Skip to content

Commit

Permalink
Fix titles for GCP Policy packs (#822)
Browse files Browse the repository at this point in the history
  • Loading branch information
madhushreeray30 authored Sep 5, 2024
1 parent 90f52a7 commit b6b0e07
Show file tree
Hide file tree
Showing 64 changed files with 66 additions and 66 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ primary_category: "security"
type: "featured"
---

# Enforce Enable Block Project-Wide SSH Keys for GCP Compute Engine Instances
# Enforce Block Project-Wide SSH Keys for GCP Compute Engine Instances

Enforcing the enablement of block project-wide SSH keys for GCP Compute Engine instances is important because it restricts the use of universally accessible SSH keys, thereby reducing the risk of unauthorized access. This measure ensures that only instance-specific SSH keys are used, enhancing the security and control over individual instance access.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce Enable Block Project-Wide SSH Keys for GCP Compute Engine Instances"
title = "Enforce Block Project-Wide SSH Keys for GCP Compute Engine Instances"
description = "Restrict the use of universally accessible SSH keys, thereby reducing the risk of unauthorized access."
akas = ["gcp_computeengine_enforce_block_project_wide_ssh_keys_is_enabled_for_instances"]
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ categories: ["cost controls", "compute", "security", "storage"]
primary_category: "cost controls"
---

# Enforce GCP Compute Engine Disks to Be Attached to Instances
# Enforce GCP Compute Engine Disks Are Attached to Instances

Enforcing GCP Compute Engine disks to be attached to instances is important for optimizing resource utilization and cost management. This control ensures that all allocated storage is actively used and monitored, reducing the risk of unnecessary expenses and potential security vulnerabilities associated with unattached disks.

Expand All @@ -13,7 +13,7 @@ This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can

## Documentation

- **[Review Policy settings →](https://hub.guardrails.turbot.com/policy-packs/enforce_disks_to_be_attached_to_instances/settings)**
- **[Review Policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_disks_are_attached_to_instances/settings)**

## Getting Started

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce GCP Compute Engine Disks to Be Attached to Instances"
title = "Enforce GCP Compute Engine Disks Are Attached to Instances"
description = "Ensure that all allocated storage is actively used and monitored, reducing the risk of unnecessary expenses and potential security vulnerabilities associated with unattached disks."
akas = ["gcp_computeengine_enforce_disks_to_be_attached_to_instances"]
akas = ["gcp_computeengine_enforce_disks_are_attached_to_instances"]
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,15 @@ categories: ["compute", "cost controls"]
primary_category: "cost controls"
---

# Enforce GCP Compute Engine Disks to Not Be Older Than 7 Days
# Enforce GCP Compute Engine Disks Are Not Older Than 7 Days

Enforcing GCP Compute Engine Disks to not be older than 7 days is critical to ensure that data storage is continuously refreshed and aligned with the latest security and performance standards. This practice helps prevent the accumulation of outdated and potentially vulnerable disks, thereby enhancing overall data integrity and security.

This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can help you configure the following settings for Compute Engine disks:

- Delete disks that are older than 7 days

- **[Review Policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_disks_to_not_be_older_than_7_days/settings)**
- **[Review Policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_disks_are_not_older_than_7_days/settings)**

## Getting Started

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce GCP Compute Engine Disks to Not Be Older Than 7 Days"
title = "Enforce GCP Compute Engine Disks Are Not Older Than 7 Days"
description = "Enforcing disks to not be older than 7 days is critical to ensure that data storage is continuously refreshed and aligned with the latest security and performance standards."
akas = ["gcp_computeengine_enforce_disks_to_not_be_older_than_7_days"]
akas = ["gcp_computeengine_enforce_disks_are_not_older_than_7_days"]
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,15 @@ categories: ["compute", "cost controls"]
primary_category: "cost controls"
---

# Enforce GCP Compute Engine Instances to Not Be Older Than 7 Days
# Enforce GCP Compute Engine Instances Are Not Older Than 7 Days

Enforcing GCP Compute Engine Instances to not be older than 7 days is important to ensure that instances are regularly updated and patched, minimizing the risk of vulnerabilities and security exploits. This practice promotes a secure and resilient infrastructure by ensuring that all instances run the latest software versions and configurations.

