CIS Google Cloud Platform Benchmark v2.0
Center for Internet Security benchmark for Google Cloud Platform. 130+ controls covering IAM, networking, logging, storage, databases, and compute security.
Ensure corporate login credentials are used
Verify that all users use corporate Google Workspace or Cloud Identity accounts, not personal Gmail accounts.
Ensure MFA is enabled for all users
Multi-factor authentication must be enforced for all Google Cloud users.
Ensure service account keys are rotated within 90 days
Service account keys must be rotated regularly to limit the window of exposure from compromised credentials.
Ensure no service accounts have admin privileges
Service accounts should not be granted Owner, Editor, or broad admin roles.
Ensure user-managed service account keys are eliminated
Prefer Workload Identity Federation or attached service accounts over user-managed keys.
Ensure IAM roles do not include cross-project permissions
Service accounts should not have IAM bindings in other projects unless explicitly required.
Ensure default VPC network is deleted
The default VPC network has overly permissive firewall rules and should be deleted.
Ensure VPC Flow Logs are enabled
VPC Flow Logs capture network flow data for monitoring and forensics.
Ensure SSH access is restricted from the internet
Firewall rules should not allow SSH (port 22) access from 0.0.0.0/0.
Ensure RDP access is restricted from the internet
Firewall rules should not allow RDP (port 3389) access from 0.0.0.0/0.
Ensure Cloud Storage buckets are not publicly accessible
Cloud Storage buckets should not grant access to allUsers or allAuthenticatedUsers.
Ensure Cloud Storage buckets have versioning enabled
Object versioning protects against accidental deletion and overwrites.
Ensure Cloud SQL instances are not publicly accessible
Cloud SQL instances should not have public IP addresses enabled.
Ensure Cloud SQL backups are configured
Automated backups must be enabled for all Cloud SQL instances.
Ensure Cloud SQL requires SSL/TLS connections
All Cloud SQL connections must use SSL/TLS encryption.
Ensure instances do not use default service accounts
Compute Engine instances should use custom service accounts, not the default compute service account.
Ensure instances do not have public IP addresses
Compute instances should use private IP addresses and access the internet through Cloud NAT.
Ensure Cloud Audit Logging is enabled for all services
Admin Activity and Data Access audit logs must be enabled across all services.
Ensure log metric filters and alerts exist for critical changes
Create log-based metrics and alerts for project ownership changes, audit config changes, and custom role modifications.
Ensure KMS encryption keys are rotated within 90 days
Customer-managed encryption keys (CMEK) should be rotated at least every 90 days.
Ensure Cloud Run services restrict ingress
Cloud Run services should not allow all traffic from the internet unless required.
Ensure Cloud Run services use custom service accounts
Cloud Run services should not use the default compute service account.
Ensure GKE clusters have Shielded Nodes enabled
Shielded GKE nodes provide verifiable integrity through Secure Boot, vTPM, and Integrity Monitoring.
Ensure GKE clusters have Network Policy enabled
Kubernetes Network Policies control pod-to-pod communication and should be enforced.