Control: 1.1 Ensure that corporate login credentials are used
Description
Use corporate login credentials instead of personal accounts, such as Gmail accounts.
It is recommended fully-managed corporate Google accounts be used for increased visibility, auditing, and controlling access to Cloud Platform resources. Email accounts based outside of the user's organization, such as personal accounts, should not be used for business purposes.
Remediation
To find if the GCP project is associated with the corporate organization domain:
- List the accounts that have been granted access to that projectgcloud projects get-iam-policy PROJECT_ID
- Also list the accounts added on each foldergcloud resource-manager folders get-iam-policy FOLDER_ID
- And list your organization's IAM policygcloud organizations get-iam-policy ORGANIZATION_ID
Note: No email accounts outside the organization domain should be granted permissions in the IAM policies.
Follow the documentation and setup corporate login accounts.
To ensure that no email addresses outside the organization can be granted IAM permissions to its Google Cloud projects, folders or organization, turn on the Organization Policy for Domain Restricted Sharing
. Learn more at https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains
Usage
Run the control in your terminal:
powerpipe control run gcp_compliance.control.cis_v130_1_1
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run gcp_compliance.control.cis_v130_1_1 --share
SQL
This control uses a named query:
iam_user_uses_corporate_login_credentials