Queries in GCP Compliance

The GCP Compliance mod includes 202 queries:

• alloydb_cluster_encrypted_with_cmk
• alloydb_instance_log_error_verbosity_database_flag_default_or_stricter
• alloydb_instance_log_min_error_statement_database_flag_configured
• alloydb_instance_log_min_messages_database_flag_error
• app_engine_application_iap_enabled
• audit_logging_configured_for_all_service
• bigquery_dataset_encrypted_with_cmk
• bigquery_dataset_not_publicly_accessible
• bigquery_dataset_restrict_gmail
• bigquery_dataset_restrict_googlegroups
• bigquery_table_encrypted_with_cmk
• cloudfunction_function_no_deployments_manager_permission
• cloudfunction_function_no_disrupt_logging_permission
• cloudfunction_function_no_ingress_settings_allow_all
• cloudfunction_function_restrict_public_access
• cloudfunction_function_restricted_permission
• cloudfunction_function_vpc_connector_enabled
• cloudrun_service_restrict_public_access
• compute_backend_bucket_no_dangling_storage_bucket
• compute_disk_encrypted_with_csk
• compute_external_backend_service_iap_enabled
• compute_firewall_allow_connections_proxied_by_iap
• compute_firewall_allow_tcp_connections_proxied_by_iap
• compute_firewall_default_rule_restrict_ingress_access_except_http_and_https
• compute_firewall_rule_ingress_access_restricted_to_dns_port_53
• compute_firewall_rule_ingress_access_restricted_to_ftp_port_21
• compute_firewall_rule_ingress_access_restricted_to_http_port_80
• compute_firewall_rule_ingress_access_restricted_to_microsoft_ds_port_445
• compute_firewall_rule_ingress_access_restricted_to_mongo_db_port_27017
• compute_firewall_rule_ingress_access_restricted_to_mysql_db_port_3306
• compute_firewall_rule_ingress_access_restricted_to_netbios_snn_port_139
• compute_firewall_rule_ingress_access_restricted_to_oracle_db_port_1521
• compute_firewall_rule_ingress_access_restricted_to_pop3_port_110
• compute_firewall_rule_ingress_access_restricted_to_postgresql_port_10250
• compute_firewall_rule_ingress_access_restricted_to_postgresql_port_10255
• compute_firewall_rule_ingress_access_restricted_to_postgresql_port_5432
• compute_firewall_rule_ingress_access_restricted_to_smtp_port_25
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_137_to_139
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_27017_to_27019
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_61620_61621
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_636
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_6379
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_7000_7001
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_7199
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_8888
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_9042
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_9090
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_9160
• compute_firewall_rule_ingress_access_restricted_to_tcp_port_9200_9300
• compute_firewall_rule_ingress_access_restricted_to_tcp_udp_port_11211
• compute_firewall_rule_ingress_access_restricted_to_tcp_udp_port_11214_to_11215
• compute_firewall_rule_ingress_access_restricted_to_tcp_udp_port_2483_to_2484
• compute_firewall_rule_ingress_access_restricted_to_tcp_udp_port_389
• compute_firewall_rule_ingress_access_restricted_to_telnet_port_23
• compute_firewall_rule_logging_enabled
• compute_firewall_rule_rdp_access_restricted
• compute_firewall_rule_restrict_ingress_all
• compute_firewall_rule_restrict_ingress_all_with_no_specific_target
• compute_firewall_rule_ssh_access_restricted
• compute_https_load_balancer_logging_enabled
• compute_instance_block_project_wide_ssh_enabled
• compute_instance_confidential_computing_enabled
• compute_instance_ip_forwarding_disabled
• compute_instance_no_data_destruction_permission
• compute_instance_no_database_write_permission
• compute_instance_no_deployments_manager_permission
• compute_instance_no_disrupt_logging_permission
• compute_instance_no_iam_write_permission
• compute_instance_no_service_account_impersonate_permission
• compute_instance_no_write_permission_on_deny_policy
• compute_instance_oslogin_enabled
• compute_instance_preemptible_termination_disabled
• compute_instance_serial_port_connection_disabled
• compute_instance_shielded_vm_enabled
• compute_instance_template_ip_forwarding_disabled
• compute_instance_with_custom_metadata
• compute_instance_with_no_default_service_account
• compute_instance_with_no_default_service_account_with_full_access
• compute_instance_with_no_public_ip_addresses
• compute_instance_wth_no_high_level_basic_role
• compute_network_auto_create_subnetwork_enabled
• compute_network_contains_no_default_network
• compute_network_contains_no_legacy_network
• compute_network_dns_logging_enabled
• compute_ssl_policy_with_no_weak_cipher
• compute_subnetwork_flow_log_enabled
• compute_subnetwork_private_ip_google_access
• compute_target_https_proxy_quic_protocol_enabled
• compute_target_https_proxy_quic_protocol_no_default_ssl_policy
• compute_target_https_uses_latest_tls_version
• dataproc_cluster_encryption_with_cmek
• dns_managed_zone_dnssec_enabled
• dns_managed_zone_key_signing_not_using_rsasha1
• dns_managed_zone_zone_signing_not_using_rsasha1
