GCP Compliance Rules for IAM, Firewalls, Cloud SQL and GKE

GCP compliance findings are grouped here by the service they inspect. Each reads a field that Cloud Asset Inventory or the service API reports, such as a firewall’s source ranges or a bucket’s public access prevention setting, and each abstains when that field is missing. They carry no saving and are written as plain findings with fix steps.

Identity and access

• GCP Service Account Has Admin Role, GCP Service Account Has User-Managed Keys and GCP Service Account Key Not Rotated Within 90 Days narrow in on service accounts, where long-lived keys accumulate.
• GCP IAM Policy Grants Access to Gmail Account flags personal accounts in project policies.
• GCP IAM Primitive Role in Use and GCP IAM Project-Level Role Binding point to grants broader than the task.
• GCP Audit Logging Not Enabled covers the audit trail.

Firewall rules

GCP Firewall Rule Allows Internet Access to Sensitive Port, GCP Firewall Rule Allows All Ports, GCP Firewall Rule on Default VPC Network and GCP Firewall Rule Uses Port Ranges. Fact sheet: GCP firewall.

Cloud SQL

• GCP Cloud SQL Instance Has Public IP Enabled reads the instance’s IPv4 setting.
• GCP Cloud SQL Instance Does Not Require SSL and GCP Cloud SQL Automated Backup Disabled.
• Cloud SQL Production Instance Without HA, Cloud SQL No Maintenance Window Configured and Cloud SQL Slow Query Log Disabled.

See Cloud SQL.

Cloud Storage

GCP Cloud Storage Bucket Does Not Enforce Public Access Prevention fires when public access prevention is not enforced. That proves the guardrail is missing, not that data is public, and the finding says so. The same family checks versioning, access logging, uniform bucket-level access, retention policies and CORS configuration. See GCS buckets.

GKE

GKE Cluster Not Private, GKE Control Plane Master Authorized Networks Disabled, GKE Cluster Network Policy Not Enforced, GKE Cluster Monitoring Disabled, GKE Cluster Logging Disabled, GKE Node Auto-Upgrade Not Configured, GKE Node Pool Auto-Repair Disabled and GKE Node Pool Not Using COS Image. Workload-level posture inside the cluster is covered by security findings. Fact sheet: GKE clusters.

Compute Engine

GCP VM Deletion Protection Disabled applies to standalone VMs, not to members of managed instance groups, whose lifecycle is owned by the group. GCP VM OS Login Not Enabled, GCP VM Shielded VM Not Enabled, GCP VM Serial Port Access Enabled, GCP VM Missing Snapshot Schedule and GCP Persistent Disk Without Snapshot complete the set.

Working the findings

Findings can be filtered by connected project, severity and resource type, exported to Excel with their evidence, or ticketed to Jira. When the underlying field changes, ZopNight re-reads it to verify the fix. All rules: GCP recommendations. Cross-cloud view: compliance findings. Other GCP categories: orphans, discounts.