Google Cloud Compliance FrameworksSpecialized Frameworks
GCP CFT Scorecard v1
Implemented Controls
The following controls are implemented as part of this framework.
GKE clusters should be private clustersIAM policies should not grant access to 'allUsers' or 'allAuthenticatedUsers'GKE clusters should have the Kubernetes web UI/Dashboard disabledGKE clusters should not use the default service account for project accessGKE clusters should have 'Legacy Authorization' set to 'Disabled'GKE clusters should have legacy metadata endpoints disabledCloud DNS managed zones should not use RSASHA1 for key-signing keysCloud DNS managed zones should not use RSASHA1 for zone-signing keysGKE clusters should have Alias IP ranges enabled at creationGKE node pools should all have automatic node repair enabledGKE nodes should have automatic node upgrades enabledGKE clusters should have 'Master authorized networks' set to 'Enabled'VPC subnets should all have VPC Flow Logs enabledVPC subnets should have Private Google Access enabledGKE clusters should use Container-Optimized OS (COS)GKE clusters should have a Network Policy installedCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL instances should have SSL enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetBigQuery datasets should require corporate-domain access and prohibit access by gmail.com addressesBigQuery datasets should require corporate-domain access and prohibit access by googlegroups.com addressesCloud SQL instances should prohibit world-readable access