CIS Google Cloud 1.3.0 Benchmark
Lacework provides compliance policies based on CIS Google Cloud Platform Foundation Benchmark v1.3.0 (or CIS Google Cloud 1.3.0 Benchmark for short).
Once you have integrated your Google Cloud environment with Lacework, you can check whether your resources are compliant with the benchmark recommendations.
Visibility and Usage in the Lacework Console
You can use the CIS Google Cloud 1.3.0 Benchmark in the following ways:
- Enable or disable policies through the Policies page (see CIS Google Cloud 1.3.0 Benchmark Policies).
- Create and manage Compliance Policy Exceptions as and when needed.
- Receive Compliance-related Alerts for enabled CIS Google Cloud 1.3.0 Benchmark policies (when violations occur).
- The Cloud Compliance Dashboard provides assessment results for each framework, including the CIS Google Cloud 1.3.0 Benchmark.
- The Reports page lists all reports that are configured for your environment. Create a report configuration with the CIS Google Cloud 1.3.0 Benchmark as the template to generate a daily report that is retained for up to 90 days.
Prerequisites
Ensure you have integrated your Google Cloud environment with the Lacework Compliance platform. Completing this will prepare your environment for the CIS Google Cloud 1.3.0 Benchmark:
- Integrate Lacework with Google Cloud
- A Configuration integration is the minimum requirement for your projects/organizations to gain access to our Compliance platform functionality.
Previous Integrations using Terraform
If you have previously integrated Google Cloud with Lacework using Terraform before this benchmark was available:
- Enter the directory containing the Terraform files used for the integration.
- Run
terraform init -upgradeto initialize the working directory (containing the Terraform files). - Run
terraform planand review the changes that will be applied. - Once satisfied with the changes that will be applied, run
terraform applyto upgrade the modules.
The Cloud Asset Inventory and Essential Contacts endpoints are now required for the Google Cloud resource collections to work with the new benchmark (see API List for a full list of APIs needed for Google Cloud integrations).
As such, upgrade to the latest Terraform modules to ensure the necessary permissions are met.
Previous Integrations using the Google Cloud Console
If you have previously integrated Google Cloud with Lacework manually using the Google Cloud Console, ensure that you enable the Cloud Asset Inventory and Essential Contacts APIs on projects that host the service account for the integrations (see API List for a full list of APIs needed for Google Cloud integrations).
See How to Enable the APIs for guidance.
CIS Google Cloud 1.3.0 Benchmark Policies
All policies in the CIS Google Cloud 1.3.0 Benchmark are enabled by default.
You can disable or enable them using one of the following methods outlined in this section.
Enable or Disable Policies in the Lacework Console
On the Policies page, use the framework:cis-gcp-1-3-0 tag to filter for CIS Google Cloud 1.3.0 policies only.
You can enable or disable each one using the status toggle.
Alternatively, see Batch Update Policies to enable or disable multiple policies at once.
Manual policies do not have a status toggle as there is no functional check to enable. For more information about manual policies, see Automated vs Manual Policies.
Enable or Disable Policies using the Lacework CLI
Enable or disable all the CIS Google Cloud 1.3.0 policies using the following commands in the Lacework CLI:
lacework policy enable --tag framework:cis-gcp-1-3-0
lacework policy disable --tag framework:cis-gcp-1-3-0
Enable or disable specific CIS Google Cloud 1.3.0 policies using the following command examples in the Lacework CLI:
lacework policy enable lacework-global-237
lacework policy disable lacework-global-237
Organization vs Project Level Policies
The majority of the CIS Google Cloud Benchmark policies are evaluated at the Project level, however, some are evaluated at the Organization level. As such, depending on your level of integration with Google Cloud, these Organization level policies may not display.
Policy Mapping for CIS Google Cloud 1.3.0
The CIS Google Cloud 1.3.0 controls are mapped to Lacework policies, as listed in the following tables.
Table key:
- Control ID - The CIS Google Cloud 1.3.0 Benchmark security control identifier.
- Title - The policy/control title.
- Lacework Policy ID - The Lacework policy identifier.
- CIS Assessment - Whether CIS have determined that the security control can be assessed automatically or if it requires manual verification.
- Lacework Assessment - Whether Lacework have determined that the security control can be assessed automatically or if it requires manual verification.
- Severity - The severity of the policy (as determined by Lacework).
