The names for some Assured Workloads control packages have changed. For information about the name change, see Control package renaming notice.

Assured Workloads cloud controls

This page provides reference content for the built-in cloud controls that are included in Assured Workloads frameworks. Cloud controls can apply to folders or projects.

Google Cloud cloud controls

Activate Security Command Center

Activate Security Command Center to evaluate security and data attack surfaces and help mitigate and remediate risks related to misconfigurations, vulnerabilities, and threats.

Enforcement mode	Audit
Finding category	`SCC_NOT_ACTIVATED`
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

To activate Security Command Center, see Overview of activating Security Command Center.

Activate Security Command Center for Continuous Monitoring

Use Security Command Center to define security policies and deploy and monitor them.

Enforcement mode	Audit
Finding category	`SECURITY_COMMAND_CENTER_NOT_ACTIVATED`
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

Activate Security Command Center.
Create and deploy frameworks with cloud controls that align with your security policies.
Review and resolve findings.
Integrate with notification channels such as email and chat.

Allocate Audit Log Storage Capacity

Allocate sufficient audit log storage capacity to accommodate audit logs

Enforcement mode	Detective Audit
Severity	`LOW`
Finding category	`INSUFFICIENT_AUDIT_LOG_STORAGE`
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Verify that you can see audit logs.
Verify that logs are being exported to the Cloud Storage bucket.
Verify the retention period for your log buckets.
Verify log storage capacity. In the console, got to Logging > Metrics and enter the following: custom.googleapis.com/log_storage_capacity
Verify the alerting policy for low log storage in your bucket.
Verify that storage capacity is sufficient for the Cloud Storage bucket (the usage is less than 90%).
Review the bucket retention period to ensure that regular review and adjustment of log storage capacity is complete.

Allow Only IL5 Compliant APIs for Gemini Enterprise Agent Platform

Restrict your folder or project to permit only Gemini Enterprise Agent Platform APIs that are compliant with Impact Level 5 (IL5).

Enforcement mode	Preventive Detective
Severity	`HIGH`
Finding category	`GEMINI_ENTERPRISE_AGENT_PLATFORM_ALLOW_IL5_COMPLIANT_APIS`
Category name in the API	CC_CATEGORY_INFRASTRUCTURE
Revision number	1
Supported target resources	Folder Project

Rules

Organization policy constraint constraints/vertexai.allowOnlyIL5CompliantAPIs

Remediation steps

Remediation for organization policy violation: Set the vertexai.allowOnlyIL5CompliantAPIs constraint to true. See Updating policies with boolean rules.

Allow Only ITAR Compliant APIs for Gemini Enterprise Agent Platform

Restrict your folder or project to permit only Gemini Enterprise Agent Platform APIs that are compliant with International Traffic in Arms Regulations (ITAR).

Enforcement mode	Preventive Detective
Severity	`HIGH`
Finding category	`GEMINI_ENTERPRISE_AGENT_PLATFORM_ALLOW_ITAR_COMPLIANT_APIS`
Category name in the API	CC_CATEGORY_INFRASTRUCTURE
Revision number	1
Supported target resources	Folder Project

Rules

Organization policy constraint constraints/vertexai.allowOnlyITARCompliantAPIs

Remediation steps

Remediation for organization policy violation: Set the vertexai.allowOnlyITARCompliantAPIs constraint to true. See Updating policies with boolean rules.

Apply Security Engineering Principles

Apply system security and privacy engineering principles in the specification, design, development, implementation, and modification of the system components.

Enforcement mode	Audit
Finding category	`MISSING_SECURITY_ENGINEERING_PRINCIPLES`
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

Address security requirements when building and applying security engineering principles to new development and operations of its data and information systems.
Include defense in depth at every phase of your system development life cycle, secure coding, security control tailoring, threat modeling, and risk management of your data and information system.

Assess Actions that Don't Require Identification or Authentication

Allow specific user actions without identification or authentication if they are deemed unnecessary, such as accessing public websites. The exception applies when identification and authentication have not occurred, not when they are simply not repeated.

Enforcement mode	Audit
Finding category	`ACTIONS_WITHOUT_IDENTIFICATION_AUTHENTICATION`
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Review permissions assigned to service accounts, users, and roles.
Monitor service accounts, especially those with elevated privileges.
Review IAM allow policies to ensure only authorized entities have necessary permissions.
Review external IP addresses and firewall rules to help prevent unauthorized access.
Identify the user actions that don't require identification or authentication.
Review system designs and use cases to understand the scenarios.
Evaluate potential risks and impact for exemption.
Document your rationale for exemptions.
Identify the security controls to mitigate potential risks.
Align exemptions with your organization's compliance requirements.

Assess the Availability of Compute and GKE Resources

Protect the availability of Compute VM instances and Google Kubernetes Engine (GKE) containers by allocating sufficient resources based on priority, quota, and security safeguards.

