mondoo-gcp-security.mql.yaml

# Copyright (c) Mondoo, Inc.
# SPDX-License-Identifier: BUSL-1.1

policies:
  - uid: mondoo-gcp-security
    name: Google Cloud (GCP) Security
    version: 1.1.0
    license: BUSL-1.1
    tags:
      mondoo.com/category: security
      mondoo.com/platform: gcp,cloud
    authors:
      - name: Mondoo, Inc
        email: hello@mondoo.com
    docs:
      desc: |-
        ## Overview

        Google Cloud Security by Mondoo provides guidance for establishing minimum recommended security and operational best practices for Google Cloud.

        ## Remote scan

        Remote scans use cnspec providers to retrieve on-demand scan results without having to install any agents.

        For a complete list of providers run:

        ```bash
        cnspec scan --help
        ```

        ### Prerequisites

        Remote scans of Google Cloud Projects requires API credentials with access to the project.

        ### Scan a GCP project

        Open a terminal and authenticate with Google Cloud:

        ```bash
        gcloud auth login
        ```

        Run a scan of a GCP project:

        ```bash
        cnspec scan gcp
        ```

        To target a specific project:

        ```bash
        gcloud config set project <project_id>
        ```

        ```bash
        cnspec scan gcp
        ```

        ## Join the community!

        Our goal is to build policies that are simple to deploy, accurate, and actionable.

        If you have any suggestions for how to improve this policy, or if you need support, [join the community](https://github.com/orgs/mondoohq/discussions) in GitHub Discussions.
    groups:
      - title: GCP Project
        filters: |
          asset.family.contains("google")
          asset.runtime == "gcp"
        checks:
          - uid: mondoo-gcp-security-block-project-wide-ssh-keys-enabled-vm-instances
          - uid: mondoo-gcp-security-cloud-storage-bucket-not-anonymously-publicly-accessible
          - uid: mondoo-gcp-security-cloud-storage-buckets-have-uniform-bucket-level-access-enabled
          - uid: mondoo-gcp-security-instances-are-not-configured-use-default-service-account
          - uid: mondoo-gcp-security-instances-not-configured-with-default-service-account-full-access-cloud-api
          - uid: mondoo-gcp-security-oslogin-enabled-project
    scoring_system: highest impact
queries:
  - uid: mondoo-gcp-security-instances-are-not-configured-use-default-service-account
    title: Ensure that instances are not configured to use the default service account
    impact: 95
    variants:
      - uid: gcp-compute-instances-configured-use-default-service-account-all
      - uid: gcp-compute-instances-configured-use-default-service-account-single
    docs:
      desc: |
        New projects that have enabled the Compute Engine API have a Compute Engine default service account, which contains the following email pattern:

        ```bash
        -compute@developer.gserviceaccount.com
        ```

        The Compute Engine default service account is created with the IAM basic Editor role, but you can modify your service account's roles to control the service account's access to Google APIs.

        You can disable or delete this service account from your project, but doing so might cause any applications that depend on the service account's credentials to fail. If you accidentally delete the Compute Engine default service account, you can try to recover the account within 30 days. For more information, see Creating and managing service accounts.

        It is recommended that you do not configure instances with the default service account. Instead, create a user account using the principle of least privilege.
      audit: |
        __cnquery run__

        To audit your Google Cloud Project with `cnquery run`:

        1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

        2. Run this query:

          ```mql
          cnquery run gcp project <project-id> -c "gcp.compute.instances.where( name != /^gke/ ) {id name serviceAccounts.where( email == /^.*compute@developer\.gserviceaccount\.com$/ )}"
          ```

        __cnquery shell__

        To audit your Google Cloud Project with `cnquery shell`:

        1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

        2. Launch `cnquery shell`:

          ```bash
          cnquery run gcp project <project-id>
          ```

        3. Run this query:

          ```mql
          gcp.compute.instances.where( name != /^gke/ ) {id name serviceAccounts.where(email == /^.*compute@developer\.gserviceaccount\.com$/ )}
          ```
      remediation: |
        ### Terraform

        To provision or update a compute instance with a custom service account:

        ```hcl
        resource "google_compute_instance" "default" {
          name         = "secure-instance"
          machine_type = var.machine_type
          zone         = var.zone
          tags = ["terraform"]

          service_account {
            email  = "example@example.com"
            scopes = ["user-email", "compute-ro", "storage-ro"]
          }
        }
        ```

        ### Google Cloud Console

        To change the policy using the GCP Console, follow these steps:

        1. Log in to the GCP Console at https://console.cloud.google.com.
        2. Select the Organization and Project where the instance you want to update is running.
        3. Navigate to **Compute Engine**.
        4. Select the compute instance that you want to update.
        5. If the instance is not stopped, select **Stop**. Wait for the instance to stop.
        6. Select **Edit**.
        7. Scroll down to the Service Account section.
        8. Select a different service account.
        9. Select **Save**.
        10. Select **START**.

