artifact_registry_repository_encrypted_with_kms_cmkartifact_registry_repository_not_publicly_accessiblebigquery_dataset_encrypted_with_cmkbigquery_dataset_not_publicly_accessiblebigquery_table_deletion_protection_enabledbigquery_table_encrypted_with_cmkbigquery_table_not_publicly_accessiblebigtable_instance_deletion_protection_enabledbigtable_instance_encrypted_with_kms_cmkcloudbuild_workers_use_private_ipcloudfunction_not_publicly_accessiblecloudrun_not_publicly_accessiblecompute_disk_encrypted_with_cskcompute_firewall_allow_ftp_port_20_ingresscompute_firewall_allow_ftp_port_21_ingresscompute_firewall_allow_http_port_80_ingresscompute_firewall_allow_mysql_port_3306_ingresscompute_firewall_allow_rdp_port_3389_ingresscompute_firewall_allow_ssh_port_22_ingresscompute_instance_block_project_wide_ssh_enabledcompute_instance_boot_disk_encryption_enabledcompute_instance_confidential_computing_enabledcompute_instance_ip_forwarding_disabledcompute_instance_oslogin_enabledcompute_instance_serial_port_connection_disabledcompute_instance_shielded_vm_enabledcompute_instance_with_no_default_service_accountcompute_instance_with_no_default_service_account_with_full_accesscompute_instance_with_no_public_ip_addressescompute_network_contains_no_default_networkcompute_network_contains_no_legacy_networkcompute_security_policy_prevent_message_lookupcompute_subnetwork_flow_log_enabledcompute_subnetwork_private_ip_google_accesscompute_subnetwork_private_ipv6_google_accessdataflow_encrypted_with_kms_cmkdataflow_job_not_publicly_accessibledatafusion_instance_not_publicly_accessibledatafusion_instance_stackdriver_logging_enableddatafusion_instance_stackdriver_monitoring_enableddataproc_cluster_encrypted_with_kms_cmkdataproc_cluster_not_publicly_accessibledataproc_cluster_public_ip_disableddns_managed_zone_dnssec_enableddns_managed_zone_key_signing_not_using_rsasha1dns_managed_zone_zone_signing_not_using_rsasha1iam_folder_impersonation_roleiam_folder_use_basic_roleiam_folder_use_default_service_roleiam_organization_impersonation_roleiam_organization_use_basic_roleiam_organization_use_default_service_roleiam_project_impersonation_roleiam_project_no_service_account_token_creator_roleiam_project_use_basic_roleiam_project_use_default_service_roleiam_service_account_gcp_managed_keyiam_service_account_no_admin_priviledgeiam_workload_identity_restrictedkms_key_not_publicly_accessiblekms_key_prevent_destroy_enabledkms_key_rotated_within_100_daykms_key_rotated_within_90_daykubernetes_cluster_alias_ip_range_enabledkubernetes_cluster_authenticator_group_configuredkubernetes_cluster_auto_repair_enabledkubernetes_cluster_auto_upgrade_enabledkubernetes_cluster_binary_auth_enabledkubernetes_cluster_client_certificate_authentication_disabledkubernetes_cluster_control_plane_restrict_public_accesskubernetes_cluster_cos_node_imagekubernetes_cluster_intranodal_visibility_enabledkubernetes_cluster_legacy_abac_enabledkubernetes_cluster_legacy_endpoints_disabledkubernetes_cluster_master_authorized_network_enabledkubernetes_cluster_metadata_server_enabledkubernetes_cluster_network_policy_installedkubernetes_cluster_no_cluster_level_node_poolkubernetes_cluster_node_config_image_cos_containerdkubernetes_cluster_private_cluster_config_enabledkubernetes_cluster_release_channel_configuredkubernetes_cluster_resource_label_configuredkubernetes_cluster_shielded_node_integrity_monitoring_enabledkubernetes_cluster_shielded_node_secure_boot_enabledkubernetes_cluster_shielded_nodes_enabledkubernetes_cluster_stackdriver_logging_enabledkubernetes_cluster_stackdriver_monitoring_enabledlogging_bucket_retention_policy_enabledpubsub_topic_encrypted_with_kms_cmkpubsub_topic_repository_not_publicly_accessibleredis_instance_auth_enabledredis_instance_encryption_in_transit_enabledspanner_database_deletion_protection_enabledspanner_database_drop_protection_enabledspanner_database_encrypted_with_kms_cmksql_instance_automated_backups_enabledsql_instance_mysql_local_infile_database_flag