Enforcement mode	Audit
Finding category	`MISSING_RESOURCE_ASSESSMENT`
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

Use Cloud Monitoring and other observability tools to monitor for demand and performance.
In the Cloud Monitoring dashboard, review the VM configuration.
Review deployment scripts and orchestration tools to confirm that they allocate resources as intended.
Review GKE system metrics for resource allocations.

Assign Correct Bucket Label

Bucket labels let you create key:value pairs that are stored as part of the bucket's metadata. You can use these labels to help identify the purpose of the bucket to your organization.

Enforcement mode	Audit
Finding category	`BUCKET_LABEL_INCORRECT`
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Set correct label for Cloud Storage buckets. For more information, see Add, modify, or remove a bucket's labels.

Assign Redis Role at Project Level

Assign the Redis Identity and Access Management (IAM) roles at the project level. Redis IAM roles assigned at the organization or folder level are overly broad. This control checks the IAM allow policy in the resource metadata for principals that are assigned roles/redis.admin, roles/redis.editor, roles/redis.viewer at the organization or folder level.

Enforcement mode	Detective
Severity	`MEDIUM`
Finding category	`REDIS_ROLE_USED_ON_ORG`
Revision number	3
Supported target resources	Organization Folder Project

Remediation steps

In the Google Cloud console, go to the IAM page and remove Redis IAM roles from the organization or folder level and add them on individual projects. For more information, see Manage access to projects, folders, and organizations.

Authorize and Monitor Privileged Remote Access

Authorize the use of privileged commands execution and access to security information through remote access.

Enforcement mode	Audit
Finding category	`PRIVILEGED_REMOTE_ACCESS_NOT_AUTHORIZED_MONITORED`
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Create custom roles for privileged access or consider temporary elevated access.
Grant only specific roles to service accounts for automated systems that require remote access.
Use SSH for remote access to VMs.
Enable audit logging for services that store sensitive data.
Configure VPC Flow Logs to capture network traffic.
Enable Binary Authorization to enforce policies when deploying images.
Use Secret Manager to create and store secrets.
Configure alerting policies for unusual or unauthorized activities.

Authorize Wireless Access to Production Systems

Authorize wireless access to applications in production environments.

Enforcement mode	Audit
Finding category	`WIRELESS_ACCESS_PRODUCTION_SYSTEMS_NOT_AUTHORIZED`
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access to your systems. Authorize wireless access to your systems before you allow such connections.

Automate Account Management System

Ensure that you have IAM policy structures to automate IAM role assignments based on resources and context-specific conditions.

Enforcement mode	Audit
Finding category	`ACCOUNT_MANAGEMENT_SYSTEMS_NOT_SUPPORTED`
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

To retrieve log entries, see List log entries.

To get a ServiceAccount, see Get a ServiceAccount.

To get the definition of a role, see Get Role Definition.

Automate Integrity Verification

Employ integrity verification tools to detect unauthorized changes to your software, firmware, and information.

Enforcement mode	Audit
Finding category	`IMPROPER_INTEGRITY_VERIFICATION_MECHANISMS`
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Complete the following:

Configure your OS Policy to perform integrity verification. For more information, see OS policy and OS policy assignment, Create an OS policy assignment, and Manage OS policy assignments.
Create custom tools that regularly check the integrity of software and configurations.

Automate Near Real-time Event Analysis

Use automated tools to support near real-time analysis of events.

Enforcement mode	Audit
Finding category	`REAL_TIME_EVENT_ANALYSIS_NOT_AUTOMATED`
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Implement automated real-time event analysis:

Use Cloud Monitoring and Cloud Logging to collect, monitor, and analyze event data, such as system and application logs, performance metrics, and other relevant information.
Create custom monitoring metrics in Cloud Monitoring to track specific parameters that are critical.
Set up alerting policies in Cloud Monitoring to receive notifications when metrics or logs indicate unusual or unauthorized activities.
Use Pub/Sub to create topics and subscriptions for real-time event processing. For more information, see Publish message overview and Subscription overview.

Avoid RSASHA1 for DNSSEC Signing

Don't use the RSASHA1 algorithm for key signing when enabling DNSSEC for Cloud DNS zones.

Enforcement mode	Detective Audit
Severity	`MEDIUM`
Finding category	`RSASHA1_FOR_SIGNING`
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

Replace the algorithm. For more information, see Using advanced signing options.

BigQuery compliance settings

Enforcement mode	Preventive
Severity	`HIGH`
Finding category	`BIGQUERY_REGULATORY_SETTINGS_NON_COMPLIANT`
Category name in the API	CC_CATEGORY_DATA_RESIDENCY
Revision number	2
Supported target resources	Organization Folder Project

Parameters

framework

STRING

Required.

Block Administrator Roles from Service Accounts

A service account with Administrator, Owner, or Editor privileges has broad access to your Google Cloud environment, which can impact its security.

Enforcement mode	Detective Audit
Severity	`MEDIUM`
Finding category	`ADMIN_SERVICE_ACCOUNT`
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Go to the IAM policy page in the Google Cloud console, click Edit principal, and remove the excessive role or roles.