• iam_api_key_age_90
• iam_api_key_restricts_apis
• iam_api_key_restricts_websites_hosts_apps
• iam_service_account_gcp_managed_key
• iam_service_account_key_age_100
• iam_service_account_key_age_90
• iam_service_account_without_admin_privilege
• iam_user_denylist_public
• iam_user_kms_separation_of_duty_enforced
• iam_user_not_assigned_service_account_user_role_project_level
• iam_user_separation_of_duty_enforced
• iam_user_uses_corporate_login_credentials
• kms_key_not_publicly_accessible
• kms_key_rotated_within_100_day
• kms_key_rotated_within_90_day
• kms_key_separation_of_duties_enforced
• kms_key_users_limited_to_3
• kubernetes_cluster_auto_repair_enabled
• kubernetes_cluster_auto_upgrade_enabled
• kubernetes_cluster_binary_authorization_enabled
• kubernetes_cluster_client_certificate_authentication_enabled
• kubernetes_cluster_dashboard_disabled
• kubernetes_cluster_database_encryption_enabled
• kubernetes_cluster_http_load_balancing_enabled
• kubernetes_cluster_incoming_traffic_open_to_all
• kubernetes_cluster_intra_node_visibility_enabled
• kubernetes_cluster_kubernetes_alpha_enabled
• kubernetes_cluster_legacy_abac_enabled
• kubernetes_cluster_legacy_endpoints_disabled
• kubernetes_cluster_logging_enabled
• kubernetes_cluster_master_authorized_networks_config_enabled
• kubernetes_cluster_monitoring_enabled
• kubernetes_cluster_network_policy_enabled
• kubernetes_cluster_network_policy_installed
• kubernetes_cluster_no_default_network
• kubernetes_cluster_node_config_image_cos_containerd
• kubernetes_cluster_node_no_default_service_account
• kubernetes_cluster_private_cluster_config_enabled
• kubernetes_cluster_private_nodes_configured
• kubernetes_cluster_release_channel_configured
• kubernetes_cluster_service_account_default
• kubernetes_cluster_shielded_instance_integrity_monitoring_enabled
• kubernetes_cluster_shielded_node_secure_boot_enabled
• kubernetes_cluster_shielded_nodes_enabled
• kubernetes_cluster_subnetwork_private_ip_google_access_enabled
• kubernetes_cluster_use_ip_aliases
• kubernetes_cluster_with_less_than_three_node_auto_upgrade_enabled
• kubernetes_cluster_with_resource_labels
• kubernetes_cluster_zone_redundant
• logging_bucket_retention_policy_enabled
• logging_metric_alert_audit_configuration_changes
• logging_metric_alert_custom_role_changes
• logging_metric_alert_custom_role_changes_with_iam_admin_undelete_role
• logging_metric_alert_firewall_rule_changes
• logging_metric_alert_network_changes
• logging_metric_alert_network_route_changes
• logging_metric_alert_project_ownership_assignment
• logging_metric_alert_sql_instance_configuration_changes
• logging_metric_alert_storage_iam_permission_changes
• logging_sink_configured_for_all_resource
• manual_control
• organization_essential_contacts_configured
• project_access_approval_settings_enabled
• project_no_api_key
• project_oslogin_enabled
• project_service_cloudasset_api_enabled
• project_service_container_scanning_api_enabled
• sql_instance_automated_backups_enabled
• sql_instance_mysql_binary_log_enabled
• sql_instance_mysql_local_infile_database_flag_off
• sql_instance_mysql_skip_show_database_flag_on
• sql_instance_not_open_to_internet
• sql_instance_not_publicly_accessible
• sql_instance_postgresql_cloudsql_pgaudit_database_flag_enabled
• sql_instance_postgresql_log_checkpoints_database_flag_on
• sql_instance_postgresql_log_connections_database_flag_on
• sql_instance_postgresql_log_disconnections_database_flag_on
• sql_instance_postgresql_log_duration_database_flag_on
• sql_instance_postgresql_log_error_verbosity_database_flag_default_or_stricter
• sql_instance_postgresql_log_executor_stats_database_flag_off
• sql_instance_postgresql_log_hostname_database_flag_configured
• sql_instance_postgresql_log_lock_waits_database_flag_on
• sql_instance_postgresql_log_min_duration_statement_database_flag_disabled
• sql_instance_postgresql_log_min_error_statement_database_flag_configured
• sql_instance_postgresql_log_min_messages_database_flag_error
• sql_instance_postgresql_log_parser_stats_database_flag_off
• sql_instance_postgresql_log_planner_stats_database_flag_off
• sql_instance_postgresql_log_statement_database_flag_ddl
• sql_instance_postgresql_log_statement_stats_database_flag_off
• sql_instance_postgresql_log_temp_files_database_flag_0
• sql_instance_require_ssl_enabled
• sql_instance_sql_3625_trace_database_flag_off
• sql_instance_sql_3625_trace_database_flag_on
• sql_instance_sql_contained_database_authentication_database_flag_off
• sql_instance_sql_cross_db_ownership_chaining_database_flag_off
• sql_instance_sql_external_scripts_enabled_database_flag_off
• sql_instance_sql_remote_access_database_flag_off
• sql_instance_sql_user_connections_database_flag_configured
• sql_instance_sql_user_options_database_flag_not_configured
• sql_instance_with_labels
• sql_instance_with_no_public_ips
• storage_bucket_bucket_policy_only_enabled
• storage_bucket_log_not_publicly_accessible
• storage_bucket_log_object_versioning_enabled
• storage_bucket_log_retention_policy_enabled
• storage_bucket_log_retention_policy_lock_enabled
• storage_bucket_not_publicly_accessible
• storage_bucket_uniform_access_enabled