_offsql_instance_mysql_skip_show_database_flag_onsql_instance_postgresql_log_checkpoints_database_flag_onsql_instance_postgresql_log_connections_database_flag_onsql_instance_postgresql_log_disconnections_database_flag_onsql_instance_postgresql_log_duration_database_flag_onsql_instance_postgresql_log_executor_stats_database_flag_offsql_instance_postgresql_log_hostname_database_flag_configuredsql_instance_postgresql_log_lock_waits_database_flag_onsql_instance_postgresql_log_min_duration_statement_database_flag_disabledsql_instance_postgresql_log_min_error_statement_flag_setsql_instance_postgresql_log_min_messages_flag_setsql_instance_postgresql_log_parser_stats_database_flag_offsql_instance_postgresql_log_planner_stats_database_flag_offsql_instance_postgresql_log_statement_flag_setsql_instance_postgresql_log_statement_stats_database_flag_offsql_instance_postgresql_log_temp_files_database_flag_0sql_instance_postgresql_pgaudit_database_flag_onsql_instance_publicly_accessiblesql_instance_require_ssl_enabledsql_instance_sql_3625_trace_database_flag_offsql_instance_sql_contained_database_authentication_database_flag_offsql_instance_sql_cross_db_ownership_chaining_database_flag_offsql_instance_sql_external_scripts_enabled_database_flag_offsql_instance_sql_remote_access_database_flag_offsql_instance_sql_user_options_database_flag_not_configuredsql_instance_sql_with_no_public_ipsql_instance_using_latest_major_database_versionstorage_bucket_logging_enabledstorage_bucket_not_publicly_accessiblestorage_bucket_public_access_prevention_enforcedstorage_bucket_self_logging_disabledstorage_bucket_uniform_access_enabledstorage_bucket_versioning_enabledvertex_ai_dataset_encrypted_with_cmkvertex_ai_notebook_instance_restrict_public_access
Queries in Terraform GCP Compliance
The Terraform GCP Compliance mod includes 132 queries:
- artifact_registry_repository_encrypted_with_kms_cmk
- artifact_registry_repository_not_publicly_accessible
- bigquery_dataset_encrypted_with_cmk
- bigquery_dataset_not_publicly_accessible
- bigquery_table_deletion_protection_enabled
- bigquery_table_encrypted_with_cmk
- bigquery_table_not_publicly_accessible
- bigtable_instance_deletion_protection_enabled
- bigtable_instance_encrypted_with_kms_cmk
- cloudbuild_workers_use_private_ip
- cloudfunction_not_publicly_accessible
- cloudrun_not_publicly_accessible
- compute_disk_encrypted_with_csk
- compute_firewall_allow_ftp_port_20_ingress
- compute_firewall_allow_ftp_port_21_ingress
- compute_firewall_allow_http_port_80_ingress
- compute_firewall_allow_mysql_port_3306_ingress
- compute_firewall_allow_rdp_port_3389_ingress
- compute_firewall_allow_ssh_port_22_ingress
- compute_instance_block_project_wide_ssh_enabled
- compute_instance_boot_disk_encryption_enabled
- compute_instance_confidential_computing_enabled
- compute_instance_ip_forwarding_disabled
- compute_instance_oslogin_enabled
- compute_instance_serial_port_connection_disabled
- compute_instance_shielded_vm_enabled
- compute_instance_with_no_default_service_account
- compute_instance_with_no_default_service_account_with_full_access
- compute_instance_with_no_public_ip_addresses
- compute_network_contains_no_default_network
- compute_network_contains_no_legacy_network
- compute_security_policy_prevent_message_lookup
- compute_subnetwork_flow_log_enabled
- compute_subnetwork_private_ip_google_access
- compute_subnetwork_private_ipv6_google_access
- dataflow_encrypted_with_kms_cmk
- dataflow_job_not_publicly_accessible
- datafusion_instance_not_publicly_accessible
- datafusion_instance_stackdriver_logging_enabled
- datafusion_instance_stackdriver_monitoring_enabled
- dataproc_cluster_encrypted_with_kms_cmk
- dataproc_cluster_not_publicly_accessible
- dataproc_cluster_public_ip_disabled
- dns_managed_zone_dnssec_enabled
- dns_managed_zone_key_signing_not_using_rsasha1
- dns_managed_zone_zone_signing_not_using_rsasha1
- iam_folder_impersonation_role
- iam_folder_use_basic_role
- iam_folder_use_default_service_role
