Policy: GCP > CIS v5.0 > 3 - Networking > 3.08 - Ensure VPC Service Controls Is Enabled for Supported Google Cloud Services > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

From Google Cloud CLI

1. Verify the Access Context Manager API is enabled and that the organization has an access policy:

gcloud services list --enabled --filter="name:accesscontextmanager.googleapis.com" gcloud access-context-manager policies list --organization=<ORGANIZATION_ID>

2. List the service perimeters and verify this project is a protected resource of a perimeter whose restricted services include the sensitive services the project uses:

gcloud access-context-manager perimeters list --policy=<POLICY_ID> \\ --filter="status.resources:projects/<PROJECT_NUMBER>"

3. Describe the perimeter and verify its access levels and ingress/egress rules are no broader than required:

gcloud access-context-manager perimeters describe <PERIMETER_NAME> --policy=<POLICY_ID>

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in GCP > CIS v5.0 > 3 - Networking > Maximum Attestation Duration, which by default follows GCP > CIS v5.0 > Maximum Attestation Duration. Set to a blank value to clear the attestation.