Turbot Guardrails Hub 
Hub
  • Mods
  • Policy Packs
  • Docs
  • Home
ModsPolicy PacksDocsHome
Mods
GCP
Loading policies...

Policy: GCP > CIS v5.0 > 3 - Networking > 3.09 - Ensure Private Service Connect is Used for Access to Google APIs

Configures auditing against a CIS Benchmark item.

Level: 2

Ensure that VPCs use Private Service Connect endpoints for access to Google APIs such as Cloud Storage, BigQuery, Pub/Sub, Artifact Registry, and other googleapis.com services, so that traffic from workloads to these APIs stays on the Google private network instead of traversing the public internet. Private Service Connect for Google APIs creates a dedicated endpoint in your VPC with firewall rule enforcement, providing more granular control than Private Google Access.

Targets

This policy targets the following resource types:

  • GCP > Network > Network

Primary Policy

This policy is used with the following primary policy:

  • GCP > CIS v5.0 > 3 - Networking

Related Policies

  • Attestation

Controls

Setting this policy configures this control:

  • GCP > CIS v5.0 > 3 - Networking > 3.09 - Ensure Private Service Connect is Used for Access to Google APIs

Policy Specification

Schema Type
string
Default
Per GCP > CIS v5.0 > 3 - Networking
Valid Values [YAML]
  • Per GCP > CIS v5.0 > 3 - Networking

  • Skip

  • Check: Benchmark using attestation

Category

  • CIS > Controls v7 > 14 Controlled Access Based on the Need to Know > 14.01 Segment the Network Based on Sensitivity

In Your Workspace

  • Policy Settings by Type report

Developers

    Category URI
    • tmod:@turbot/cis#/control/categories/v071401
    • Policy Type URI
    • tmod:@turbot/gcp-cisv5-0#/policy/types/r0309
    • GraphQL
    • query policyType(id: "tmod:@turbot/gcp-cisv5-0#/policy/types/r0309") { … }
    • query policySettings(filter: "policyTypeId:'tmod:@turbot/gcp-cisv5-0#/policy/types/r0309'") { … }
    • query policyValues(filter: "policyTypeId:'tmod:@turbot/gcp-cisv5-0#/policy/types/r0309'") { … }
    • CLI
    • Get Policy Type
    • turbot graphql policy-type --id "tmod:@turbot/gcp-cisv5-0#/policy/types/r0309"
      • Get Policy Settings
    • turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/gcp-cisv5-0#/policy/types/r0309"
Guardrails
Guardrails Hub
  • Hub
  • Docs
  • Blog
  • Changelog
Products
  • GuardrailsGuardrails
  • PipesPipes
  • SteampipeSteampipe
  • PowerpipePowerpipe
  • FlowpipeFlowpipe
  • TailpipeTailpipe
Turbot
  • Home
  • About us
  • We're hiring!
  • Contact us
Community

Our community of practitioners love to discuss cloud governance & security.

Slack logoJoin us on Slack →

System StatusLegalSecurity
Terms of UseSecurityPrivacy
42
Mods
158
Resource Types
2,654
Policies
1,319
Controls
131
Quick Actions
93
IAM