GCP Security Checks

GCP Scanners

Cloudsploit's GCP detectors review your Google Cloud projects for security best practice violations across Compute Engine, Cloud Storage, GKE, BigQuery, Cloud SQL, IAM, and more.

Scanning GCP Project

Run a complete GCP security scan:

bash

1cloudsploit scan gcp

List all GCP-specific detectors:

bash

1cloudsploit detectors --provider gcp --list

Identity & Access

IAM Password Policy

GCP_IAM_PASSWORD_POLICY

Organization password policy strength

IAM 2-Step Verification

GCP_IAM_2SV

2-Step verification enforced for users

IAM Admin Role Overuse

GCP_IAM_ADMIN_ROLE_OVERUSE

Too many users have Owner/Editor roles

IAM Service Account Keys

GCP_IAM_SERVICE_ACCOUNT_KEYS

Service account keys older than 90 days

IAM External User Access

GCP_IAM_EXTERNAL_USER_ACCESS

External (non-company) users with access

IAP Accessible Resources

GCP_IAP_ACCESSIBLE

Resources accessible without Identity-Aware Proxy

Storage

Cloud Storage Public Access

GCS_PUBLIC_ACCESS

Bucket allows allUsers or allAuthenticatedUsers

Cloud Storage Uniform Bucket Access

GCS_UNIFORM_BUCKET_ACCESS

Uniform bucket-level access not enabled

Cloud Storage Encryption

GCS_ENCRYPTION

Customer-managed encryption keys not used

Cloud Storage Versioning

GCS_VERSIONING

Object versioning not enabled

Cloud Storage Logging

GCS_LOGGING

Access logging not configured

Cloud Storage Retention Policy

GCS_RETENTION_POLICY

No retention policy (data deletion risk)

Compute

Compute Engine Public IP

GCE_PUBLIC_IP

VM instance has external IP address

Compute Engine Disk Encryption

GCE_DISK_ENCRYPTION

Persistent disks not encrypted with CMEK

Compute Engine OS Patch Management

GCE_OS_PATCH_MANAGEMENT

OS patch management not configured

Compute Engine Shielded VM

GCE_SHIELDED_VM

Shielded VM features not enabled

GKE Cluster Legacy ABAC

GKE_LEGACY_ABAC

Legacy ABAC enabled instead of RBAC

GKE Cluster Private Nodes

GKE_PRIVATE_NODES

Nodes have public IP addresses

GKE Cluster Master Authorized Networks

GKE_MASTER_AUTHORIZED_NETWORKS

Control plane accessible from anywhere

Database

Cloud SQL Public IP

CLOUD_SQL_PUBLIC_IP

Cloud SQL instance has public IP

Cloud SQL Encryption

CLOUD_SQL_ENCRYPTION

Customer-managed keys not configured

Cloud SQL Automated Backups

CLOUD_SQL_BACKUPS

Automated backups disabled or retention too short

Cloud SQL Binary Logging

CLOUD_SQL_BINARY_LOGGING

Binary logging disabled (point-in-time recovery)

BigQuery Dataset Public Access

BIGQUERY_PUBLIC_ACCESS

Dataset grants allUsers or allAuthenticatedUsers

Firestore Database

FIRESTORE_DATABASE

Firestore security rules too permissive

Networking & Security

VPC Flow Logs

VPC_FLOW_LOGS

VPC flow logs not enabled for subnet

Cloud CDN HTTPS Only

CLOUD_CDN_HTTPS

HTTPS not enforced for Cloud CDN

Cloud Armor Security Policy

CLOUD_ARMOR_POLICY

Cloud Armor security policy missing

SSL Certificate Expiration

SSL_CERT_EXPIRATION

Managed SSL certificate expiring soon

DNS Security Policy

DNS_SECURITY_POLICY

Cloud DNS security policy not configured

Serverless & APIs

Cloud Function Public Access

CLOUD_FUNCTION_PUBLIC_ACCESS

Cloud Function allows unauthenticated invocations

Cloud Function Environment Variables Encrypted

CLOUD_FUNCTION_ENV_ENCRYPTED

Sensitive env vars not encrypted with KMS

Cloud Run Public Access

CLOUD_RUN_PUBLIC_ACCESS

Cloud Run service allows unauthenticated access

API Gateway API Key Required

API_GATEWAY_API_KEY

API Gateway does not require API key

Pub/Sub Topic IAM Policy

PUBSUB_TOPIC_IAM_POLICY

Pub/Sub topic has overly permissive IAM

Monitoring & Logging

Cloud Monitoring Dashboard

CLOUD_MONITORING_DASHBOARD

No monitoring dashboard for project

Cloud Logging Sink Exists

CLOUD_LOGGING_SINK

No log sinks configured for log export

Cloud Audit Logs Admin Activity

CLOUD_AUDIT_LOGS_ADMIN

Admin activity audit logs not configured

Cloud Audit Logs Data Access

CLOUD_AUDIT_LOGS_DATA

Data access audit logs not configured

Error Reporting Enabled

ERROR_REPORTING_ENABLED

Cloud Error Reporting not enabled

Project vs Organization Scans

GCP scans can target individual projects or entire organizations:

bash

1# Scan specific project
2cloudsploit scan gcp --project-id my-project-123
3 
4# Scan all projects in organization (requires org-level permissions)
5cloudsploit scan gcp --organization-id 123456789012

Info

Organization-level scans require roles/orgviewer or custom role with resourcemanager.projects.list permission.

Next: Detector Reference