GKE clusters should have monitoring enabled
Stackdriver Monitoring must be enabled on Kubernetes Engine Clusters. The `monitoring_service` attribute must be defined and different than `none`. StackDriver monitoring aggregates logs, events, and metrics from your Kubernetes environment on GKE.
StackDriver monitoring aggregates logs, events, and metrics from your Kubernetes environment on GKE to help you understand your application's behavior in production.
What this control checks
GKE google_container_cluster monitoring_service must not be none
Common pitfalls
The monitoring_service attribute cannot be none
Kubernetes Engine Clusters must have Stackdriver Monitoring enabled, which means the attribute monitoring_service must be different than none.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_monitoring_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_8; KICS query "Stackdriver Monitoring Disabled" (30e8dfd2-3591-4d19-8d11-79e93106c93d); Trivy check GCP-0052.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to DE.CM-09 (Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.), GV.SC-07 (The risks posed by a supplier, their products and services, and other third parties are understood, recorded...), GV.SC-09 (Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their...) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- DE.CM-09
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- PR.PS-04
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_monitoring_enabled - Checkov Check:
CKV_GCP_8 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_monitoring_enabled - KICS Query:
30e8dfd2-3591-4d19-8d11-79e93106c93d - Trivy Check:
GCP-0052
Last reviewed: 2026-10-09