        ### gcloud cli

        To update the service account using the `gcloud` cli:

        1. Stop the instance:

          ```bash
          gcloud compute instances stop INSTANCE_NAME
          ```

        2. Update the instance:

          ```bash
          gcloud compute instances set-service-account INSTANCE_NAME --serviceaccount=SERVICE_ACCOUNT --scopes [SCOPE1, SCOPE2...]
          ```

        3. Restart the instance:

          ```bash
          gcloud compute instances start INSTANCE_NAME
          ```
  - uid: gcp-compute-instances-configured-use-default-service-account-all
    filters: asset.platform == "gcp" || asset.platform == "gcp-project"
    mql: |
      gcp.compute.instances.where(name != /^gke-/).all(
        serviceAccounts.none(
          email == /^.*compute@developer\.gserviceaccount\.com$/
        )
      )
  - uid: gcp-compute-instances-configured-use-default-service-account-single
    filters: |
      asset.platform == "gcp-compute-instance"
      gcp.compute.instance.name != /^gke-/
    mql: |
        gcp.compute.instance.serviceAccounts.none(
          email == /^.*compute@developer\.gserviceaccount\.com$/
        )
  - uid: mondoo-gcp-security-instances-not-configured-with-default-service-account-full-access-cloud-api
    title: Ensure instances are not configured to use the default service account with full access to all Cloud APIs
    impact: 90
    variants:
      - uid: gcp-compute-instances-configured-use-default-service-account-full-access-all-cloud-all
      - uid: gcp-compute-instances-configured-use-default-service-account-full-access-all-cloud-single
    docs:
      desc: |
        Google compute instances provisioned with full access to all cloud APIs pose a security risk to a GCP environment. Instances should instead be provisioned using a non-default service account, and limited permissions to cloud APIs using the principle of least privilege.
      audit: |
        __cnquery run__

         To audit your Google Cloud Project with `cnquery run`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Run this query:

           ```mql
           cnquery run gcp project <project-id> -c "gcp.compute.instances.where( name != /^gke/ ) {id name serviceAccounts.where( email == /^.*compute@developer\.gserviceaccount\.com$/ ) {email scopes}}"
           ```

         __cnquery shell__

         To audit your Google Cloud Project with `cnquery shell`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Launch `cnquery shell`:

           ```bash
           cnquery shell gcp
           ```

         3. Run this query:

           ```mql
           gcp.compute.instances.where(name != /^gke/) {id name serviceAccounts.where(email == /^.*compute@developer\.gserviceaccount\.com$/) {email scopes}}
           ```
      remediation: |
        ### Terraform

        To provision or update a compute instance with Terraform:

        ```hcl
        resource "google_compute_instance" "default" {
          name         = "secure-instance"
          machine_type = var.machine_type
          zone         = var.zone
          tags = ["terraform"]

          service_account {
            # Google recommends custom service accounts with cloud-platform scope and permissions granted via IAM Roles.
            email  = google_service_account.default.email
            scopes = ["cloud-platform"]
          }
        }
        ```
        ### Google Cloud Console

        To change the policy using the Google Cloud Console:

        1. Log in to the GCP Console at https://console.cloud.google.com.
        2. Select the Organization and Project where the instance you want to update is running.
        3. Navigate to **Compute Engine**.
        4. Select the compute instance that you want to update.
        5. If the instance is not stopped, select **Stop**. Wait for the instance to stop.
        6. Select **Edit**.
        7. Scroll down to the Service Account section.
        8. Select a different service account or ensure Allow full access to all Cloud APIs is not selected.
        9. Select **Save**.
        10. Select **START**.

