@sagentix-inc/evidence-collector 0.3.0 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/THIRD_PARTY_NOTICES.md +14 -14
- package/apps/sos-app/src/data/checks/aws.json +2 -2
- package/apps/sos-app/src/data/checks/checkov.json +59 -59
- package/apps/sos-app/src/data/checks/kubescape.json +1 -1
- package/apps/sos-app/src/data/checks/prowler_aws.json +1926 -491
- package/apps/sos-app/src/data/checks/prowler_azure.json +634 -137
- package/apps/sos-app/src/data/checks/prowler_cloudflare.json +207 -3
- package/apps/sos-app/src/data/checks/prowler_gcp.json +274 -92
- package/apps/sos-app/src/data/checks/prowler_github.json +193 -3
- package/apps/sos-app/src/data/checks/prowler_googleworkspace.json +459 -3
- package/apps/sos-app/src/data/checks/prowler_kubernetes.json +208 -75
- package/apps/sos-app/src/data/checks/prowler_m365.json +643 -69
- package/apps/sos-app/src/data/checks/prowler_okta.json +207 -3
- package/apps/sos-app/src/data/fedramp_rules.json +1 -1
- package/collector/package.json +1 -1
- package/collector/src/sources/aws/checks.js +4 -1
- package/collector/src/sources/prowler.js +81 -26
- package/package.json +1 -1
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"source": "prowler",
|
|
3
|
-
"title": "Prowler 5.
|
|
3
|
+
"title": "Prowler 5.47.0: Google Cloud (runs in the customer's CI with read-only credentials)",
|
|
4
4
|
"readScopes": [
|
|
5
5
|
"roles/viewer",
|
|
6
6
|
"roles/serviceusage.serviceUsageConsumer",
|
|
@@ -8,639 +8,821 @@
|
|
|
8
8
|
],
|
|
9
9
|
"engine": {
|
|
10
10
|
"name": "Prowler",
|
|
11
|
-
"version": "5.
|
|
11
|
+
"version": "5.47.0",
|
|
12
12
|
"licence": "Apache-2.0",
|
|
13
13
|
"url": "https://github.com/prowler-cloud/prowler"
|
|
14
14
|
},
|
|
15
15
|
"provider": "gcp",
|
|
16
16
|
"checks": [
|
|
17
|
+
{
|
|
18
|
+
"id": "prowler.gcp.apikeys_api_restricted_with_gemini_api",
|
|
19
|
+
"title": "API key is restricted to specific Google APIs when the Gemini (Generative Language) API is enabled",
|
|
20
|
+
"scope": "Prowler 5.47.0 check apikeys_api_restricted_with_gemini_api (Google Cloud apikeys, resource type apikeys.googleapis.com/Key): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
21
|
+
"evidenceType": "Configuration",
|
|
22
|
+
"severity": "high"
|
|
23
|
+
},
|
|
17
24
|
{
|
|
18
25
|
"id": "prowler.gcp.apikeys_api_restrictions_configured",
|
|
19
26
|
"title": "API key is restricted to specific Google APIs",
|
|
20
|
-
"scope": "Prowler 5.
|
|
27
|
+
"scope": "Prowler 5.47.0 check apikeys_api_restrictions_configured (Google Cloud apikeys, resource type apikeys.googleapis.com/Key): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
21
28
|
"evidenceType": "Configuration",
|
|
22
29
|
"severity": "high"
|
|
23
30
|
},
|
|
24
31
|
{
|
|
25
32
|
"id": "prowler.gcp.apikeys_key_exists",
|
|
26
33
|
"title": "Project has no active API keys",
|
|
27
|
-
"scope": "Prowler 5.
|
|
34
|
+
"scope": "Prowler 5.47.0 check apikeys_key_exists (Google Cloud apikeys, resource type apikeys.googleapis.com/Key): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
28
35
|
"evidenceType": "Configuration",
|
|
29
36
|
"severity": "medium"
|
|
30
37
|
},
|
|
31
38
|
{
|
|
32
39
|
"id": "prowler.gcp.apikeys_key_rotated_in_90_days",
|
|
33
40
|
"title": "API key was created within the last 90 days",
|
|
34
|
-
"scope": "Prowler 5.
|
|
41
|
+
"scope": "Prowler 5.47.0 check apikeys_key_rotated_in_90_days (Google Cloud apikeys, resource type apikeys.googleapis.com/Key): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
35
42
|
"evidenceType": "Configuration",
|
|
36
43
|
"severity": "medium"
|
|
37
44
|
},
|
|
45
|
+
{
|
|
46
|
+
"id": "prowler.gcp.appengine_version_php_runtime_supported",
|
|
47
|
+
"title": "App Engine serving version runs a supported PHP runtime",
|
|
48
|
+
"scope": "Prowler 5.47.0 check appengine_version_php_runtime_supported (Google Cloud appengine, resource type appengine.googleapis.com/Version): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
49
|
+
"evidenceType": "Configuration",
|
|
50
|
+
"severity": "critical"
|
|
51
|
+
},
|
|
38
52
|
{
|
|
39
53
|
"id": "prowler.gcp.artifacts_container_analysis_enabled",
|
|
40
54
|
"title": "GCP project has Artifact Registry Container Analysis API enabled",
|
|
41
|
-
"scope": "Prowler 5.
|
|
55
|
+
"scope": "Prowler 5.47.0 check artifacts_container_analysis_enabled (Google Cloud artifacts, resource type serviceusage.googleapis.com/Service): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
42
56
|
"evidenceType": "Configuration",
|
|
43
57
|
"severity": "medium"
|
|
44
58
|
},
|
|
45
59
|
{
|
|
46
60
|
"id": "prowler.gcp.bigquery_dataset_cmk_encryption",
|
|
47
61
|
"title": "BigQuery dataset is encrypted with Customer-Managed Keys (CMKs)",
|
|
48
|
-
"scope": "Prowler 5.
|
|
62
|
+
"scope": "Prowler 5.47.0 check bigquery_dataset_cmk_encryption (Google Cloud bigquery, resource type bigquery.googleapis.com/Dataset): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
49
63
|
"evidenceType": "Configuration",
|
|
50
64
|
"severity": "high"
|
|
51
65
|
},
|
|
52
66
|
{
|
|
53
67
|
"id": "prowler.gcp.bigquery_dataset_public_access",
|
|
54
68
|
"title": "BigQuery dataset is not publicly accessible",
|
|
55
|
-
"scope": "Prowler 5.
|
|
69
|
+
"scope": "Prowler 5.47.0 check bigquery_dataset_public_access (Google Cloud bigquery, resource type bigquery.googleapis.com/Dataset): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
56
70
|
"evidenceType": "Configuration",
|
|
57
71
|
"severity": "high"
|
|
58
72
|
},
|
|
59
73
|
{
|
|
60
74
|
"id": "prowler.gcp.bigquery_table_cmk_encryption",
|
|
61
75
|
"title": "BigQuery table is encrypted with a Customer-Managed Key (CMK)",
|
|
62
|
-
"scope": "Prowler 5.
|
|
76
|
+
"scope": "Prowler 5.47.0 check bigquery_table_cmk_encryption (Google Cloud bigquery, resource type bigquery.googleapis.com/Table): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
63
77
|
"evidenceType": "Configuration",
|
|
64
78
|
"severity": "high"
|
|
65
79
|
},
|
|
66
80
|
{
|
|
67
81
|
"id": "prowler.gcp.cloudfunction_function_inside_vpc",
|
|
68
82
|
"title": "Cloud Function is connected to a VPC network",
|
|
69
|
-
"scope": "Prowler 5.
|
|
83
|
+
"scope": "Prowler 5.47.0 check cloudfunction_function_inside_vpc (Google Cloud cloudfunction, resource type cloudfunctions.googleapis.com/Function): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
70
84
|
"evidenceType": "Configuration",
|
|
71
85
|
"severity": "medium"
|
|
72
86
|
},
|
|
73
87
|
{
|
|
74
88
|
"id": "prowler.gcp.cloudfunction_function_not_publicly_accessible",
|
|
75
89
|
"title": "Cloud Function is not publicly invocable",
|
|
76
|
-
"scope": "Prowler 5.
