp | LOW | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project. | accurics.gcp.LOG.010 | ACGCP0009 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Resilience | gcp | HIGH | Ensure all Cloud SQL database instance have backup configuration enabled. | accurics.gcp.BDR.105 | ACGCP0001 | | Infrastructure Security | gcp | HIGH | Ensure that Cloud SQL database Instances are not open to the world. | accurics.gcp.NS.102 | ACGCP0295 | | Infrastructure Security | gcp | HIGH | Ensure that Cloud SQL database instance requires all incoming connections to use SSL | accurics.gcp.EKM.141 | ACGCP0003 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | gcp | MEDIUM | Ensure IP forwarding is not enabled on Instances. | accurics.gcp.NS.130 | ACGCP0232 | | Infrastructure Security | gcp | HIGH | Ensure 'Block Project-wide SSH keys' is enabled for VM instances. | accurics.gcp.NS.126 | ACGCP0039 | | Data Protection | gcp | MEDIUM | VM disks attached to a compute instance should be encrypted with Customer Supplied Encryption Keys (CSEK) . |

| ACGCP0036 | | Identity and Access Management | gcp | HIGH | Instances may have been configured to use the default service account with full access to all Cloud APIs | accurics.gcp.IAM.124 | ACGCP0040 | | Infrastructure Security | gcp | MEDIUM | Ensure 'Enable connecting to serial ports' is not enabled for VM instances. | accurics.gcp.NS.129 | ACGCP0037 | | Infrastructure Security | gcp | MEDIUM | Ensure Compute instances are launched with Shielded VM enabled. | accurics.gcp.NS.133 | ACGCP0035 | | Identity and Access Management | gcp | MEDIUM | Ensure that no instance in the project overrides the project setting for enabling OSLogin | accurics.gcp.IAM.128 | ACGCP0038 | | Infrastructure Security | gcp | HIGH | Instances may have been configured to use the default service account with full access to all Cloud APIs | accurics.gcp.NS.125 | ACGCP0041 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Identity and Access Management | gcp | MEDIUM | Ensure that Cloud Storage bucket is not anonymously or publicly accessible. | accurics.gcp.IAM.121 | ACGCP0237 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | Medium | GKE Control Plane is exposed to few public IP addresses using master-authorized-network-config | AC-GC-IS-CC-M-0367 | ACGCP0292 | | Logging and Monitoring | gcp | HIGH | Ensure Stackdriver Monitoring is enabled on Kubernetes Engine Clusters. | accurics.gcp.MON.143 | ACGCP0029 | | Infrastructure Security | gcp | HIGH | Ensure Kubernetes Cluster is created with Private cluster enabled. | accurics.gcp.NS.117 | ACGCP0294 | | Compliance Validation | gcp | HIGH | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters. | accurics.gcp.OPS.116 | ACGCP0022 | | Identity and Access Management | gcp | HIGH | Ensure GKE basic auth is disabled. | accurics.gcp.IAM.110 | ACGCP0021 | | Infrastructure Security | gcp | HIGH | Ensure Master Authentication is set to enabled on Kubernetes Engine Clusters. | accurics.gcp.NS.112 | ACGCP0027 | | Compliance Validation | gcp | HIGH | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | accurics.gcp.OPS.115 | ACGCP0025 | | Infrastructure Security | gcp | HIGH | Ensure GKE Control Plane is not public. | accurics.gcp.NS.109 | ACGCP0023 | | Identity and Access Management | gcp | MEDIUM | Ensure Kubernetes Cluster is created with Client Certificate disabled. | accurics.gcp.IAM.104 | ACGCP0024 | | Compliance Validation | gcp | HIGH | Ensure Kubernetes Clusters are configured with Labels. | accurics.gcp.OPS.113 | ACGCP0019 | | Identity and Access Management | gcp | HIGH | Ensure Legacy Authorization is set to disabled on Kubernetes Engine Clusters. | accurics.gcp.IAM.142 | ACGCP0028 | | Logging and Monitoring | gcp | HIGH | Ensure Stackdriver Logging is enabled on Kubernetes Engine Clusters. | accurics.gcp.LOG.100 | ACGCP0030 | | Infrastructure Security | gcp | HIGH | Ensure Network policy is enabled on Kubernetes Engine Clusters. | accurics.gcp.NS.103 | ACGCP0293 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | gcp | MEDIUM | Ensure that the default network does not exist in a project. |

