Policy: GCP > CIS v5.0 > 3 - Networking > 3.09 - Ensure Private Service Connect is Used for Access to Google APIs > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

From Google Cloud CLI

If workloads on this VPC network access Google APIs (Cloud Storage, BigQuery, Pub/Sub, Artifact Registry and so on):

1. Verify a global internal address with purpose PRIVATE_SERVICE_CONNECT exists on the network:

gcloud compute addresses list --global --filter="purpose=PRIVATE_SERVICE_CONNECT"

2. Verify a global forwarding rule on the network targets the all-apis or vpc-sc Google APIs bundle:

gcloud compute forwarding-rules list --global --format="table(name,IPAddress,network,target)"

3. Verify a private Cloud DNS zone for googleapis.com. is attached to the network and that its *.googleapis.com. record points to the endpoint address. 4. Verify firewall rules limit which sources can reach the endpoint address and do not allow 0.0.0.0/0.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in GCP > CIS v5.0 > 3 - Networking > Maximum Attestation Duration, which by default follows GCP > CIS v5.0 > Maximum Attestation Duration. Set to a blank value to clear the attestation.