        ### gcloud cli

        To update the service account using the `gcloud` cli:

        1. Stop the instance:

          ```bash
          gcloud compute instances stop INSTANCE_NAME
          ```

        2. Update the instance:

          ```bash
          gcloud compute instances set-service-account INSTANCE_NAME --serviceaccount=SERVICE_ACCOUNT --scopes [SCOPE1, SCOPE2...]
          ```

        3. Restart the instance:

          ```bash
          gcloud compute instances start INSTANCE_NAME
          ```
  - uid: gcp-compute-instances-configured-use-default-service-account-full-access-all-cloud-all
    filters: asset.platform == "gcp" || asset.platform == "gcp-project"
    mql: |
      gcp.compute.instances.where(name != /^gke-/).all(
        serviceAccounts.none(
          scopes == "https://www.googleapis.com/auth/cloud-platform"
        )
      )
  - uid: gcp-compute-instances-configured-use-default-service-account-full-access-all-cloud-single
    filters: |
      asset.platform == "gcp-compute-instance"
      gcp.compute.instance.name != /^gke-/
    mql: |
      gcp.compute.instance.serviceAccounts.none(
        scopes == "https://www.googleapis.com/auth/cloud-platform"
      )
  - uid: mondoo-gcp-security-block-project-wide-ssh-keys-enabled-vm-instances
    title: Ensure "Block Project-wide SSH keys" is enabled for VM instances
    impact: 70
    variants:
      - uid: gcp-compute-block-project-wide-ssh-keys-enabled-vm-instances-all
      - uid: gcp-compute-block-project-wide-ssh-keys-enabled-vm-instances-single
    docs:
      desc: |
        Project-wide SSH keys can be used to login into all instances within a project. While using project-wide SSH keys eases SSH key management, if SSH keys are compromised, the potential security risk can impact all instances within a project.

        The recommended approach is to use instance-specific SSH keys instead of common/shared project-wide SSH keys.
      audit: |
        __cnquery run__

         To audit your Google Cloud Project with `cnquery run`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Run this query:

           ```mql
           cnquery run gcp -c "gcp.compute.instances {id name metadata['block-project-ssh-keys'] }"
           ```

         __cnquery shell__

         To audit your Google Cloud Project with `cnquery shell`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Launch `cnquery shell`:

           ```bash
           cnquery shell gcp
           ```

         3. Run this query:

           ```mql
           gcp.compute.instances {id name metadata['block-project-ssh-keys'] }
           ```
      remediation: |
        ### Terraform

        To provision or update a compute instance with Terraform:

        ```hcl
        resource "google_compute_instance" "default" {
          name         = "secure-instance"
          machine_type = var.machine_type
          zone         = var.zone
          tags = ["terraform"]

          metadata = {
            block-project-ssh-keys = true
          }
        }
        ```

        ### Google Cloud Console

        To change the policy using the GCP Console:

        1. Log in to the GCP Console at https://console.cloud.google.com.
        2. Select the organization/project where the instance(s) you want to update are running.
        3. Navigate to **Compute Engine**.
        4. Select the instance you want to update.
        5. Select **EDIT** in the toolbar.
        6. Under the **Security and access** section, select the **Block project-wide SSH keys** option.
        7. Select **SAVE**.

        Repeat these steps for each impacted Instance.

        ### gcloud cli

        To update an instance using the `gcloud` cli:

        1. Update the instance:

          ```bash
          gcloud compute instances add-metadata INSTANCE_NAME --metadata block-projectssh-keys=TRUE
          ```
  - uid: gcp-compute-block-project-wide-ssh-keys-enabled-vm-instances-all
    filters: asset.platform == "gcp" || asset.platform == "gcp-project"
    mql: |
      gcp.compute.instances.all(
        metadata['block-project-ssh-keys'] == true
      )
  - uid: gcp-compute-block-project-wide-ssh-keys-enabled-vm-instances-single
    filters: asset.platform == "gcp-compute-instance"
    mql: |
      gcp.compute.instance.metadata['block-project-ssh-keys'] == true
  - uid: mondoo-gcp-security-oslogin-enabled-project
    title: Ensure oslogin is enabled for compute instances
    impact: 70
    variants:
      - uid: gcp-compute-oslogin-enabled-project-all
      - uid: gcp-compute-oslogin-enabled-project-single
    docs:
      desc: |
        OS Login lets you use Compute Engine Identity and Access Management (IAM) roles to grant or revoke SSH access to your Linux instances. OS Login is an alternative to managing instance access by adding and removing SSH keys in metadata.
      audit: |
        __cnquery run__