|
|
90
|
+
"scope": "Prowler 5.47.0 check cloudfunction_function_not_publicly_accessible (Google Cloud cloudfunction, resource type cloudfunctions.googleapis.com/Function): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
77
91
|
"evidenceType": "Configuration",
|
|
78
92
|
"severity": "high"
|
|
79
93
|
},
|
|
80
94
|
{
|
|
81
95
|
"id": "prowler.gcp.cloudsql_instance_automated_backups",
|
|
82
96
|
"title": "Cloud SQL database instance has automated backups configured",
|
|
83
|
-
"scope": "Prowler 5.
|
|
97
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_automated_backups (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
84
98
|
"evidenceType": "Configuration",
|
|
85
99
|
"severity": "high"
|
|
86
100
|
},
|
|
87
101
|
{
|
|
88
102
|
"id": "prowler.gcp.cloudsql_instance_cmek_encryption_enabled",
|
|
89
103
|
"title": "Cloud SQL instance is encrypted with a customer-managed key (CMEK)",
|
|
90
|
-
"scope": "Prowler 5.
|
|
104
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_cmek_encryption_enabled (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
91
105
|
"evidenceType": "Configuration",
|
|
92
106
|
"severity": "medium"
|
|
93
107
|
},
|
|
94
108
|
{
|
|
95
109
|
"id": "prowler.gcp.cloudsql_instance_high_availability_enabled",
|
|
96
110
|
"title": "Cloud SQL instance has high availability (REGIONAL) configured",
|
|
97
|
-
"scope": "Prowler 5.
|
|
111
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_high_availability_enabled (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
98
112
|
"evidenceType": "Configuration",
|
|
99
113
|
"severity": "medium"
|
|
100
114
|
},
|
|
115
|
+
{
|
|
116
|
+
"id": "prowler.gcp.cloudsql_instance_mysql_local_infile_flag",
|
|
117
|
+
"title": "Cloud SQL MySQL instance has the local_infile database flag set to off",
|
|
118
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_mysql_local_infile_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
119
|
+
"evidenceType": "Configuration",
|
|
120
|
+
"severity": "high"
|
|
121
|
+
},
|
|
122
|
+
{
|
|
123
|
+
"id": "prowler.gcp.cloudsql_instance_mysql_skip_show_database_flag",
|
|
124
|
+
"title": "Cloud SQL MySQL instance has skip_show_database flag set to on",
|
|
125
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_mysql_skip_show_database_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
126
|
+
"evidenceType": "Configuration",
|
|
127
|
+
"severity": "low"
|
|
128
|
+
},
|
|
101
129
|
{
|
|
102
130
|
"id": "prowler.gcp.cloudsql_instance_postgres_enable_pgaudit_flag",
|
|
103
131
|
"title": "Cloud SQL PostgreSQL instance has 'cloudsql.enable_pgaudit' flag set to 'on'",
|
|
104
|
-
"scope": "Prowler 5.
|
|
132
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_postgres_enable_pgaudit_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
105
133
|
"evidenceType": "Configuration",
|
|
106
134
|
"severity": "high"
|
|
107
135
|
},
|
|
108
136
|
{
|
|
109
137
|
"id": "prowler.gcp.cloudsql_instance_postgres_log_connections_flag",
|
|
110
138
|
"title": "Cloud SQL PostgreSQL instance has log_connections flag set to on",
|
|
111
|
-
"scope": "Prowler 5.
|
|
139
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_postgres_log_connections_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
112
140
|
"evidenceType": "Configuration",
|
|
113
141
|
"severity": "medium"
|
|
114
142
|
},
|
|
115
143
|
{
|
|
116
144
|
"id": "prowler.gcp.cloudsql_instance_postgres_log_disconnections_flag",
|
|
117
145
|
"title": "Cloud SQL PostgreSQL instance has log_disconnections flag set to on",
|
|
118
|
-
"scope": "Prowler 5.
|
|
146
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_postgres_log_disconnections_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
119
147
|
"evidenceType": "Configuration",
|
|
120
148
|
"severity": "medium"
|
|
121
149
|
},
|
|
122
150
|
{
|
|
123
151
|
"id": "prowler.gcp.cloudsql_instance_postgres_log_error_verbosity_flag",
|
|
124
152
|
"title": "Cloud SQL PostgreSQL instance has log_error_verbosity flag set to default",
|
|
125
|
-
"scope": "Prowler 5.
|
|
153
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_postgres_log_error_verbosity_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
126
154
|
"evidenceType": "Configuration",
|
|
127
155
|
"severity": "medium"
|
|
128
156
|
},
|
|
129
157
|
{
|
|
130
158
|
"id": "prowler.gcp.cloudsql_instance_postgres_log_min_duration_statement_flag",
|
|
131
159
|
"title": "Cloud SQL PostgreSQL instance has the log_min_duration_statement flag set to -1",
|
|
132
|
-
"scope": "Prowler 5.
|
|
160
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_postgres_log_min_duration_statement_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
133
161
|
"evidenceType": "Configuration",
|
|
134
162
|
"severity": "medium"
|
|
135
163
|
},
|
|
136
164
|
{
|
|
137
165
|
"id": "prowler.gcp.cloudsql_instance_postgres_log_min_error_statement_flag",
|
|
138
166
|
"title": "Cloud SQL for PostgreSQL instance has log_min_error_statement set to error",
|
|
139
|
-
"scope": "Prowler 5.
|
|
167
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_postgres_log_min_error_statement_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
140
168
|
"evidenceType": "Configuration",
|
|
141
169
|
"severity": "medium"
|
|
142
170
|
},
|
|
143
171
|
{
|
|
144
172
|
"id": "prowler.gcp.cloudsql_instance_postgres_log_min_messages_flag",
|
|
145
173
|
"title": "Cloud SQL PostgreSQL instance has the log_min_messages flag set to WARNING or higher",
|
|
146
|
-
"scope": "Prowler 5.
|
|
174
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_postgres_log_min_messages_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
147
175
|
"evidenceType": "Configuration",
|
|
148
176
|
"severity": "medium"
|
|
149
177
|
},
|
|
150
178
|
{
|
|
151
179
|
"id": "prowler.gcp.cloudsql_instance_postgres_log_statement_flag",
|
|
152
180
|
"title": "Cloud SQL PostgreSQL instance has 'log_statement' flag set to 'ddl'",
|
|
153
|
-
"scope": "Prowler 5.
|
|
181
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_postgres_log_statement_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
154
182
|
"evidenceType": "Configuration",
|
|
155
183
|
"severity": "medium"
|
|
156
184
|
},
|
|
157
185
|
{
|
|
158
186
|
"id": "prowler.gcp.cloudsql_instance_private_ip_assignment",
|
|
159
187
|
"title": "Cloud SQL instance has no public IP addresses",
|
|
160
|
-
"scope": "Prowler 5.
|
|
188
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_private_ip_assignment (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
161
189
|
"evidenceType": "Configuration",
|
|
162
190
|
"severity": "high"
|
|
163
191
|
},
|
|
164
192
|
{
|
|
165
193
|
"id": "prowler.gcp.cloudsql_instance_public_access",
|
|
166
194
|
"title": "Cloud SQL instance does not allow 0.0.0.0/0 in authorized networks",
|
|
167
|
-
"scope": "Prowler 5.
|
|
195
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_public_access (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
168
196
|
"evidenceType": "Configuration",
|
|
169
197
|
"severity": "critical"
|
|
170
198
|
},
|
|
171
199
|
{
|
|
172
200
|
"id": "prowler.gcp.cloudsql_instance_public_ip",
|
|
173
201
|
"title": "Cloud SQL database instance does not have a public IP address",
|
|
174
|
-
"scope": "Prowler 5.