This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can help you configure the following settings for Compute Engine instances:

- Terminate instances that are older than 7 days

- **[Review Policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_instances_to_not_be_older_than_7_days/settings)**
- **[Review Policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_instances_are_not_older_than_7_days/settings)**

## Getting Started

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce GCP Compute Engine Instances to Not Be Older Than 7 Days"
title = "Enforce GCP Compute Engine Instances Are Not Older Than 7 Days"
description = "Enforcing instances to not be older than 7 days is important to ensure that instances are regularly updated and patched, minimizing the risk of vulnerabilities and security exploits."
akas = ["gcp_computeengine_enforce_instances_to_not_be_older_than_7_days"]
akas = ["gcp_computeengine_enforce_instances_are_not_older_than_7_days"]
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,15 @@ categories: ["security", "networking"]
primary_category: "security"
---

# Enforce GCP Compute Engine Instances to Not Use External IP Addresses
# Enforce GCP Compute Engine Instances Do Not Use External IP Addresses

Enforcing GCP Compute Engine instances to not use external IP addresses is vital for reducing the attack surface and enhancing security. By restricting instances to internal IP addresses, it minimizes exposure to the internet, thereby protecting sensitive data and systems from unauthorized access and potential threats.

This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can help you configure the following settings for Compute Engine instances:

- Enforce no external IP addresses are used

**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_instances_to_not_use_external_ip_address/settings)**
**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_instances_do_not_use_external_ip_address/settings)**

## Getting Started

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce GCP Compute Engine Instances to Not Use External IP Addresses"
title = "Enforce GCP Compute Engine Instances Do Not Use External IP Addresses"
description = "Limiting instances to internal IP addresses only minimizes exposure to the internet, thereby protecting sensitive data and systems from unauthorized access and potential threats."
akas = ["gcp_computeengine_enforce_instances_to_not_use_external_ip_address"]
akas = ["gcp_computeengine_enforce_instances_do_not_use_external_ip_address"]
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ categories: ["compute", "cost controls", "security"]
primary_category: "cost controls"
---

# Enforce GCP Compute Engine Instances to Not Use Specific Machine Types
# Enforce GCP Compute Engine Instances Do Not Use Specific Machine Types

Enforcing GCP Compute Engine Instances to not use specific machine types is important to ensure compliance with organizational policies and cost management strategies. This control helps prevent the use of machine types that may be unsuitable for certain workloads, excessively costly, or lacking necessary security features, thereby optimizing resource utilization and maintaining a secure environment.

Expand All @@ -13,7 +13,7 @@ This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can
- Set unapproved list of instance family
- Terminate instances that are not approved for use due to unapproved size or family

**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_instances_to_not_use_specific_machine_types/settings)**
**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_instances_do_not_use_specific_machine_types/settings)**

## Getting Started

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce GCP Compute Engine Instances to Not Use Specific Machine Types"
title = "Enforce GCP Compute Engine Instances Do Not Use Specific Machine Types"
description = "Enforce instances to not use specific machine types helps prevent the use of machine types that may be unsuitable for certain workloads, excessively costly, or lacking necessary security features, thereby optimizing resource utilization and maintaining a secure environment."
akas = ["gcp_computeengine_enforce_instances_to_not_use_specific_machine_types"]
akas = ["gcp_computeengine_enforce_instances_do_not_use_specific_machine_types"]
}

This file was deleted.

Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ categories: ["compute", "security"]
primary_category: "security"
---

# Enforce GCP Compute Engine Instances to Not Use Unapproved Images
# Enforce GCP Compute Engine Instances Use Only Approved Images

Enforcing GCP Compute Engine instances to not use unapproved images is crucial for maintaining security, compliance, and consistency across the infrastructure. It ensures that all instances adhere to organizational standards, reducing the risk of vulnerabilities, unauthorized software, and potential breaches.