- 1. Identity and Access Management (IAM)
- 2. Logging and Monitoring
- 3. Networking
- 4. Virtual Machines
- 5. Storage
- 6. Cloud SQL Database Services
- 7. BigQuery
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 1.1 | Use Corporate Login Credentials | lacework-global-232 | Manual | Manual | High |
| 1.2 | Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts | lacework-global-233 | Manual | Manual | High |
| 1.3 | Enable Security Key Enforcement for All Admin Accounts | lacework-global-293 | Manual | Manual | Medium |
| 1.4 | Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account | lacework-global-234 | Automated | Automated | Medium |
| 1.5 | Ensure That Service Account Has No Admin Privileges | lacework-global-235 | Automated | Automated | Medium |
| 1.6 | Ensure That Identity and Access Management (IAM) Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level | lacework-global-236 | Automated | Manual | Medium |
| 1.7 | Rotate User-Managed/External Keys for Service Accounts Every 90 Days or Fewer | lacework-global-237 | Automated | Automated | Medium |
| 1.8 | Enforce Separation of Duties While Assigning Service Account Related Roles to Users | lacework-global-294 | Automated | Manual | High |
| 1.9 | Ensure That Cloud Key Management Service (KMS) Cryptokeys Are Not Anonymously or Publicly Accessible | lacework-global-238 | Automated | Automated | Critical |
| 1.10 | Rotate Key Management Service (KMS) Encryption Keys Within a Period of 90 Days | lacework-global-239 | Automated | Automated | Medium |
| 1.11 | Enforce Separation of Duties While Assigning Key Management Service (KMS) Related Roles to Users | lacework-global-295 | Automated | Manual | High |
| 1.12 | Ensure API Keys Are Not Created for a Project | lacework-global-296 | Manual | Automated | Medium |
| 1.13 | Restrict API Keys To Use by Only Specified Hosts and Apps | lacework-global-240 | Manual | Automated | Medium |
| 1.14 | Restrict API Keys to Only APIs That Application Needs Access | lacework-global-241 | Manual | Automated | Medium |
| 1.15 | Rotate API Keys Every 90 Days | lacework-global-242 | Manual | Automated | Medium |
| 1.16 | Configure Essential Contacts for Organization | lacework-global-243 | Automated | Manual | Medium |
| 1.17 | Encrypt Dataproc Cluster using Customer-Managed Encryption Key (CMEK) | lacework-global-297 | Automated | Automated | Medium |
| 1.18 | Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager | lacework-global-244 | Manual | Manual | Medium |
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 2.1 | Configure Cloud Audit Logging Properly Across All Services and All Users From a Project | lacework-global-245 (Project) lacework-global-487 (Folder) lacework-global-488 (Organization) | Automated | Automated | Low |
| 2.2 | Configure Sinks for All Log Entries | lacework-global-246 (Configuration) lacework-global-489 (Existence) | Automated | Automated | Low |
| 2.3 | Configure Retention Policies on Cloud Storage Buckets Used for Exporting Logs Using Bucket Lock | lacework-global-298 | Automated | Automated | Low |
| 2.4 | Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes | lacework-global-247 | Automated | Automated | Low |
| 2.5 | Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes | lacework-global-248 | Automated | Automated | Low |
| 2.6 | Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes | lacework-global-249 | Automated | Automated | Low |
| 2.7 | Ensure That the Log Metric Filter and Alerts Exist for Virtual Private Cloud (VPC) Network Firewall Rule Changes | lacework-global-250 | Automated | Automated | Low |
| 2.8 | Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes | lacework-global-251 | Automated | Automated | Low |
| 2.9 | Ensure That the Log Metric Filter and Alerts Exist for Virtual Private Cloud (VPC) Network Changes | lacework-global-252 | Automated | Automated | Low |
| 2.10 | Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage Identity and Access Management (IAM) Permission Changes | lacework-global-253 | Automated | Automated | Low |
| 2.11 | Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes | lacework-global-254 | Automated | Automated | Low |
| 2.12 | Enable Cloud Domain Name System (DNS) Logging for All Virtual Private Cloud (VPC) Networks | lacework-global-255 | Automated | Automated | Medium |
| 2.13 | Enable Cloud Asset Inventory | lacework-global-256 | Automated | Automated | Medium |
| 2.14 | Ensure 'Access Transparency' is 'Enabled' | lacework-global-257 | Manual | Manual | Medium |
| 2.15 | Ensure 'Access Approval' is 'Enabled' | lacework-global-299 | Automated | Manual | Medium |
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 3.1 | Ensure That the Default Network Does Not Exist in a Project | lacework-global-300 | Automated | Automated | Medium |