|
|
202
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_public_ip (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
175
203
|
"evidenceType": "Configuration",
|
|
176
204
|
"severity": "high"
|
|
177
205
|
},
|
|
206
|
+
{
|
|
207
|
+
"id": "prowler.gcp.cloudsql_instance_sqlserver_contained_database_authentication_flag",
|
|
208
|
+
"title": "Cloud SQL for SQL Server instance has 'contained database authentication' flag set to off",
|
|
209
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_contained_database_authentication_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
210
|
+
"evidenceType": "Configuration",
|
|
211
|
+
"severity": "medium"
|
|
212
|
+
},
|
|
178
213
|
{
|
|
179
214
|
"id": "prowler.gcp.cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag",
|
|
180
215
|
"title": "Cloud SQL SQL Server instance has 'cross db ownership chaining' flag set to off",
|
|
181
|
-
"scope": "Prowler 5.
|
|
216
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
182
217
|
"evidenceType": "Configuration",
|
|
183
218
|
"severity": "high"
|
|
184
219
|
},
|
|
185
220
|
{
|
|
186
221
|
"id": "prowler.gcp.cloudsql_instance_sqlserver_external_scripts_enabled_flag",
|
|
187
222
|
"title": "Cloud SQL SQL Server instance has 'external scripts enabled' flag set to 'off'",
|
|
188
|
-
"scope": "Prowler 5.
|
|
223
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_external_scripts_enabled_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
189
224
|
"evidenceType": "Configuration",
|
|
190
225
|
"severity": "high"
|
|
191
226
|
},
|
|
192
227
|
{
|
|
193
228
|
"id": "prowler.gcp.cloudsql_instance_sqlserver_remote_access_flag",
|
|
194
229
|
"title": "Cloud SQL SQL Server instance has 'remote access' database flag set to 'off'",
|
|
195
|
-
"scope": "Prowler 5.
|
|
230
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_remote_access_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
196
231
|
"evidenceType": "Configuration",
|
|
197
232
|
"severity": "medium"
|
|
198
233
|
},
|
|
199
234
|
{
|
|
200
235
|
"id": "prowler.gcp.cloudsql_instance_sqlserver_trace_flag",
|
|
201
236
|
"title": "Cloud SQL for SQL Server instance has trace flag 3625 set to 'on'",
|
|
202
|
-
"scope": "Prowler 5.
|
|
237
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_trace_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
238
|
+
"evidenceType": "Configuration",
|
|
239
|
+
"severity": "medium"
|
|
240
|
+
},
|
|
241
|
+
{
|
|
242
|
+
"id": "prowler.gcp.cloudsql_instance_sqlserver_user_connections_flag",
|
|
243
|
+
"title": "Cloud SQL SQL Server instance has the 'user connections' database flag set to 0",
|
|
244
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_user_connections_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
245
|
+
"evidenceType": "Configuration",
|
|
246
|
+
"severity": "medium"
|
|
247
|
+
},
|
|
248
|
+
{
|
|
249
|
+
"id": "prowler.gcp.cloudsql_instance_sqlserver_user_options_flag",
|
|
250
|
+
"title": "Cloud SQL for SQL Server instance does not have the 'user options' flag configured",
|
|
251
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_user_options_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
203
252
|
"evidenceType": "Configuration",
|
|
204
253
|
"severity": "medium"
|
|
205
254
|
},
|
|
206
255
|
{
|
|
207
256
|
"id": "prowler.gcp.cloudsql_instance_ssl_connections",
|
|
208
257
|
"title": "Cloud SQL database instance requires SSL for all incoming connections",
|
|
209
|
-
"scope": "Prowler 5.
|
|
258
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_ssl_connections (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
210
259
|
"evidenceType": "Configuration",
|
|
211
260
|
"severity": "high"
|
|
212
261
|
},
|
|
213
262
|
{
|
|
214
263
|
"id": "prowler.gcp.cloudstorage_audit_logs_enabled",
|
|
215
264
|
"title": "Data Access audit logs are enabled for Cloud Storage",
|
|
216
|
-
"scope": "Prowler 5.
|
|
265
|
+
"scope": "Prowler 5.47.0 check cloudstorage_audit_logs_enabled (Google Cloud cloudstorage, resource type cloudresourcemanager.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
217
266
|
"evidenceType": "Configuration",
|
|
218
267
|
"severity": "medium"
|
|
219
268
|
},
|
|
269
|
+
{
|
|
270
|
+
"id": "prowler.gcp.cloudstorage_bucket_lifecycle_management_enabled",
|
|
271
|
+
"title": "Cloud Storage bucket has lifecycle management enabled with at least one valid rule",
|
|
272
|
+
"scope": "Prowler 5.47.0 check cloudstorage_bucket_lifecycle_management_enabled (Google Cloud cloudstorage, resource type storage.googleapis.com/Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
273
|
+
"evidenceType": "Configuration",
|
|
274
|
+
"severity": "low"
|
|
275
|
+
},
|
|
220
276
|
{
|
|
221
277
|
"id": "prowler.gcp.cloudstorage_bucket_log_retention_policy_lock",
|
|
222
278
|
"title": "Cloud Storage log sink bucket has a retention policy with Bucket Lock enabled",
|
|
223
|
-
"scope": "Prowler 5.
|
|
279
|
+
"scope": "Prowler 5.47.0 check cloudstorage_bucket_log_retention_policy_lock (Google Cloud cloudstorage, resource type storage.googleapis.com/Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
224
280
|
"evidenceType": "Configuration",
|
|
225
281
|
"severity": "high"
|
|
226
282
|
},
|
|
227
283
|
{
|
|
228
284
|
"id": "prowler.gcp.cloudstorage_bucket_logging_enabled",
|
|
229
285
|
"title": "Cloud Storage buckets have Usage and Storage Logs enabled",
|
|
230
|
-
"scope": "Prowler 5.
|
|
286
|
+
"scope": "Prowler 5.47.0 check cloudstorage_bucket_logging_enabled (Google Cloud cloudstorage, resource type storage.googleapis.com/Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
231
287
|
"evidenceType": "Configuration",
|
|
232
288
|
"severity": "medium"
|
|
233
289
|
},
|
|
234
290
|
{
|
|
235
291
|
"id": "prowler.gcp.cloudstorage_bucket_public_access",
|
|
236
292
|
"title": "Cloud Storage bucket is not publicly accessible",
|
|
237
|
-
"scope": "Prowler 5.
|
|
293
|
+
"scope": "Prowler 5.47.0 check cloudstorage_bucket_public_access (Google Cloud cloudstorage, resource type storage.googleapis.com/Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
238
294
|
"evidenceType": "Configuration",
|
|
239
295
|
"severity": "critical"
|
|
240
296
|
},
|
|
241
297
|
{
|
|
242
298
|
"id": "prowler.gcp.cloudstorage_bucket_soft_delete_enabled",
|
|
243
299
|
"title": "Cloud Storage bucket has Soft Delete enabled",
|
|
244
|
-
"scope": "Prowler 5.
|
|
300
|
+
"scope": "Prowler 5.47.0 check cloudstorage_bucket_soft_delete_enabled (Google Cloud cloudstorage, resource type storage.googleapis.com/Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
245
301
|
"evidenceType": "Configuration",
|
|
246
302
|
"severity": "medium"
|
|
247
303
|
},
|
|
248
304
|
{
|
|
249
305
|
"id": "prowler.gcp.cloudstorage_bucket_sufficient_retention_period",
|
|
250
306
|
"title": "Cloud Storage bucket has a sufficient Retention Policy period",
|
|
251
|
-
"scope": "Prowler 5.
|
|
307
|
+
"scope": "Prowler 5.47.0 check cloudstorage_bucket_sufficient_retention_period (Google Cloud cloudstorage, resource type storage.googleapis.com/Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
252
308
|
"evidenceType": "Configuration",
|
|
253
309
|
"severity": "medium"
|
|
254
310
|
},
|
|
255
311
|
{
|
|
256
312
|
"id": "prowler.gcp.cloudstorage_bucket_uniform_bucket_level_access",
|
|
257
313
|
"title": "Cloud Storage bucket has uniform bucket-level access enabled",
|
|
258
|
-
"scope": "Prowler 5.
