Google Cloud Compliance ControlsGoogle Kubernetes Engine
GKE clusters should have monitoring enabled
Stackdriver Monitoring must be enabled on Kubernetes Engine Clusters. The `monitoring_service` attribute must be defined and different than `none`. StackDriver monitoring aggregates logs, events, and metrics from your Kubernetes environment on GKE.
What this control checks
GKE google_container_cluster monitoring_service must not be none
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- DE.CM-09
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- PR.PS-04
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_monitoring_enabled - Checkov Check:
CKV_GCP_8 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_monitoring_enabled - KICS Query:
30e8dfd2-3591-4d19-8d11-79e93106c93d - Trivy Check:
GCP-0052
Last reviewed: 2026-10-09