         To audit your Google Cloud Project with `cnquery run`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Run this query:

           ```mql
           cnquery run gcp project <project-id> -c "gcp.compute.instances {id name metadata['enable-oslogin'] == true}"
           ```

         __cnquery shell__

         To audit your Google Cloud Project with `cnquery shell`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Launch `cnquery shell`:

           ```bash
           cnquery shell gcp project <project-id>
           ```

         3. Run this query:

           ```mql
           gcp.compute.instances {id name metadata['enable-oslogin'] }
           ```
      remediation: |
        ### Terraform

        To configure OS Login for a project:

        ```hcl
        resource "google_compute_project_metadata" "default" {
          metadata = {
            enable-oslogin = "TRUE"
          }
        }
        ```

        To provision or update a compute instance with Terraform:

        ```hcl
        resource "google_compute_instance" "default" {
          name         = "secure-instance"
          machine_type = var.machine_type
          zone         = var.zone
          tags = ["terraform"]

          metadata = {
            enable-oslogin = true
          }
        }
        ```

        ### Google Cloud Console

        To configure OS Login for a project via Google Cloud Console:

        1. In the Google Cloud console, go to the **Metadata** page.
        2. Select **EDIT**.
        3. Add a metadata entry, setting the key to `enable-oslogin` and the value to `TRUE`.
        4. Select **SAVE** to apply the changes.

        To configure OS Login for an existing instance:

        1. In the Google Cloud console, go to the **Compute Engine**.
        2. Select the name of the instance that you want to enable OS Login on.
        3. On the instance details page, select **EDIT**.
        4. Under **Custom metadata**, add a metadata entry, setting the key to `enable-oslogin` and the value to `TRUE`.
        5. Select **SAVE**.

        ### gcloud cli

        To update OS Login for a project using the `gcloud` cli:

          ```bash
          gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE
          ```

        To update OS Login for an existing instance using the `gcloud` cli:

          ```bash
          gcloud compute instances add-metadata INSTANCE_NAME --metadata enable-oslogin=TRUE
          ```
  - uid: gcp-compute-oslogin-enabled-project-all
    filters: asset.platform == "gcp" || asset.platform == "gcp-project"
    mql: |
      gcp.compute.instances.all(
        metadata['enable-oslogin'] == true
      )
  - uid: gcp-compute-oslogin-enabled-project-single
    filters: asset.platform == "gcp-compute-instance"
    mql:
      gcp.compute.instance.metadata['enable-oslogin'] == true
  - uid: mondoo-gcp-security-cloud-storage-bucket-not-anonymously-publicly-accessible
    title: Ensure that Cloud Storage buckets are not anonymously or publicly accessible
    impact: 90
    variants:
      - uid: gcp-storage-cloud-storage-bucket-anonymously-publicly-accessible-all
      - uid: gcp-storage-cloud-storage-bucket-anonymously-publicly-accessible-single
    docs:
      desc: |
        Public access prevention protects Cloud Storage buckets and objects from being accidentally exposed to the public. When you enforce public access prevention, no one can make data in applicable buckets public through IAM policies or ACLs.
      audit: |
        __cnquery run__

         To audit your Google Cloud Project with `cnquery run`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Run this query:

           ```mql
           cnquery run gcp -c "gcloud.storage.buckets { iamPolicy { members {*} } } "
           ```

         __cnquery shell__

         To audit your Google Cloud Project with `cnquery shell`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Launch `cnquery shell`:

           ```bash
           cnquery shell gcp
           ```

         3. Run this query:

           ```mql
           gcloud.storage.buckets { iamPolicy { members {*} } }
           ```
      remediation: |
        ### Terraform

        To update public access configuration using Terraform, ensure `allUsers` and `allAuthenticatedUsers` are not set:

        ```hcl
        resource "google_storage_bucket_iam_binding" "binding" {
          bucket = google_storage_bucket.default.name
          role = "roles/storage.admin"
          members = [
            "user:jane@example.com",
          ]
        }
        ```

        ```hcl
        resource "google_storage_bucket_iam_member" "member" {
          bucket = google_storage_bucket.default.name
          role = "roles/storage.admin"
          member = "user:jane@example.com"
        }
        ```

        ### Google Cloud Console
        1. In the Google Cloud console, go to the **Cloud Storage Bucket** page.
        2. For the bucket you want to enforce public access prevention on, select the more actions menu.
        3. Select **Edit access** from the drop-down menu.
        4. In the Public access card, select **Prevent public access** to enforce public access prevention.
        5. Select **Confirm**.