|
|
314
|
+
"scope": "Prowler 5.47.0 check cloudstorage_bucket_uniform_bucket_level_access (Google Cloud cloudstorage, resource type storage.googleapis.com/Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
259
315
|
"evidenceType": "Configuration",
|
|
260
316
|
"severity": "medium"
|
|
261
317
|
},
|
|
262
318
|
{
|
|
263
319
|
"id": "prowler.gcp.cloudstorage_bucket_versioning_enabled",
|
|
264
320
|
"title": "Cloud Storage bucket has Object Versioning enabled",
|
|
265
|
-
"scope": "Prowler 5.
|
|
321
|
+
"scope": "Prowler 5.47.0 check cloudstorage_bucket_versioning_enabled (Google Cloud cloudstorage, resource type storage.googleapis.com/Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
266
322
|
"evidenceType": "Configuration",
|
|
267
323
|
"severity": "medium"
|
|
268
324
|
},
|
|
269
325
|
{
|
|
270
326
|
"id": "prowler.gcp.cloudstorage_uses_vpc_service_controls",
|
|
271
327
|
"title": "Cloud Storage services are protected by VPC Service Controls",
|
|
272
|
-
"scope": "Prowler 5.
|
|
328
|
+
"scope": "Prowler 5.47.0 check cloudstorage_uses_vpc_service_controls (Google Cloud cloudstorage, resource type cloudresourcemanager.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
273
329
|
"evidenceType": "Configuration",
|
|
274
330
|
"severity": "medium"
|
|
275
331
|
},
|
|
276
332
|
{
|
|
277
333
|
"id": "prowler.gcp.compute_firewall_rdp_access_from_the_internet_allowed",
|
|
278
334
|
"title": "Firewall rule does not allow ingress from 0.0.0.0/0 to TCP port 3389 (RDP)",
|
|
279
|
-
"scope": "Prowler 5.
|
|
335
|
+
"scope": "Prowler 5.47.0 check compute_firewall_rdp_access_from_the_internet_allowed (Google Cloud compute, resource type compute.googleapis.com/Firewall): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
280
336
|
"evidenceType": "Configuration",
|
|
281
337
|
"severity": "critical"
|
|
282
338
|
},
|
|
283
339
|
{
|
|
284
340
|
"id": "prowler.gcp.compute_firewall_ssh_access_from_the_internet_allowed",
|
|
285
341
|
"title": "Firewall does not expose TCP port 22 (SSH) to the Internet",
|
|
286
|
-
"scope": "Prowler 5.
|
|
342
|
+
"scope": "Prowler 5.47.0 check compute_firewall_ssh_access_from_the_internet_allowed (Google Cloud compute, resource type compute.googleapis.com/Firewall): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
287
343
|
"evidenceType": "Configuration",
|
|
288
344
|
"severity": "critical"
|
|
289
345
|
},
|
|
290
346
|
{
|
|
291
347
|
"id": "prowler.gcp.compute_image_not_publicly_shared",
|
|
292
348
|
"title": "Compute Engine disk image is not publicly shared",
|
|
293
|
-
"scope": "Prowler 5.
|
|
349
|
+
"scope": "Prowler 5.47.0 check compute_image_not_publicly_shared (Google Cloud compute, resource type compute.googleapis.com/Image): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
294
350
|
"evidenceType": "Configuration",
|
|
295
351
|
"severity": "medium"
|
|
296
352
|
},
|
|
297
353
|
{
|
|
298
354
|
"id": "prowler.gcp.compute_instance_automatic_restart_enabled",
|
|
299
355
|
"title": "Compute Engine VM instances have Automatic Restart enabled",
|
|
300
|
-
"scope": "Prowler 5.
|
|
356
|
+
"scope": "Prowler 5.47.0 check compute_instance_automatic_restart_enabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
301
357
|
"evidenceType": "Configuration",
|
|
302
358
|
"severity": "medium"
|
|
303
359
|
},
|
|
304
360
|
{
|
|
305
361
|
"id": "prowler.gcp.compute_instance_block_project_wide_ssh_keys_disabled",
|
|
306
362
|
"title": "VM instance has Block project-wide SSH keys enabled",
|
|
307
|
-
"scope": "Prowler 5.
|
|
363
|
+
"scope": "Prowler 5.47.0 check compute_instance_block_project_wide_ssh_keys_disabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
308
364
|
"evidenceType": "Configuration",
|
|
309
365
|
"severity": "medium"
|
|
310
366
|
},
|
|
311
367
|
{
|
|
312
368
|
"id": "prowler.gcp.compute_instance_confidential_computing_enabled",
|
|
313
369
|
"title": "Compute instance has Confidential Computing enabled",
|
|
314
|
-
"scope": "Prowler 5.
|
|
370
|
+
"scope": "Prowler 5.47.0 check compute_instance_confidential_computing_enabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
315
371
|
"evidenceType": "Configuration",
|
|
316
372
|
"severity": "medium"
|
|
317
373
|
},
|
|
318
374
|
{
|
|
319
375
|
"id": "prowler.gcp.compute_instance_default_service_account_in_use",
|
|
320
376
|
"title": "Compute Engine instance does not use the default service account",
|
|
321
|
-
"scope": "Prowler 5.
|
|
377
|
+
"scope": "Prowler 5.47.0 check compute_instance_default_service_account_in_use (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
322
378
|
"evidenceType": "Configuration",
|
|
323
379
|
"severity": "medium"
|
|
324
380
|
},
|
|
325
381
|
{
|
|
326
382
|
"id": "prowler.gcp.compute_instance_default_service_account_in_use_with_full_api_access",
|
|
327
383
|
"title": "Compute Engine instance does not use the default service account with full access to all Cloud APIs",
|
|
328
|
-
"scope": "Prowler 5.
|
|
384
|
+
"scope": "Prowler 5.47.0 check compute_instance_default_service_account_in_use_with_full_api_access (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
385
|
+
"evidenceType": "Configuration",
|
|
386
|
+
"severity": "medium"
|
|
387
|
+
},
|
|
388
|
+
{
|
|
389
|
+
"id": "prowler.gcp.compute_instance_deletion_protection_enabled",
|
|
390
|
+
"title": "VM instance has deletion protection enabled",
|
|
391
|
+
"scope": "Prowler 5.47.0 check compute_instance_deletion_protection_enabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
392
|
+
"evidenceType": "Configuration",
|
|
393
|
+
"severity": "medium"
|
|
394
|
+
},
|
|
395
|
+
{
|
|
396
|
+
"id": "prowler.gcp.compute_instance_disk_auto_delete_disabled",
|
|
397
|
+
"title": "VM instance attached disks have auto-delete disabled",
|
|
398
|
+
"scope": "Prowler 5.47.0 check compute_instance_disk_auto_delete_disabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
329
399
|
"evidenceType": "Configuration",
|
|
330
400
|
"severity": "medium"
|
|
331
401
|
},
|
|
332
402
|
{
|
|
333
403
|
"id": "prowler.gcp.compute_instance_encryption_with_csek_enabled",
|
|
334
404
|
"title": "VM instance has all disks encrypted with Customer-Supplied Encryption Keys (CSEK)",
|
|
335
|
-
"scope": "Prowler 5.
|
|
405
|
+
"scope": "Prowler 5.47.0 check compute_instance_encryption_with_csek_enabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
336
406
|
"evidenceType": "Configuration",
|
|
337
407
|
"severity": "high"
|
|
338
408
|
},
|
|
339
409
|
{
|
|
340
410
|
"id": "prowler.gcp.compute_instance_group_autohealing_enabled",
|
|
341
411
|
"title": "Managed Instance Group has autohealing enabled with a valid health check",
|
|
342
|
-
"scope": "Prowler 5.