| 3.2 | Ensure Legacy Networks Do Not Exist for Older Projects | lacework-global-258 | Automated | Automated | Medium |
| 3.3 | Enable DNSSEC for Cloud Domain Name System (DNS) | lacework-global-259 | Automated | Automated | Medium |
| 3.4 | Ensure That RSASHA1 Is Not Used for the Key-Signing Key (KSK) in Cloud Domain Name System (DNS) DNSSEC | lacework-global-260 | Manual | Automated | Low |
| 3.5 | Ensure That RSASHA1 Is Not Used for the Zone-Signing Key (ZSK) in Cloud Domain Name System (DNS) DNSSEC | lacework-global-261 | Manual | Automated | Low |
| 3.6 | Restrict SSH Access From the Internet | lacework-global-301 | Automated | Automated | Medium |
| 3.7 | Restrict Remote Desktop Protocol (RDP) Access From the Internet | lacework-global-302 | Automated | Automated | Critical |
| 3.8 | Enable Virtual Private Cloud (VPC) Flow Logs for Every Subnet in a VPC Network | lacework-global-262 | Automated | Automated | Low |
| 3.9 | Ensure No HTTPS Load Balancers Permit SSL Policies With Weak Cipher Suites | lacework-global-263 (HTTPS) lacework-global-490 (SSL Proxy) | Manual | Automated | Medium |
| 3.10 | Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed' | lacework-global-303 | Manual | Manual | Medium |
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 4.1 | Ensure That Instances Are Not Configured To Use the Default Service Account | lacework-global-264 | Automated | Automated | Medium |
| 4.2 | Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs | lacework-global-265 | Automated | Automated | Medium |
| 4.3 | Enable Block Project-Wide SSH Keys for VM Instances | lacework-global-266 | Automated | Automated | Medium |
| 4.4 | Enable Oslogin for a Project | lacework-global-267 (Project) lacework-global-498 (Instances) | Automated | Automated | Medium |
| 4.5 | Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance | lacework-global-268 | Automated | Automated | Medium |
| 4.6 | Ensure That IP Forwarding Is Not Enabled on Instances | lacework-global-269 | Automated | Automated | Medium |
| 4.7 | Encrypt VM Disks for Critical VMs With Customer-Supplied Encryption Keys (CSEK) | lacework-global-304 | Automated | Automated | Critical |
| 4.8 | Launch Compute Instances With Shielded VM Enabled | lacework-global-305 | Automated | Automated | Medium |
| 4.9 | Ensure That Compute Instances Do Not Have Public IP Addresses | lacework-global-306 | Automated | Automated | High |
| 4.10 | Ensure That App Engine Applications Enforce HTTPS Connections | lacework-global-307 | Manual | Manual | Medium |
| 4.11 | Ensure That Compute Instances Have Confidential Computing Enabled | lacework-global-308 | Automated | Automated | Medium |
| 4.12 | Install the Latest Operating System Updates On Your Virtual Machines in All Projects | lacework-global-309 | Manual | Manual | Medium |
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 5.1 | Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible | lacework-global-270 | Automated | Automated | Critical |
| 5.2 | Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled | lacework-global-310 | Automated | Automated | Medium |
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 6.4 | Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL | lacework-global-271 | Automated | Automated | High |
| 6.5 | Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses | lacework-global-272 | Automated | Automated | Critical |
| 6.6 | Ensure That Cloud SQL Database Instances Do Not Have Public IPs | lacework-global-311 | Automated | Automated | High |
| 6.7 | Configure Cloud SQL Database Instances With Automated Backups | lacework-global-273 | Automated | Automated | Medium |
- 6.1 MySQL Database
- 6.2 PostgreSQL Database
- 6.3 SQL Server
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 6.1.1 | Ensure That a MySQL Database Instance Does Not Allow Anyone To Connect With Administrative Privileges | lacework-global-274 | Manual | Manual | High |
| 6.1.2 | Set 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance to 'On' | lacework-global-275 | Automated | Automated | Medium |
| 6.1.3 | Set the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance to 'Off' | lacework-global-276 | Automated | Automated | Medium |
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 6.2.1 | Set 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance to 'DEFAULT' or Stricter | lacework-global-312 | Manual | Automated | Medium |
| 6.2.2 | Set the 'Log_connections' Database Flag for Cloud SQL PostgreSQL Instance to 'On' | lacework-global-277 | Automated | Automated | Medium |
| 6.2.3 | Set the 'Log_disconnections' Database Flag for Cloud SQL PostgreSQL Instance to 'On' | lacework-global-278 | Automated | Automated | Medium |
