Google Cloud identity, MFA & sign-in security checks
Who can sign in, how strongly they authenticate, and whether sessions, passwords and sign-in locations meet the baseline every admin account should clear.
On Google Cloud, Black Cat runs 4 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Google Cloud connector needs.
Checks (4)
severity: high Instance Uses Full Cloud-Platform API Scope fix difficulty: medium #
Use a custom service account with only the OAuth scopes the workload requires (CIS GCP 4.2)
- Create a dedicated service account with least-privilege IAM roles
- Navigate to GCP Console > Compute Engine > VM Instances
- Stop the instance and click Edit
- Under Service account, select the new dedicated account
- Under Access scopes, select Set access for each API and grant only required scopes
- Save and restart the instance
Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-04.2 NIST CSF 2.0 PR.AA-05 NIS2 Directive NIS2-21.i.2 DORA (SaaS Security) DORA-9.6
severity: medium Instance Does Not Block Project-Wide SSH Keys fix difficulty: easy #
Enable block-project-ssh-keys metadata on the instance to prevent project-level SSH key access (CIS GCP 4.3)
- Navigate to GCP Console > Compute Engine > VM Instances
- Select the flagged instance and click Edit
- Under SSH Keys, check Block project-wide SSH keys
- Save changes
Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-04.3 NIST CSF 2.0 PR.AA-05 NIS2 Directive NIS2-21.i.2 DORA (SaaS Security) DORA-9.6
severity: medium OS Login Disabled on Instance fix difficulty: easy #
Enable OS Login for centralized SSH key management via IAM (CIS GCP 4.4)
- Navigate to GCP Console > Compute Engine > VM Instances
- Select the flagged instance and click Edit
- Under Metadata, add key enable-oslogin with value TRUE
- Grant users the roles/compute.osLogin or roles/compute.osAdminLogin IAM role
- Save changes
Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-04.4 NIST CSF 2.0 PR.AA-05 NIS2 Directive NIS2-21.i.2 DORA (SaaS Security) DORA-9.6
severity: medium Cloud Function Default Service Account fix difficulty: medium #
Assign a dedicated service account with least-privilege permissions instead of the default compute SA
- Create a new service account with only the permissions the function requires
- Navigate to GCP Console > Cloud Functions
- Select the flagged function and click Edit
- Under Runtime service account, select the new dedicated service account
- Deploy the updated function
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 CIS Controls v8 CIS-05.4 NIST CSF 2.0 PR.AA-05 NIS2 Directive NIS2-21.i.2 DORA (SaaS Security) DORA-9.6