|
|
412
|
+
"scope": "Prowler 5.47.0 check compute_instance_group_autohealing_enabled (Google Cloud compute, resource type compute.googleapis.com/InstanceGroupManager): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
343
413
|
"evidenceType": "Configuration",
|
|
344
414
|
"severity": "high"
|
|
345
415
|
},
|
|
346
416
|
{
|
|
347
417
|
"id": "prowler.gcp.compute_instance_group_load_balancer_attached",
|
|
348
418
|
"title": "Managed Instance Group is attached to a load balancer",
|
|
349
|
-
"scope": "Prowler 5.
|
|
419
|
+
"scope": "Prowler 5.47.0 check compute_instance_group_load_balancer_attached (Google Cloud compute, resource type compute.googleapis.com/InstanceGroupManager): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
350
420
|
"evidenceType": "Configuration",
|
|
351
421
|
"severity": "low"
|
|
352
422
|
},
|
|
353
423
|
{
|
|
354
424
|
"id": "prowler.gcp.compute_instance_group_multiple_zones",
|
|
355
425
|
"title": "Managed Instance Groups span multiple zones for high availability",
|
|
356
|
-
"scope": "Prowler 5.
|
|
426
|
+
"scope": "Prowler 5.47.0 check compute_instance_group_multiple_zones (Google Cloud compute, resource type compute.googleapis.com/InstanceGroupManager): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
357
427
|
"evidenceType": "Configuration",
|
|
358
428
|
"severity": "low"
|
|
359
429
|
},
|
|
360
430
|
{
|
|
361
431
|
"id": "prowler.gcp.compute_instance_ip_forwarding_is_enabled",
|
|
362
432
|
"title": "Compute Engine VM instance has IP forwarding disabled",
|
|
363
|
-
"scope": "Prowler 5.
|
|
433
|
+
"scope": "Prowler 5.47.0 check compute_instance_ip_forwarding_is_enabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
364
434
|
"evidenceType": "Configuration",
|
|
365
435
|
"severity": "medium"
|
|
366
436
|
},
|
|
367
437
|
{
|
|
368
438
|
"id": "prowler.gcp.compute_instance_on_host_maintenance_migrate",
|
|
369
439
|
"title": "Compute Engine VM instance has On Host Maintenance set to MIGRATE",
|
|
370
|
-
"scope": "Prowler 5.
|
|
440
|
+
"scope": "Prowler 5.47.0 check compute_instance_on_host_maintenance_migrate (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
371
441
|
"evidenceType": "Configuration",
|
|
372
442
|
"severity": "medium"
|
|
373
443
|
},
|
|
374
444
|
{
|
|
375
445
|
"id": "prowler.gcp.compute_instance_preemptible_vm_disabled",
|
|
376
446
|
"title": "VM instance is not configured as preemptible or Spot VM",
|
|
377
|
-
"scope": "Prowler 5.
|
|
447
|
+
"scope": "Prowler 5.47.0 check compute_instance_preemptible_vm_disabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
378
448
|
"evidenceType": "Configuration",
|
|
379
449
|
"severity": "medium"
|
|
380
450
|
},
|
|
381
451
|
{
|
|
382
452
|
"id": "prowler.gcp.compute_instance_public_ip",
|
|
383
453
|
"title": "VM instance does not have a public IP address",
|
|
384
|
-
"scope": "Prowler 5.
|
|
454
|
+
"scope": "Prowler 5.47.0 check compute_instance_public_ip (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
385
455
|
"evidenceType": "Configuration",
|
|
386
456
|
"severity": "high"
|
|
387
457
|
},
|
|
458
|
+
{
|
|
459
|
+
"id": "prowler.gcp.compute_instance_serial_ports_in_use",
|
|
460
|
+
"title": "VM instance has 'Enable Connecting to Serial Ports' disabled",
|
|
461
|
+
"scope": "Prowler 5.47.0 check compute_instance_serial_ports_in_use (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
462
|
+
"evidenceType": "Configuration",
|
|
463
|
+
"severity": "medium"
|
|
464
|
+
},
|
|
388
465
|
{
|
|
389
466
|
"id": "prowler.gcp.compute_instance_shielded_vm_enabled",
|
|
390
467
|
"title": "Compute instance has vTPM and Integrity Monitoring enabled",
|
|
391
|
-
"scope": "Prowler 5.
|
|
468
|
+
"scope": "Prowler 5.47.0 check compute_instance_shielded_vm_enabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
392
469
|
"evidenceType": "Configuration",
|
|
393
470
|
"severity": "medium"
|
|
394
471
|
},
|
|
395
472
|
{
|
|
396
473
|
"id": "prowler.gcp.compute_instance_single_network_interface",
|
|
397
474
|
"title": "VM instance has a single network interface",
|
|
398
|
-
"scope": "Prowler 5.
|
|
475
|
+
"scope": "Prowler 5.47.0 check compute_instance_single_network_interface (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
476
|
+
"evidenceType": "Configuration",
|
|
477
|
+
"severity": "medium"
|
|
478
|
+
},
|
|
479
|
+
{
|
|
480
|
+
"id": "prowler.gcp.compute_instance_suspended_without_persistent_disks",
|
|
481
|
+
"title": "Suspended VM instance does not have persistent disks attached",
|
|
482
|
+
"scope": "Prowler 5.47.0 check compute_instance_suspended_without_persistent_disks (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
399
483
|
"evidenceType": "Configuration",
|
|
400
484
|
"severity": "medium"
|
|
401
485
|
},
|
|
402
486
|
{
|
|
403
487
|
"id": "prowler.gcp.compute_loadbalancer_logging_enabled",
|
|
404
488
|
"title": "HTTP(S) load balancer has logging enabled",
|
|
405
|
-
"scope": "Prowler 5.
|
|
489
|
+
"scope": "Prowler 5.47.0 check compute_loadbalancer_logging_enabled (Google Cloud compute, resource type compute.googleapis.com/BackendService): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
406
490
|
"evidenceType": "Configuration",
|
|
407
491
|
"severity": "high"
|
|
408
492
|
},
|
|
409
493
|
{
|
|
410
494
|
"id": "prowler.gcp.compute_network_default_in_use",
|
|
411
495
|
"title": "Project does not have a default VPC network",
|
|
412
|
-
"scope": "Prowler 5.
|
|
496
|
+
"scope": "Prowler 5.47.0 check compute_network_default_in_use (Google Cloud compute, resource type compute.googleapis.com/Network): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
413
497
|
"evidenceType": "Configuration",
|
|
414
498
|
"severity": "medium"
|
|
415
499
|
},
|
|
416
500
|
{
|
|
417
501
|
"id": "prowler.gcp.compute_network_dns_logging_enabled",
|
|
418
502
|
"title": "VPC network has Cloud DNS logging enabled",
|
|
419
|
-
"scope": "Prowler 5.