        ### gcloud cli

        Update an existing storage bucket with the `gcloud` cli:

        ```bash
        gcloud storage buckets update gs://BUCKET_NAME --no-pap
        ```
  - uid: gcp-storage-cloud-storage-bucket-anonymously-publicly-accessible-all
    filters: asset.platform == "gcp" || asset.platform == "gcp-project"
    mql: |
      gcp.storage.buckets.all(iamPolicy.all(members.none(_ == "allUsers")))
      gcp.storage.buckets.all(iamPolicy.all(members.none(_ == "allAuthenticatedUsers")))
  - uid: gcp-storage-cloud-storage-bucket-anonymously-publicly-accessible-single
    filters: asset.platform == "gcp-storage-bucket"
    mql: |
      gcp.storage.bucket.iamPolicy.all(members.none(_ == "allUsers"))
      gcp.storage.bucket.iamPolicy.all(members.none(_ == "allAuthenticatedUsers"))
  - uid: mondoo-gcp-security-cloud-storage-buckets-have-uniform-bucket-level-access-enabled
    title: Ensure that Cloud Storage buckets have uniform bucket-level access enabled
    impact: 60
    variants:
      - uid: gcp-storage-cloud-storage-buckets-uniform-bucket-level-access-enabled-all
      - uid: gcp-storage-cloud-storage-buckets-uniform-bucket-level-access-enabled-single
    docs:
      desc: |
        Cloud Storage offers two systems for granting users permission to access your buckets and objects: IAM and Access Control Lists (ACLs). These systems act in parallel - in order for a user to access a Cloud Storage resource, only one of the systems needs to grant the user permission. IAM is used throughout Google Cloud and allows you to grant a variety of permissions at the bucket and project levels. ACLs are used only by Cloud Storage and have limited permission options, but they allow you to grant permissions on a per-object basis.

        It is recommended to enable uniform bucket-level access on Cloud Storage buckets. Uniform bucket-level access is used to unify and simplify how you grant access to your Cloud Storage resources. Cloud Storage offers two systems that act in parallel to grant users permission to access buckets and objects:
      audit: |
        __cnquery run__

         To audit your Google Cloud Project with `cnquery run`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Run this query:

           ```bash
           cnquery run gcp -c "gcloud.storage.buckets { iamConfiguration['UniformBucketLevelAccess']['Enabled'] }"
           ```

         __cnquery shell__

         To audit your Google Cloud Project with `cnquery shell`:

         1. Ensure the `gcloud` cli is configured to the GCP project:

           ```bash
           gcloud config set project <project_id>
           ```

         2. Launch `cnquery shell`:

           ```bash
           cnquery shell gcp
           ```

         3. Run this query:

           ```mql
           gcloud.storage.buckets { iamConfiguration['UniformBucketLevelAccess']['Enabled'] }
           ```
      remediation: |
        ### Terraform

        ```hcl
        resource "google_storage_bucket" "example" {
          name     = "test-bucket"
          bucket_policy_only = true
          uniform_bucket_level_access = true
        }
        ```

        ### Google Cloud Console

        1. In the Google Cloud console, go to the **Cloud Storage Buckets** page.
        2. In the list of buckets, select the name of the desired bucket.
        3. Select the **Permissions** tab near the top of the page.
        4. In the text box named **Access Control**, select the **Switch to** link. Note that the text box disappears 90 days after you enable uniform bucket-level access.
        5. In the pop-up menu that appears, select **Fine-grained**.
        6. Select **Save**.

        ### gcloud cli

        ```bash
        gsutil uniformbucketlevelaccess set STATE gs://BUCKET_NAME
        ```
  - uid: gcp-storage-cloud-storage-buckets-uniform-bucket-level-access-enabled-all
    filters: asset.platform == "gcp" || asset.platform == "gcp-project"
    mql: |
      gcp.storage.buckets.all(
        iamConfiguration.UniformBucketLevelAccess.enabled == true
      )
  - uid: gcp-storage-cloud-storage-buckets-uniform-bucket-level-access-enabled-single
    filters: asset.platform == "gcp-storage-bucket"
    mql: gcp.storage.bucket.iamConfiguration.UniformBucketLevelAccess.enabled == true