| 6.2.4 | Set 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Appropriately | lacework-global-279 | Manual | Automated | Low |
| 6.2.5 | Set 'Log_hostname' Database Flag for Cloud SQL PostgreSQL Instance to 'on' | lacework-global-280 | Automated | Automated | Low |
| 6.2.6 | Set the 'Log_min_messages' Database Flag for Cloud SQL PostgreSQL Instance to at least 'Warning' | lacework-global-281 | Manual | Automated | Low |
| 6.2.7 | Set 'Log_min_error_statement' Database Flag for Cloud SQL PostgreSQL Instance to 'Error' or Stricter | lacework-global-282 | Automated | Automated | Medium |
| 6.2.8 | Set the 'Log_min_duration_statement' Database Flag for Cloud SQL PostgreSQL Instance to '-1' (Disabled) | lacework-global-283 | Automated | Automated | Medium |
| 6.2.9 | Set 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance to 'on' For Centralized Logging | lacework-global-284 | Automated | Automated | Medium |
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 6.3.1 | Set 'external scripts enabled' database flag for Cloud SQL on SQL Server instance to 'off' | lacework-global-285 | Automated | Automated | Medium |
| 6.3.2 | Set the 'cross db ownership chaining' database flag for Cloud SQL on SQL Server instance to 'off' | lacework-global-286 | Automated | Automated | Medium |
| 6.3.3 | Set 'user Connections' Database Flag for Cloud SQL on SQL Server Instance to a Non-limiting Value | lacework-global-287 | Automated | Automated | Low |
| 6.3.4 | Do not configure 'user options' database flag for Cloud SQL on SQL Server instance | lacework-global-288 | Automated | Automated | Medium |
| 6.3.5 | Set 'remote access' database flag for Cloud SQL on SQL Server instance to 'off' | lacework-global-289 | Automated | Automated | Medium |
| 6.3.6 | Set '3625 (trace flag)' database flag for all Cloud SQL Server instances to 'off' | lacework-global-290 | Automated | Automated | Medium |
| 6.3.7 | Set the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance to 'off' | lacework-global-291 | Automated | Automated | Medium |
| Control ID | Title | Lacework Policy ID | CIS Assessment | Lacework Assessment | Severity |
|---|---|---|---|---|---|
| 7.1 | Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible | lacework-global-292 | Manual | Automated | Critical |
| 7.2 | Encrypt All BigQuery Tables With Customer-Managed Encryption Key (CMEK) | lacework-global-313 | Automated | Automated | Medium |
| 7.3 | Specify a Default Customer-Managed Encryption Key (CMEK) for All BigQuery Data Sets | lacework-global-314 | Manual | Automated | Medium |
Automated vs Manual Policies
Lacework automates compliance policies where possible. This allows the Lacework platform to monitor your environment resources to check whether they are compliant with the benchmark recommendations.
For some benchmark recommendations, it is not possible to automate the policy checks in a Google Cloud environment. These policies are manual, and you must verify such policies manually. Lacework provides the manual remediation steps for these policies (when available).
Automated Policies (that were deemed manual)
In some cases, Lacework is able to automate certain CIS benchmark controls that were deemed as manual by CIS.
The following table outlines the CIS Google Cloud 1.3.0 Benchmark policies that fall within this category:
Click to expand
| Control ID | Lacework Policy ID | Title |
|---|---|---|
| 1.12 | lacework-global-296 | Ensure API Keys Are Not Created for a Project |
| 1.13 | lacework-global-240 | Restrict API Keys To Use by Only Specified Hosts and Apps |
| 1.14 | lacework-global-241 | Restrict API Keys to Only APIs That Application Needs Access |
| 1.15 | lacework-global-242 | Rotate API Keys Every 90 Days |
| 3.4 | lacework-global-260 | Ensure That RSASHA1 Is Not Used for the Key-Signing Key (KSK) in Cloud Domain Name System (DNS) DNSSEC |
| 3.5 | lacework-global-261 | Ensure That RSASHA1 Is Not Used for the Zone-Signing Key (ZSK) in Cloud Domain Name System (DNS) DNSSEC |
| 3.9 | lacework-global-490 | Ensure No HTTPS Load Balancers Permit SSL Policies With Weak Cipher Suites |
| 6.2.1 | lacework-global-312 | Set 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance to 'DEFAULT' or Stricter |
| 6.2.4 | lacework-global-279 | Set 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Appropriately |
| 6.2.6 | lacework-global-281 | Set the 'Log_min_messages' Database Flag for Cloud SQL PostgreSQL Instance to at least 'Warning' |
| 7.1 | lacework-global-292 | Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible |
| 7.3 | lacework-global-314 | Specify a Default Customer-Managed Encryption Key (CMEK) for All BigQuery Data Sets |
Manual Policies (that were deemed automated)
In some cases, Lacework cannot automate certain CIS benchmark controls that were deemed as automated by CIS.