|
|
503
|
+
"scope": "Prowler 5.47.0 check compute_network_dns_logging_enabled (Google Cloud compute, resource type compute.googleapis.com/Network): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
504
|
+
"evidenceType": "Configuration",
|
|
505
|
+
"severity": "medium"
|
|
506
|
+
},
|
|
507
|
+
{
|
|
508
|
+
"id": "prowler.gcp.compute_network_not_legacy",
|
|
509
|
+
"title": "VPC network is not legacy",
|
|
510
|
+
"scope": "Prowler 5.47.0 check compute_network_not_legacy (Google Cloud compute, resource type compute.googleapis.com/Network): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
420
511
|
"evidenceType": "Configuration",
|
|
421
512
|
"severity": "medium"
|
|
422
513
|
},
|
|
514
|
+
{
|
|
515
|
+
"id": "prowler.gcp.compute_project_os_login_2fa_enabled",
|
|
516
|
+
"title": "GCP project has OS Login with 2FA enabled",
|
|
517
|
+
"scope": "Prowler 5.47.0 check compute_project_os_login_2fa_enabled (Google Cloud compute, resource type compute.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
518
|
+
"evidenceType": "Configuration",
|
|
519
|
+
"severity": "high"
|
|
520
|
+
},
|
|
521
|
+
{
|
|
522
|
+
"id": "prowler.gcp.compute_project_os_login_enabled",
|
|
523
|
+
"title": "Project has OS Login enabled",
|
|
524
|
+
"scope": "Prowler 5.47.0 check compute_project_os_login_enabled (Google Cloud compute, resource type compute.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
525
|
+
"evidenceType": "Configuration",
|
|
526
|
+
"severity": "low"
|
|
527
|
+
},
|
|
528
|
+
{
|
|
529
|
+
"id": "prowler.gcp.compute_public_address_shodan",
|
|
530
|
+
"title": "Public IP address is not listed in Shodan",
|
|
531
|
+
"scope": "Prowler 5.47.0 check compute_public_address_shodan (Google Cloud compute, resource type compute.googleapis.com/Address): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
532
|
+
"evidenceType": "Configuration",
|
|
533
|
+
"severity": "medium"
|
|
534
|
+
},
|
|
535
|
+
{
|
|
536
|
+
"id": "prowler.gcp.compute_snapshot_not_outdated",
|
|
537
|
+
"title": "Compute Engine disk snapshot is not outdated",
|
|
538
|
+
"scope": "Prowler 5.47.0 check compute_snapshot_not_outdated (Google Cloud compute, resource type compute.googleapis.com/Snapshot): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
539
|
+
"evidenceType": "Configuration",
|
|
540
|
+
"severity": "low"
|
|
541
|
+
},
|
|
423
542
|
{
|
|
424
543
|
"id": "prowler.gcp.compute_subnet_flow_logs_enabled",
|
|
425
544
|
"title": "Subnet has VPC Flow Logs enabled",
|
|
426
|
-
"scope": "Prowler 5.
|
|
545
|
+
"scope": "Prowler 5.47.0 check compute_subnet_flow_logs_enabled (Google Cloud compute, resource type compute.googleapis.com/Subnetwork): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
427
546
|
"evidenceType": "Configuration",
|
|
428
547
|
"severity": "medium"
|
|
429
548
|
},
|
|
430
549
|
{
|
|
431
550
|
"id": "prowler.gcp.dataproc_encrypted_with_cmks_disabled",
|
|
432
551
|
"title": "Dataproc cluster is encrypted with a customer-managed encryption key (CMEK)",
|
|
433
|
-
"scope": "Prowler 5.
|
|
552
|
+
"scope": "Prowler 5.47.0 check dataproc_encrypted_with_cmks_disabled (Google Cloud dataproc, resource type dataproc.googleapis.com/Cluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
434
553
|
"evidenceType": "Configuration",
|
|
435
554
|
"severity": "medium"
|
|
436
555
|
},
|
|
437
556
|
{
|
|
438
557
|
"id": "prowler.gcp.dns_dnssec_disabled",
|
|
439
558
|
"title": "Cloud DNS managed zone has DNSSEC enabled",
|
|
440
|
-
"scope": "Prowler 5.
|
|
559
|
+
"scope": "Prowler 5.47.0 check dns_dnssec_disabled (Google Cloud dns, resource type dns.googleapis.com/ManagedZone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
441
560
|
"evidenceType": "Configuration",
|
|
442
561
|
"severity": "medium"
|
|
443
562
|
},
|
|
444
563
|
{
|
|
445
564
|
"id": "prowler.gcp.dns_rsasha1_in_use_to_key_sign_in_dnssec",
|
|
446
565
|
"title": "Cloud DNS managed zone DNSSEC key-signing key does not use RSASHA1",
|
|
447
|
-
"scope": "Prowler 5.
|
|
566
|
+
"scope": "Prowler 5.47.0 check dns_rsasha1_in_use_to_key_sign_in_dnssec (Google Cloud dns, resource type dns.googleapis.com/ManagedZone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
448
567
|
"evidenceType": "Configuration",
|
|
449
568
|
"severity": "medium"
|
|
450
569
|
},
|
|
451
570
|
{
|
|
452
571
|
"id": "prowler.gcp.dns_rsasha1_in_use_to_zone_sign_in_dnssec",
|
|
453
572
|
"title": "Cloud DNS managed zone does not use the RSASHA1 algorithm for the DNSSEC zone-signing key",
|
|
454
|
-
"scope": "Prowler 5.
|
|
573
|
+
"scope": "Prowler 5.47.0 check dns_rsasha1_in_use_to_zone_sign_in_dnssec (Google Cloud dns, resource type dns.googleapis.com/ManagedZone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
455
574
|
"evidenceType": "Configuration",
|
|
456
575
|
"severity": "medium"
|
|
457
576
|
},
|
|
458
577
|
{
|
|
459
578
|
"id": "prowler.gcp.gcr_container_scanning_enabled",
|
|
460
579
|
"title": "Project has GCR Container Scanning API enabled",
|
|
461
|
-
"scope": "Prowler 5.
|
|
580
|
+
"scope": "Prowler 5.47.0 check gcr_container_scanning_enabled (Google Cloud gcr, resource type serviceusage.googleapis.com/Service): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
581
|
+
"evidenceType": "Configuration",
|
|
582
|
+
"severity": "medium"
|
|
583
|
+
},
|
|
584
|
+
{
|
|
585
|
+
"id": "prowler.gcp.gemini_api_disabled",
|
|
586
|
+
"title": "Gemini (Generative Language) API is disabled",
|
|
587
|
+
"scope": "Prowler 5.47.0 check gemini_api_disabled (Google Cloud gemini, resource type serviceusage.googleapis.com/Service): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
462
588
|
"evidenceType": "Configuration",
|
|
463
589
|
"severity": "medium"
|
|
464
590
|
},
|
|
591
|
+
{
|
|
592
|
+
"id": "prowler.gcp.gke_cluster_no_default_service_account",
|
|
593
|
+
"title": "GKE cluster does not use the Compute Engine default service account",
|
|
594
|
+
"scope": "Prowler 5.47.0 check gke_cluster_no_default_service_account (Google Cloud gke, resource type container.googleapis.com/Cluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
595
|
+
"evidenceType": "Configuration",
|
|
596
|
+
"severity": "medium"
|
|
597
|
+
},
|
|
598
|
+
{
|
|
599
|
+
"id": "prowler.gcp.iam_account_access_approval_enabled",
|
|
600
|
+
"title": "Project has Access Approval enabled",
|
|
601
|
+
"scope": "Prowler 5.47.0 check iam_account_access_approval_enabled (Google Cloud iam, resource type accessapproval.googleapis.com/AccessApprovalSettings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
602
|
+
"evidenceType": "Configuration",
|
|
603
|
+
"severity": "high"
|
|
604
|
+
},
|
|
465
605
|
{
|
|
466
606
|
"id": "prowler.gcp.iam_audit_logs_enabled",
|
|
467
607
|
"title": "GCP project has Cloud Audit Logs enabled",
|
|
468
|
-
"scope": "Prowler 5.
|
|
608
|
+
"scope": "Prowler 5.47.0 check iam_audit_logs_enabled (Google Cloud iam, resource type cloudresourcemanager.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
469
609
|
"evidenceType": "Configuration",
|
|
470
610
|
"severity": "medium"
|
|
471
611
|
},
|
|
472
612
|
{
|
|
473
613
|
"id": "prowler.gcp.iam_cloud_asset_inventory_enabled",
|
|
474
614
|
"title": "Project has Cloud Asset Inventory API enabled",
|
|
475
|
-
"scope": "Prowler 5.
|
|
615
|
+
"scope": "Prowler 5.47.0 check iam_cloud_asset_inventory_enabled (Google Cloud iam, resource type serviceusage.googleapis.com/Service): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
476
616
|
"evidenceType": "Configuration",
|
|
477
617
|
"severity": "high"
|
|
478
618
|
},
|
|
479
619
|
{
|
|
480
620
|
"id": "prowler.gcp.iam_no_service_roles_at_project_level",
|
|
481
621
|
"title": "Project has no IAM users assigned the Service Account User or Service Account Token Creator roles at project level",
|
|
482
|
-
"scope": "Prowler 5.
