Policy: GCP > CIS v5.0 > 4 - Virtual Machines > 4.12 - Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects > Attestation

By setting this policy, you attest that you have manually verified that it complies with the relevant section of the CIS Benchmark.

From Google Cloud Console

Determine if the OS Config API is enabled for the project:

1. Navigate into the project. In the navigation menu, hover over APIs & Services and select API Library. 2. Search for VM Manager (OS Config API), or select the Compute filter in the left-hand column, and open the API. 3. Verify that the API is enabled.

Determine if VM instances have the correct metadata for OS Config parsing:

1. In the navigation menu, hover over Compute Engine and, under Settings, select Metadata. 2. Verify that the project-wide metadata contains the key enable-osconfig set to true.

Determine if the OS Config agent is running on the instance:

There is no way to determine this from the Google Cloud console. Run the operating-system-specific commands in https://cloud.google.com/compute/docs/troubleshooting/vm-manager/verify-setup inside the instance. Instances created from a Google-supplied OS image with a build date later than v20200114 have the agent installed, but you should still check that it is running.

Verify that the service account set up for the project in recommendation 4.1 is running:

1. Go to the VM instances page at https://console.cloud.google.com/compute/instances and click the instance name. 2. Note the service account under Service Account. 3. Run the operating-system-specific commands from the service-account-enabled section of the verify-setup page inside the instance. They should return the name of that service account.

Determine if the instance can connect to public update hosting. VM Manager doesn't host the updates; it lets you issue update commands to each VM centrally.

- Debian-based Linux: sudo apt update should list numbered lines with Hit: and the update URLs. - Red Hat-based Linux: yum check-update should list the packages that have updates available. - Windows: ping http://windowsupdate.microsoft.com/ should be delivered and received.

From Google Cloud CLI

1. In the project, run gcloud services list. If osconfig.googleapis.com is listed, the OS Config API is enabled. 2. Determine if VM Manager is enabled for the instance:

gcloud compute instances os-inventory describe <VM_NAME> --zone=<ZONE>

The output lists the instance with its operating system, OS Config agent version and update time.

3. View the instance tags:

gcloud compute instances list --format="table(name,status,tags.list())"

Each instance should have enable-osconfig set to true.

Once verified, enter the date that this attestation expires. Note that the date can not be further in the future than is specified in GCP > CIS v5.0 > 4 - Virtual Machines > Maximum Attestation Duration, which by default follows GCP > CIS v5.0 > Maximum Attestation Duration. Set to a blank value to clear the attestation.