This is often due to one of the following reasons:
- Scope is defined by the user.
- It requires configuring other products or API permissions that are out of scope.
- Known issues for audit procedure described by the CIS control.
The following table outlines the CIS Google Cloud 1.3.0 Benchmark policies that fall within this category:
Lacework intends to automate these policies in a future release.
Click to expand
| Control ID | Lacework Policy ID | Title |
|---|---|---|
| 1.6 | lacework-global-236 | Ensure That Identity and Access Management (IAM) Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level |
| 1.8 | lacework-global-294 | Enforce Separation of Duties While Assigning Service Account Related Roles to Users |
| 1.11 | lacework-global-295 | Enforce Separation of Duties While Assigning Key Management Service (KMS) Related Roles to Users |
| 1.16 | lacework-global-243 | Configure Essential Contacts for Organization |
Permanently Manual Policies (that were deemed automated)
The following table outlines controls that were deemed automated by CIS, but will remain as manual policies:
Click to expand
| Control ID | Lacework Policy ID | Title |
|---|---|---|
| 2.15 | lacework-global-299 | Ensure 'Access Approval' is 'Enabled' |
Adjusted Controls
2.1 Ensure That Cloud Audit Logging Is Configured Properly Across All Services and All Users From a Project
This control has been split into three different policies to monitor at the project, folder, and organization levels separately.
The table below outlines each policy and their new title:
Click to expand
| Control ID | Lacework Policy ID | Title |
|---|---|---|
| 2.1 | lacework-global-245 | Configure Cloud Audit Logging Properly Across All Services and All Users From a Project |
| 2.1 | lacework-global-487 | Ensure That Cloud Audit Logging Is Configured Properly Across All Users From a Folder. |
| 2.1 | lacework-global-488 | Ensure That Cloud Audit Logging Is Configured Properly Across All Users From an Organization. |
The policy catalog only retains one entry for this control, which is lacework-global-245.
2.2 Ensure That Sinks Are Configured for All Log Entries
This control has been split into two different policies to check the following regarding Google Cloud sinks:
- There is at least one log sink with no filter configured (as this ensures all log entries are included).
- There is a destination that exists for the sink.
The table below outlines each policy and their new title:
Click to expand
| Control ID | Lacework Policy ID | Title |
|---|---|---|
| 2.2 | lacework-global-246 | Configure Sinks for All Log Entries |
| 2.2 | lacework-global-489 | Ensure That Sink Destinations Exist |
3.9 Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites
This control has been split into two different policies to monitor HTTPS and SSL Proxy Load Balancers separately.
The table below outlines each policy and their new title:
Click to expand
| Control ID | Lacework Policy ID | Title |
|---|---|---|
| 3.9 | lacework-global-263 | Ensure No HTTPS Load Balancers Permit SSL Policies With Weak Cipher Suites |
| 3.9 | lacework-global-490 | Ensure No SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites. |
The policy catalog only retains one entry for this control, which is lacework-global-263.
4.4 Ensure Oslogin Is Enabled for a Project
This control has been split into two different policies to check the following regarding OS Login:
- Checks for projects without OS Login enabled.
- Checks for VMs (instances) with OS Login disabled.
The table below outlines each policy and their new title:
Click to expand
| Control ID | Lacework Policy ID | Title |
|---|---|---|
| 4.4 | lacework-global-267 | Enable Oslogin for a Project |
| 4.4 | lacework-global-498 | Ensure Oslogin Is Not Disabled on Instances. |
The policy catalog only retains one entry for this control, which is lacework-global-267.
Determining Active Google Cloud API Keys for Certain Policies
For the following control IDs, Lacework pulls data on API keys from Google Cloud APIs. The data provided by Google returns active API keys, but also recently deleted API keys.
As such, the number of assessed resources in the policy assessment (and reports) may be greater than the number of API keys seen in your Google Cloud Console.
Click to expand
| Control ID | Lacework Policy ID | Title |
|---|---|---|
| 1.12 | lacework-global-296 | Ensure API Keys Are Not Created for a Project |
| 1.13 | lacework-global-240 | Restrict API Keys To Use by Only Specified Hosts and Apps |
| 1.14 | lacework-global-241 | Restrict API Keys to Only APIs That Application Needs Access |
| 1.15 | lacework-global-242 | Rotate API Keys Every 90 Days |