|
|
622
|
+
"scope": "Prowler 5.47.0 check iam_no_service_roles_at_project_level (Google Cloud iam, resource type cloudresourcemanager.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
623
|
+
"evidenceType": "Configuration",
|
|
624
|
+
"severity": "medium"
|
|
625
|
+
},
|
|
626
|
+
{
|
|
627
|
+
"id": "prowler.gcp.iam_organization_essential_contacts_configured",
|
|
628
|
+
"title": "Organization has Essential Contacts configured",
|
|
629
|
+
"scope": "Prowler 5.47.0 check iam_organization_essential_contacts_configured (Google Cloud iam, resource type cloudresourcemanager.googleapis.com/Organization): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
483
630
|
"evidenceType": "Configuration",
|
|
484
631
|
"severity": "medium"
|
|
485
632
|
},
|
|
486
633
|
{
|
|
487
634
|
"id": "prowler.gcp.iam_role_kms_enforce_separation_of_duties",
|
|
488
635
|
"title": "Project members are not assigned both Cloud KMS Admin and CryptoKey Encrypter/Decrypter roles",
|
|
489
|
-
"scope": "Prowler 5.
|
|
636
|
+
"scope": "Prowler 5.47.0 check iam_role_kms_enforce_separation_of_duties (Google Cloud iam, resource type cloudresourcemanager.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
490
637
|
"evidenceType": "Configuration",
|
|
491
638
|
"severity": "medium"
|
|
492
639
|
},
|
|
493
640
|
{
|
|
494
641
|
"id": "prowler.gcp.iam_role_sa_enforce_separation_of_duties",
|
|
495
642
|
"title": "Project enforces separation of duties for Service Account Admin and Service Account User roles",
|
|
496
|
-
"scope": "Prowler 5.
|
|
643
|
+
"scope": "Prowler 5.47.0 check iam_role_sa_enforce_separation_of_duties (Google Cloud iam, resource type cloudresourcemanager.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
497
644
|
"evidenceType": "Configuration",
|
|
498
645
|
"severity": "medium"
|
|
499
646
|
},
|
|
500
647
|
{
|
|
501
648
|
"id": "prowler.gcp.iam_sa_no_administrative_privileges",
|
|
502
649
|
"title": "Service account has no administrative privileges",
|
|
503
|
-
"scope": "Prowler 5.
|
|
650
|
+
"scope": "Prowler 5.47.0 check iam_sa_no_administrative_privileges (Google Cloud iam, resource type iam.googleapis.com/ServiceAccount): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
504
651
|
"evidenceType": "Configuration",
|
|
505
652
|
"severity": "high"
|
|
506
653
|
},
|
|
507
654
|
{
|
|
508
655
|
"id": "prowler.gcp.iam_sa_no_user_managed_keys",
|
|
509
656
|
"title": "Service account has no user-managed keys",
|
|
510
|
-
"scope": "Prowler 5.
|
|
657
|
+
"scope": "Prowler 5.47.0 check iam_sa_no_user_managed_keys (Google Cloud iam, resource type iam.googleapis.com/ServiceAccount): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
511
658
|
"evidenceType": "Configuration",
|
|
512
659
|
"severity": "medium"
|
|
513
660
|
},
|
|
514
661
|
{
|
|
515
662
|
"id": "prowler.gcp.iam_sa_user_managed_key_rotate_90_days",
|
|
516
663
|
"title": "Service account user-managed key has been rotated within the last 90 days",
|
|
517
|
-
"scope": "Prowler 5.
|
|
664
|
+
"scope": "Prowler 5.47.0 check iam_sa_user_managed_key_rotate_90_days (Google Cloud iam, resource type iam.googleapis.com/ServiceAccountKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
518
665
|
"evidenceType": "Configuration",
|
|
519
666
|
"severity": "low"
|
|
520
667
|
},
|
|
521
668
|
{
|
|
522
669
|
"id": "prowler.gcp.iam_sa_user_managed_key_unused",
|
|
523
670
|
"title": "User-managed service account key was used within the allowed inactivity period",
|
|
524
|
-
"scope": "Prowler 5.
|
|
671
|
+
"scope": "Prowler 5.47.0 check iam_sa_user_managed_key_unused (Google Cloud iam, resource type iam.googleapis.com/ServiceAccountKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
525
672
|
"evidenceType": "Configuration",
|
|
526
673
|
"severity": "medium"
|
|
527
674
|
},
|
|
528
675
|
{
|
|
529
676
|
"id": "prowler.gcp.iam_service_account_unused",
|
|
530
677
|
"title": "Service account was used within the configured maximum unused period",
|
|
531
|
-
"scope": "Prowler 5.
|
|
678
|
+
"scope": "Prowler 5.47.0 check iam_service_account_unused (Google Cloud iam, resource type iam.googleapis.com/ServiceAccount): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
532
679
|
"evidenceType": "Configuration",
|
|
533
680
|
"severity": "medium"
|
|
534
681
|
},
|
|
535
682
|
{
|
|
536
683
|
"id": "prowler.gcp.iam_workload_identity_pool_provider_attribute_condition",
|
|
537
684
|
"title": "Workload Identity Federation providers trusting a multi-tenant issuer enforce an attribute condition",
|
|
538
|
-
"scope": "Prowler 5.
|
|
685
|
+
"scope": "Prowler 5.47.0 check iam_workload_identity_pool_provider_attribute_condition (Google Cloud iam, resource type iam.googleapis.com/WorkloadIdentityPoolProvider): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
539
686
|
"evidenceType": "Configuration",
|
|
540
687
|
"severity": "high"
|
|
541
688
|
},
|
|
542
689
|
{
|
|
543
690
|
"id": "prowler.gcp.kms_key_not_publicly_accessible",
|
|
544
691
|
"title": "Cloud KMS key has no public IAM access",
|
|
545
|
-
"scope": "Prowler 5.
|
|
692
|
+
"scope": "Prowler 5.47.0 check kms_key_not_publicly_accessible (Google Cloud kms, resource type cloudkms.googleapis.com/CryptoKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
546
693
|
"evidenceType": "Configuration",
|
|
547
694
|
"severity": "high"
|
|
548
695
|
},
|
|
549
696
|
{
|
|
550
697
|
"id": "prowler.gcp.kms_key_rotation_enabled",
|
|
551
698
|
"title": "KMS key has automatic rotation enabled",
|
|
552
|
-
"scope": "Prowler 5.
|
|
699
|
+
"scope": "Prowler 5.47.0 check kms_key_rotation_enabled (Google Cloud kms, resource type cloudkms.googleapis.com/CryptoKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
553
700
|
"evidenceType": "Configuration",
|
|
554
701
|
"severity": "low"
|
|
555
702
|
},
|
|
556
703
|
{
|
|
557
704
|
"id": "prowler.gcp.kms_key_rotation_max_90_days",
|
|
558
705
|
"title": "KMS key is rotated every 90 days or less",
|
|
559
|
-
"scope": "Prowler 5.
|
|
706
|
+
"scope": "Prowler 5.47.0 check kms_key_rotation_max_90_days (Google Cloud kms, resource type cloudkms.googleapis.com/CryptoKey): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
560
707
|
"evidenceType": "Configuration",
|
|
561
708
|
"severity": "low"
|
|
562
709
|
},
|
|
563
710
|
{
|
|
564
711
|
"id": "prowler.gcp.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
|
|
565
712
|
"title": "Log metric filter for audit configuration changes has an associated alert policy",
|
|
566
|
-
"scope": "Prowler 5.
|
|
713
|
+
"scope": "Prowler 5.47.0 check logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled (Google Cloud logging, resource type logging.googleapis.com/LogMetric): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
567
714
|
"evidenceType": "Configuration",
|
|
568
715
|
"severity": "medium"
|
|
569
716
|
},
|
|
570
717
|
{
|
|
571
718
|
"id": "prowler.gcp.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
|
|
572
719
|
"title": "Log metric filter for Cloud Storage IAM permission changes has an associated alert policy",
|
|
573
|
-
"scope": "Prowler 5.
