Policy: GCP > CIS v3.0 > 1 - Identity and Access Management

Targets

This policy targets the following resource types:

• GCP > Project

Primary Policy

This policy is used with the following primary policy:

• GCP > CIS v3.0

Related Policies

• 1.01 - Ensure that Corporate Login Credentials are Used
• 1.02 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts
• 1.03 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts
• 1.04 - Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
• 1.05 - Ensure That Service Account Has No Admin Privileges
• 1.06 - Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level
• 1.07 - Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
• 1.08 - Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users
• 1.09 - Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible
• 1.10 - Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
• 1.11 - Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users
• 1.12 - Ensure API Keys Only Exist for Active Services
• 1.13 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
• 1.14 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
• 1.15 - Ensure API Keys Are Rotated Every 90 Days
• 1.16 - Ensure Essential Contacts is Configured for Organization
• 1.17 - Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key
• 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager
• Maximum Attestation Duration

Controls

Setting this policy configures these controls:

• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.01 - Ensure that Corporate Login Credentials are Used
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.02 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.03 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.04 - Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.05 - Ensure That Service Account Has No Admin Privileges
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.06 - Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.07 - Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.08 - Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.09 - Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.10 - Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.11 - Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.12 - Ensure API Keys Only Exist for Active Services
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Rotated Every 90 Days
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.16 - Ensure Essential Contacts is Configured for Organization
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.17 - Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key
• GCP > CIS v3.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager

Policy Specification

string

Per GCP > CIS v3.0

Category

• CIS

In Your Workspace

• Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/cis

Policy Type URI

tmod:@turbot/gcp-cisv3-0#/policy/types/s01

GraphQL

query policyType(id: "tmod:@turbot/gcp-cisv3-0#/policy/types/s01") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/gcp-cisv3-0#/policy/types/s01'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/gcp-cisv3-0#/policy/types/s01'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/gcp-cisv3-0#/policy/types/s01"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/gcp-cisv3-0#/policy/types/s01"