GCP Forseti Security v2.26
Active
Controls by category
10 controls are Mapped to GCP Forseti Security v2.26.
Other
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST Cybersecurity Framework v2.0 | High 80% | |
| GCP CFT Scorecard v1 | High 60% | |
| CIS GCP Benchmark v2.0.0 | Medium 50% |
Frequently asked questions
What is Forseti Security?
Forseti Security is a collection of community-driven, open-source tools to help improve the security of Google Cloud Platform environments. Its core modules can be enabled, configured, and executed independently of each other.
Which controls does the Forseti Security v2.26 bundle contain?
The forseti-security bundle in the Config Validator policy library lists 10 constraints, each marked v2.26.0. They cover CMEK rotation, public IAM users, service account key age, domain restriction, BigQuery access, open firewall rules and Cloud SQL.
How can the Forseti Security bundle be installed?
The bundle can be installed via kpt. Set the BUNDLE variable to forseti-security, fetch the policy-library package, then evaluate it with the get-policy-bundle image and write the constraints to policy-library/policies/constraints/.
What does the service account key age control check?
The iam-restrict-service-account-key-age-one-hundred-days constraint checks if service account keys are older than 100 days. The CMEK rotation constraint separately checks that a rotation policy is in place and is sufficiently short.