|
|
720
|
+
"scope": "Prowler 5.47.0 check logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled (Google Cloud logging, resource type logging.googleapis.com/LogMetric): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
574
721
|
"evidenceType": "Configuration",
|
|
575
722
|
"severity": "medium"
|
|
576
723
|
},
|
|
577
724
|
{
|
|
578
725
|
"id": "prowler.gcp.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled",
|
|
579
726
|
"title": "Compute Engine configuration changes are monitored with log metric filters and alerts",
|
|
580
|
-
"scope": "Prowler 5.
|
|
727
|
+
"scope": "Prowler 5.47.0 check logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled (Google Cloud logging, resource type MetricFilter): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
581
728
|
"evidenceType": "Configuration",
|
|
582
729
|
"severity": "medium"
|
|
583
730
|
},
|
|
584
731
|
{
|
|
585
732
|
"id": "prowler.gcp.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
|
|
586
733
|
"title": "Log metric filter for IAM custom role changes has an associated alert policy",
|
|
587
|
-
"scope": "Prowler 5.
|
|
734
|
+
"scope": "Prowler 5.47.0 check logging_log_metric_filter_and_alert_for_custom_role_changes_enabled (Google Cloud logging, resource type logging.googleapis.com/LogMetric): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
588
735
|
"evidenceType": "Configuration",
|
|
589
736
|
"severity": "medium"
|
|
590
737
|
},
|
|
591
738
|
{
|
|
592
739
|
"id": "prowler.gcp.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
|
|
593
740
|
"title": "Log metric filter for project ownership assignments/changes has an associated alert policy",
|
|
594
|
-
"scope": "Prowler 5.
|
|
741
|
+
"scope": "Prowler 5.47.0 check logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled (Google Cloud logging, resource type logging.googleapis.com/LogMetric): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
595
742
|
"evidenceType": "Configuration",
|
|
596
743
|
"severity": "medium"
|
|
597
744
|
},
|
|
598
745
|
{
|
|
599
746
|
"id": "prowler.gcp.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
|
|
600
747
|
"title": "Log metric filter for Cloud SQL instance configuration changes has an associated alert policy",
|
|
601
|
-
"scope": "Prowler 5.
|
|
748
|
+
"scope": "Prowler 5.47.0 check logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled (Google Cloud logging, resource type logging.googleapis.com/LogMetric): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
602
749
|
"evidenceType": "Configuration",
|
|
603
750
|
"severity": "medium"
|
|
604
751
|
},
|
|
605
752
|
{
|
|
606
753
|
"id": "prowler.gcp.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
|
|
607
754
|
"title": "Log metric filter for VPC network firewall rule changes has an associated alert policy",
|
|
608
|
-
"scope": "Prowler 5.
|
|
755
|
+
"scope": "Prowler 5.47.0 check logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled (Google Cloud logging, resource type logging.googleapis.com/LogMetric): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
609
756
|
"evidenceType": "Configuration",
|
|
610
757
|
"severity": "medium"
|
|
611
758
|
},
|
|
612
759
|
{
|
|
613
760
|
"id": "prowler.gcp.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
|
|
614
761
|
"title": "Log metric filter for VPC network changes has an associated alert policy",
|
|
615
|
-
"scope": "Prowler 5.
|
|
762
|
+
"scope": "Prowler 5.47.0 check logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled (Google Cloud logging, resource type logging.googleapis.com/LogMetric): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
616
763
|
"evidenceType": "Configuration",
|
|
617
764
|
"severity": "medium"
|
|
618
765
|
},
|
|
619
766
|
{
|
|
620
767
|
"id": "prowler.gcp.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled",
|
|
621
768
|
"title": "Log metric filter for VPC network route changes has an associated alert policy",
|
|
622
|
-
"scope": "Prowler 5.
|
|
769
|
+
"scope": "Prowler 5.47.0 check logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled (Google Cloud logging, resource type logging.googleapis.com/LogMetric): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
623
770
|
"evidenceType": "Configuration",
|
|
624
771
|
"severity": "medium"
|
|
625
772
|
},
|
|
626
773
|
{
|
|
627
774
|
"id": "prowler.gcp.logging_sink_created",
|
|
628
775
|
"title": "Project has at least one logging sink exporting copies of all log entries",
|
|
629
|
-
"scope": "Prowler 5.
|
|
776
|
+
"scope": "Prowler 5.47.0 check logging_sink_created (Google Cloud logging, resource type logging.googleapis.com/LogSink): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
630
777
|
"evidenceType": "Configuration",
|
|
631
778
|
"severity": "medium"
|
|
632
779
|
},
|
|
633
780
|
{
|
|
634
781
|
"id": "prowler.gcp.secretmanager_secret_not_publicly_accessible",
|
|
635
782
|
"title": "Secret Manager secret is not publicly accessible",
|
|
636
|
-
"scope": "Prowler 5.
|
|
783
|
+
"scope": "Prowler 5.47.0 check secretmanager_secret_not_publicly_accessible (Google Cloud secretmanager, resource type secretmanager.googleapis.com/Secret): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
637
784
|
"evidenceType": "Configuration",
|
|
638
785
|
"severity": "critical"
|
|
639
786
|
},
|
|
640
787
|
{
|
|
641
788
|
"id": "prowler.gcp.secretmanager_secret_rotation_enabled",
|
|
642
789
|
"title": "Secret Manager secret is rotated every 90 days or less",
|
|
643
|
-
"scope": "Prowler 5.
|
|
790
|
+
"scope": "Prowler 5.47.0 check secretmanager_secret_rotation_enabled (Google Cloud secretmanager, resource type secretmanager.googleapis.com/Secret): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
791
|
+
"evidenceType": "Configuration",
|
|
792
|
+
"severity": "medium"
|
|
793
|
+
},
|
|
794
|
+
{
|
|
795
|
+
"id": "prowler.gcp.vertexai_workbench_instance_auto_upgrade_enabled",
|
|
796
|
+
"title": "Vertex AI Workbench instance has automatic upgrades scheduled",
|
|
797
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_auto_upgrade_enabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
798
|
+
"evidenceType": "Configuration",
|
|
799
|
+
"severity": "low"
|
|
800
|
+
},
|
|
801
|
+
{
|
|
802
|
+
"id": "prowler.gcp.vertexai_workbench_instance_file_download_disabled",
|
|
803
|
+
"title": "Vertex AI Workbench instance has file downloads disabled",
|
|
804
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_file_download_disabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
805
|
+
"evidenceType": "Configuration",
|
|
806
|
+
"severity": "medium"
|
|
807
|
+
},
|
|
808
|
+
{
|
|
809
|
+
"id": "prowler.gcp.vertexai_workbench_instance_public_ip_disabled",
|
|
810
|
+
"title": "Vertex AI Workbench instance does not have a public IP address",
|
|
811
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_public_ip_disabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
812
|
+
"evidenceType": "Configuration",
|
|
813
|
+
"severity": "high"
|
|
814
|
+
},
|
|
815
|
+
{
|
|
816
|
+
"id": "prowler.gcp.vertexai_workbench_instance_root_access_disabled",
|
|
817
|
+
"title": "Vertex AI Workbench instance has root access disabled",
|
|
818
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_root_access_disabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
819
|
+
"evidenceType": "Configuration",
|
|
820
|
+
"severity": "medium"
|
|
821
|
+
},
|
|
822
|
+
{
|
|
823
|
+
"id": "prowler.gcp.vertexai_workbench_instance_terminal_access_disabled",
|
|
824
|
+
"title": "Vertex AI Workbench instance has terminal access disabled",
|
|
825
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_terminal_access_disabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
644
826
|
"evidenceType": "Configuration",
|
|
645
827
|
"severity": "medium"
|
|
646
828
|
}
|