Block Automatic IAM Grants to Default Service Accounts

Use the "Disable Automatic IAM Grants for Default Service Accounts" (iam.automaticIamGrantsForDefaultServiceAccounts) organization policy constraint to prevent automatic role grants to default service accounts.

Enforcement mode	Detective Audit
Severity	`MEDIUM`
Finding category	`ORG_POLICY_AUTOMATIC_IAM_GRANTS_TO_DEFAULT_SERVICE_ACCOUNTS_ENABLED`
Revision number	1
Supported target resources	Organization Folder Project

Remediation steps

To disable the automatic role grant, see Disable automatic role grants to default service accounts.

Block Default VPC Network for Agent Platform Workbench Instances

Don't create Gemini Enterprise Agent Platform Workbench Instances in the default VPC network to help prevent the use of its over-permissive default firewall rules.

Enforcement mode	Detective Audit
Severity	`MEDIUM`
Finding category	`VERTEX_AI_WORKBENCH_DEFAULT_VPC_NETWORK_USED`
Category name in the API	CC_CATEGORY_ARTIFICIAL_INTELLIGENCE
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

You can't change the network on an Agent Platform Workbench Instance after it's created. Delete the existing instances, create another VPC network, and create new instances that use the new VPC network.

Delete the instances. For instructions to shut down the instance before deleting it, see Shut down an Agent Platform Workbench instance.
Create a VPC network and subnet for the project. For instructions, see Create and manage VPC networks. For information about Agent Platform Workbench networking requirements, see Network configuration options.
Create the instances. For instructions, see Create an Agent Platform Workbench Instance. In the Networking section, select the VPC network and subnet that you created.

Block External IP Address Access on Compute Engine VM Instances

Use the "Define allowed external IPs for VM instances" (compute.vmExternalIpAccess) organization policy constraint to block public access to your VMs.

Enforcement mode	Detective Audit
Severity	`HIGH`
Finding category	`ORG_POLICY_EXTERNAL_IP_ACCESS_ALLOWED`
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

To block external IP addresses on Compute Engine VM instances, see Restrict external IP addresses to specific instances.

Block File Downloading in JupyterLab Console

Don't permit file downloading from the JupyterLab console in Workbench instances to reduce data exfiltration risks and help prevent malware distribution.

Enforcement mode	Detective Audit
Severity	`HIGH`
Finding category	`VERTEX_AI_JUPYTERLAB_FILE_DOWNLOADING_ENABLED`
Category name in the API	CC_CATEGORY_ARTIFICIAL_INTELLIGENCE
Revision number	1.1
Supported target resources	Organization Folder Project

Remediation steps

Turn off file downloading for the instance.

In the Google Cloud console, go to the Instances page.
Click the instance that you want to configure.
In the Software and security tab, add the notebook-disable-downloads metadata key and set the value to TRUE.

For more information, see Update an instance's metadata.

Block Generic Access to Cassandra Ports

Block connections on TCP ports 7000, 70001, 7199, 8888, 9042, 9160, 61620, and 61621 from all IP addresses to help prevent unwanted traffic and attacks on Apache Cassandra services.

Enforcement mode	Detective Audit
Severity	`HIGH`
Finding category	`OPEN_CASSANDRA_PORT`
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:7000, tcp:70001, tcp:7199, tcp:8888, tcp:9042, tcp:9160, tcp:61620, and tcp:61621 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to CiscoSecure/WebSM Ports

Block incoming connections on TCP port 9090 from all IP addresses to help prevent undesired traffic and attacks on CiscoSecure/WebSM services.

Enforcement mode	Detective Audit
Severity	`HIGH`
Finding category	`OPEN_CISCOSECURE_WEBSM_PORT`
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:9090 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to Directory Service Ports

Block incoming connections on TCP port 445 or UDP port 445 from all IP addresses to help prevent undesired traffic and attacks on Directory Services.

Enforcement mode	Detective Audit
Severity	`HIGH`
Finding category	`OPEN_DIRECTORY_SERVICES_PORT`
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:445 and udp:445 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to DNS Ports from All IP Addresses

Block incoming connections on TCP port 53 or UDP port 53 from all IP addresses to help prevent undesired traffic and attacks on DNS services.

Enforcement mode	Detective Audit
Severity	`HIGH`
Finding category	`OPEN_DNS_PORT`
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:53 and udp:53 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.

Block Generic Access to Elasticsearch Ports from All IP Addresses

Block incoming connections on TCP ports 9200 and 9300 from all IP addresses to help prevent undesired traffic and attacks on Elasticsearch services.

Enforcement mode	Detective Audit
Severity	`HIGH`
Finding category	`OPEN_ELASTICSEARCH_PORT`
Revision number	2
Supported target resources	Organization Folder Project

Remediation steps

Go to the Firewall page in the Google Cloud console. Click the firewall rule name, then click Edit. Edit the firewall rule to deny access to ports tcp:9200 and tcp:9300 from the source IP range 0.0.0.0/0. Create a firewall rule that permits specific IP address ranges to access these ports instead. For more information, see Use VPC firewall rules.