Expand All @@ -12,7 +12,7 @@ This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can
- Set list of approved image IDs
- Stop/Terminate instances that use unapproved images

**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_instances_to_not_use_unapproved_images/settings)**
**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_computeengine_enforce_instances_use_only_approved_images/settings)**

## Getting Started

Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce GCP Compute Engine Instances Use Only Approved Images"
description = "Ensure that all instances adhere to organizational standards, reducing the risk of vulnerabilities."
akas = ["gcp_computeengine_enforce_instances_use_only_approved_images"]
}
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ primary_category: "logging"
type: "featured"
---

# Enable Event Handlers for GCP Projects in Guardrails
# Enable Event Handlers for GCP Projects

The Guardrails Event Handlers are responsible for conveying events from GCP Logging back to Guardrails for processing. This is a requirement for Guardrails to process and respond in real-time.

Expand Down
2 changes: 1 addition & 1 deletion policy_packs/gcp/guardrails/enable_event_handlers/main.tf
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
akas = ["gcp_guardrails_enable_event_handlers"]
title = "Enable Event Handlers for GCP Projects in Guardrails"
title = "Enable Event Handlers for GCP Projects"
description = "The Guardrails Event Handlers are responsible for conveying events from GCP Logging back to Guardrails for processing. This is a requirement for Guardrails to process and respond in real-time."
}
2 changes: 1 addition & 1 deletion policy_packs/gcp/guardrails/enable_event_poller/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ categories: ["logging", "networking"]
primary_category: "logging"
---

# Enable Event Poller for GCP Projects in Guardrails
# Enable Event Poller for GCP Projects

The Guardrails Event Poller are responsible polling GCP Logging at intervals specified and retrieves the latest events for processing.

Expand Down
2 changes: 1 addition & 1 deletion policy_packs/gcp/guardrails/enable_event_poller/main.tf
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
akas = ["gcp_guardrails_enable_event_poller"]
title = "Enable Event Poller for GCP Projects in Guardrails"
title = "Enable Event Poller for GCP Projects"
description = "The Guardrails Event Poller are responsible polling GCP Logging at intervals specified and retrieves the latest events for processing."
}
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@ primary_category: "access management"
type: "featured"
---

# Enforce GCP IAM User-Managed Service Accounts to Not Have Admin Privileges
# Enforce GCP IAM User-Managed Service Accounts Do Not Have Admin Privileges

Enforcing that GCP IAM user-managed service accounts do not have admin privileges is essential for maintaining the principle of least privilege. This minimizes the risk of unauthorized access and potential misuse of administrative capabilities, enhancing security by ensuring that service accounts only have the permissions necessary to perform their specific tasks.

This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can help you configure the following settings for IAM user-managed service accounts:

- Delete service accounts that have `roles/owner`, `roles/admin` or `roles/editor` privileges

**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_iam_enforce_user_service_accounts_to_not_have_admin_privileges/settings)**
**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_iam_enforce_user_service_accounts_do_not_have_admin_privileges/settings)**

## Getting Started

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce GCP IAM User-Managed Service Accounts to Not Have Admin Privileges"
title = "Enforce GCP IAM User-Managed Service Accounts Do Not Have Admin Privileges"
description = "Minimize the risk of unauthorized access and potential misuse of administrative capabilities."
akas = ["gcp_iam_enforce_user_service_accounts_to_not_have_admin_privileges"]
akas = ["gcp_iam_enforce_user_service_accounts_do_not_have_admin_privileges"]
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ categories: ["data protection", "security"]
primary_category: "data protection"
---