- iam_organization_impersonation_role
- iam_organization_use_basic_role
- iam_organization_use_default_service_role
- iam_project_impersonation_role
- iam_project_no_service_account_token_creator_role
- iam_project_use_basic_role
- iam_project_use_default_service_role
- iam_service_account_gcp_managed_key
- iam_service_account_no_admin_priviledge
- iam_workload_identity_restricted
- kms_key_not_publicly_accessible
- kms_key_prevent_destroy_enabled
- kms_key_rotated_within_100_day
- kms_key_rotated_within_90_day
- kubernetes_cluster_alias_ip_range_enabled
- kubernetes_cluster_authenticator_group_configured
- kubernetes_cluster_auto_repair_enabled
- kubernetes_cluster_auto_upgrade_enabled
- kubernetes_cluster_binary_auth_enabled
- kubernetes_cluster_client_certificate_authentication_disabled
- kubernetes_cluster_control_plane_restrict_public_access
- kubernetes_cluster_cos_node_image
- kubernetes_cluster_intranodal_visibility_enabled
- kubernetes_cluster_legacy_abac_enabled
- kubernetes_cluster_legacy_endpoints_disabled
- kubernetes_cluster_master_authorized_network_enabled
- kubernetes_cluster_metadata_server_enabled
- kubernetes_cluster_network_policy_installed
- kubernetes_cluster_no_cluster_level_node_pool
- kubernetes_cluster_node_config_image_cos_containerd
- kubernetes_cluster_private_cluster_config_enabled
- kubernetes_cluster_release_channel_configured
- kubernetes_cluster_resource_label_configured
- kubernetes_cluster_shielded_node_integrity_monitoring_enabled
- kubernetes_cluster_shielded_node_secure_boot_enabled
- kubernetes_cluster_shielded_nodes_enabled
- kubernetes_cluster_stackdriver_logging_enabled
- kubernetes_cluster_stackdriver_monitoring_enabled
- logging_bucket_retention_policy_enabled
- pubsub_topic_encrypted_with_kms_cmk
- pubsub_topic_repository_not_publicly_accessible
- redis_instance_auth_enabled
- redis_instance_encryption_in_transit_enabled
- spanner_database_deletion_protection_enabled
- spanner_database_drop_protection_enabled
- spanner_database_encrypted_with_kms_cmk
- sql_instance_automated_backups_enabled
- sql_instance_mysql_local_infile_database_flag_off
- sql_instance_mysql_skip_show_database_flag_on
- sql_instance_postgresql_log_checkpoints_database_flag_on
- sql_instance_postgresql_log_connections_database_flag_on
- sql_instance_postgresql_log_disconnections_database_flag_on
- sql_instance_postgresql_log_duration_database_flag_on
- sql_instance_postgresql_log_executor_stats_database_flag_off
- sql_instance_postgresql_log_hostname_database_flag_configured
- sql_instance_postgresql_log_lock_waits_database_flag_on
- sql_instance_postgresql_log_min_duration_statement_database_flag_disabled
- sql_instance_postgresql_log_min_error_statement_flag_set
- sql_instance_postgresql_log_min_messages_flag_set
- sql_instance_postgresql_log_parser_stats_database_flag_off
- sql_instance_postgresql_log_planner_stats_database_flag_off
- sql_instance_postgresql_log_statement_flag_set
- sql_instance_postgresql_log_statement_stats_database_flag_off
- sql_instance_postgresql_log_temp_files_database_flag_0
- sql_instance_postgresql_pgaudit_database_flag_on
- sql_instance_publicly_accessible
- sql_instance_require_ssl_enabled
- sql_instance_sql_3625_trace_database_flag_off
- sql_instance_sql_contained_database_authentication_database_flag_off
- sql_instance_sql_cross_db_ownership_chaining_database_flag_off
- sql_instance_sql_external_scripts_enabled_database_flag_off
- sql_instance_sql_remote_access_database_flag_off
- sql_instance_sql_user_options_database_flag_not_configured
- sql_instance_sql_with_no_public_ip
- sql_instance_using_latest_major_database_version
- storage_bucket_logging_enabled
- storage_bucket_not_publicly_accessible
- storage_bucket_public_access_prevention_enforced
- storage_bucket_self_logging_disabled
- storage_bucket_uniform_access_enabled
- storage_bucket_versioning_enabled
- vertex_ai_dataset_encrypted_with_cmk
- vertex_ai_notebook_instance_restrict_public_access