| ACGCP0010 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | MEDIUM | Ensure Puppet Master (TCP:8140) is not exposed to public for Google Compute Firewall | ACGCP0049 | ACGCP0049 | | Infrastructure Security | json | HIGH | Ensure Remote Desktop (TCP:3389) is not exposed to entire internet for Google Compute Firewall | ACGCP0225 | ACGCP0225 | | Infrastructure Security | json | HIGH | Ensure LDAP SSL (TCP:636) is not exposed to entire internet for Google Compute Firewall | ACGCP0161 | ACGCP0161 | | Infrastructure Security | json | MEDIUM | Ensure SaltStack Master (TCP:4506) is not exposed to public for Google Compute Firewall | ACGCP0073 | ACGCP0073 | | Infrastructure Security | json | MEDIUM | Ensure Cassandra (TCP:7001) is not exposed to public for Google Compute Firewall | ACGCP0136 | ACGCP0136 | | Infrastructure Security | json | HIGH | Ensure VNC Listener (TCP:5500) is not exposed to entire internet for Google Compute Firewall | ACGCP0065 | ACGCP0065 | | Infrastructure Security | json | LOW | Ensure Memcached SSL (UDP:11215) is not exposed to private hosts more than 32 for Google Compute Firewall | ACGCP0120 | ACGCP0120 | | Infrastructure Security | json | MEDIUM | Ensure Oracle DB (TCP:1521) is not exposed to public for Google Compute Firewall | ACGCP0209 | ACGCP0209 | | Infrastructure Security | json | HIGH | Ensure Cassandra Internode Communication (TCP:7000) is not exposed to entire internet for Google Compute Firewall | ACGCP0198 | ACGCP0198 | | Infrastructure Security | json | LOW | Ensure Elastic Search (TCP:9300) is not exposed to private hosts more than 32 for Google Compute Firewall | ACGCP0177 | ACGCP0177 | | Infrastructure Security | json | MEDIUM | Ensure NetBios Datagram Service (TCP:138) is not exposed to public for Google Compute Firewall | ACGCP0100 | ACGCP0100 | | Infrastructure Security | json | LOW | Ensure Mongo Web Portal (TCP:27018) is not exposed to private hosts more than 32 for Google Compute Firewall | ACGCP0045 | ACGCP0045 | | Infrastructure Security | json | MEDIUM | Ensure MSSQL Server (TCP:1433) is not exposed to public for Google Compute Firewall | ACGCP0157 | ACGCP0157 | | Infrastructure Security | json | LOW | Ensure Postgres SQL (TCP:5432) is not exposed to private hosts more than 32 for Google Compute Firewall | ACGCP0141 | ACGCP0141 | | Infrastructure Security | json | HIGH | Ensure Microsoft-DS (TCP:445) is not exposed to entire internet for Google Compute Firewall | ACGCP0116 | ACGCP0116 | | Infrastructure Security | json | HIGH | Ensure SQL Server Analysis Service browser (TCP:2382) is not exposed to entire internet for Google Compute Firewall | ACGCP0053 | ACGCP0053 | | Infrastructure Security | json | HIGH | Ensure Elastic Search (TCP:9200) is not exposed to entire internet for Google Compute Firewall | ACGCP0182 | ACGCP0182 | | Infrastructure Security | json | HIGH | Ensure LDAP (UDP:389) is not exposed to entire internet for Google Compute Firewall | ACGCP0213 | ACGCP0213 | | Infrastructure Security | json | LOW | Ensure NetBios Session Service (UDP:139) is not exposed to private hosts more than 32 for Google Compute Firewall | ACGCP0090 | ACGCP0090 | | Infrastructure Security | json | LOW | Ensure Oracle DB (TCP:2483) is not exposed to private hosts more than 32 for Google Compute Firewall | ACGCP0205 | ACGCP0205 | | Infrastructure Security | json | LOW | Ensure Known internal web port (TCP:8000) is