# Enforce GCP KMS Crypto Keys to be rotated on regular basis
# Check If GCP KMS Crypto Keys Are Rotated Regularly

KMS Crypto Keys should be rotated on regular basis. A rotation schedule defines the frequency of rotation, and optionally the date and time when the first rotation occurs. The rotation schedule can be based on either the key's age or the number or volume of messages encrypted with a key version. Enforcing regular rotation of GCP KMS crypto keys is essential for maintaining the security and integrity of encrypted data. Regular key rotation mitigates the risk of key compromise, ensuring that even if a key is exposed, its usage window is limited, thereby enhancing overall security and ensuring compliance with best practices and regulatory requirements.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ primary_category: "data protection"
type: "featured"
---

# Enforce Encryption for Secrets is Enabled for GCP GKE Clusters
# Enforce Encryption for Secrets Is Enabled for GCP GKE Clusters

Enforcing encryption for secrets in GCP GKE clusters is critical for protecting sensitive information stored within the cluster. This measure ensures that secrets, such as passwords and API keys, are encrypted, safeguarding them from unauthorized access and potential breaches, and ensuring compliance with security best practices and regulatory requirements.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce Encryption for Secrets is Enabled for GCP GKE Clusters"
title = "Enforce Encryption for Secrets Is Enabled for GCP GKE Clusters"
description = "Ensure that secrets, such as passwords and API keys, are encrypted, thereby safeguarding them from unauthorized access and potential breaches."
akas = ["gcp_kubernetesengine_enforce_encryption_for_secrets_is_enabled_for_clusters"]
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,15 @@ categories: ["networking", "security"]
primary_category: "networking"
---

# Check If GCP Network Load Balancers Enforce HTTPS to Manage Encrypted Web Traffic
# Check GCP Network Load Balancers Enforce HTTPS for Encrypted Web Traffic

Ensure that GCP Network Load Balancers are configured to use valid SSL/TLS certificates in order to handle encrypted web traffic. SSL certificate resources contain SSL certificate information that the load balancer uses to terminate SSL/TLS when HTTPS clients connect to it. This practice guarantees that data transmitted between clients and load-balanced applications is encrypted, protecting it from interception and unauthorized access, thereby enhancing security and compliance with regulatory requirements and best practices.

This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can help you configure the following settings for network load balancers:

- Check and alarm if the URL map for load balancers is configured to use target https proxy

**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_network_check_https_is_enforced_for_load_balancers/settings)**
**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_network_check_load_balancers_enforce_https/settings)**

## Getting Started

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Check If GCP Network Load Balancers Enforce HTTPS to Manage Encrypted Web Traffic"
title = "Check GCP Network Load Balancers Enforce HTTPS for Encrypted Web Traffic"
description = "Ensure that the data transmitted between clients and load-balanced applications is encrypted, protecting it from interception and unauthorized access."
akas = ["gcp_network_check_https_is_enforced_for_load_balancers"]
akas = ["gcp_network_check_load_balancers_enforce_https"]
}
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,15 @@ categories: ["networking", "security"]
primary_category: "networking"
---

# Enforce Default VPC Network to Not Be Used Within GCP Projects
# Enforce Default VPC Network Is Not Used in GCP Projects

Enforcing that the default VPC network is not used within GCP projects is essential for maintaining a secure and customized network environment. This practice encourages the creation of tailored VPC networks with specific configurations and security controls, reducing the risk of misconfigurations and enhancing overall network security and compliance with best practices.

This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can help you configure the following settings for VPC networks:

- Remove default networks that are used within projects

**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_network_enforce_default_vpc_network_is_not_used_for_projects/settings)**
**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/gcp_network_enforce_default_vpc_network_is_not_used_in_projects/settings)**

## Getting Started

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
resource "turbot_policy_pack" "main" {
title = "Enforce Default VPC Network Is Not Used Within GCP Projects"
title = "Enforce Default VPC Network Is Not Used in GCP Projects"
description = "Encourage the creation of tailored VPC networks with specific configurations and security controls, reducing the risk of misconfigurations and enhancing overall network security."
akas = ["gcp_network_enforce_default_vpc_network_is_not_used_for_projects"]
akas = ["gcp_network_enforce_default_vpc_network_is_not_used_in_projects"]
}
Loading

0 comments on commit b6b0e07

Please sign in to comment.