Turbot Guardrails Hub 
Hub
  • Mods
  • Policy Packs
  • Docs
  • Home
ModsPolicy PacksDocsHome
Mods
GCP
Loading policies...

Policy: GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.04 - Ensure Organization Policies Are Configured For Centralized Constraints

Configures auditing against a CIS Benchmark item.

Level: 2

Ensure that one or more baseline Organization Policies are configured at the organization or folder level in accordance with enterprise security requirements. Organization Policies act as preventive guardrails that set centralized constraints on how resources can be configured across all projects within the organization hierarchy. These policies can enforce security invariants such as preventing public IP addresses on compute instances, requiring OS Login for SSH access, restricting resource locations to approved regions, enforcing uniform bucket-level access on Cloud Storage, or limiting IAM policy member domains to prevent external sharing.

Targets

This policy targets the following resource types:

  • GCP > Organization

Primary Policy

This policy is used with the following primary policy:

  • GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource

Related Policies

  • Attestation

Controls

Setting this policy configures this control:

  • GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.04 - Ensure Organization Policies Are Configured For Centralized Constraints

Policy Specification

Schema Type
string
Default
Per GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource
Valid Values [YAML]
  • >-
  Per GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization
  Resource

  • Skip

  • Check: Benchmark using attestation

Category

  • CIS > Controls v7 > 05 Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers > 5.01 Establish Secure Configurations

In Your Workspace

  • Policy Settings by Type report

Developers

    Category URI
    • tmod:@turbot/cis#/control/categories/v070501
    • Policy Type URI
    • tmod:@turbot/gcp-cisv5-0#/policy/types/r010104
    • GraphQL
    • query policyType(id: "tmod:@turbot/gcp-cisv5-0#/policy/types/r010104") { … }
    • query policySettings(filter: "policyTypeId:'tmod:@turbot/gcp-cisv5-0#/policy/types/r010104'") { … }
    • query policyValues(filter: "policyTypeId:'tmod:@turbot/gcp-cisv5-0#/policy/types/r010104'") { … }
    • CLI
    • Get Policy Type
    • turbot graphql policy-type --id "tmod:@turbot/gcp-cisv5-0#/policy/types/r010104"
      • Get Policy Settings
    • turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/gcp-cisv5-0#/policy/types/r010104"
Guardrails
Guardrails Hub
  • Hub
  • Docs
  • Blog
  • Changelog
Products
  • GuardrailsGuardrails
  • PipesPipes
  • SteampipeSteampipe
  • PowerpipePowerpipe
  • FlowpipeFlowpipe
  • TailpipeTailpipe
Turbot
  • Home
  • About us
  • We're hiring!
  • Contact us
Community

Our community of practitioners love to discuss cloud governance & security.

Slack logoJoin us on Slack →

System StatusLegalSecurity
Terms of UseSecurityPrivacy
42
Mods
158
Resource Types
2,654
Policies
1,319
Controls
131
Quick Actions
93
IAM