默认、扩展的预定义安全状况

本页介绍了 v1.0 中包含的预防性政策。 预定义安全状况的扩展版本。这个 预定义的状况有助于防止常见的错误配置和常见的安全性 由默认设置导致的问题

您可以使用此预定义的安全状况来配置安全状况，以帮助 保护 Google Cloud 资源。如果您想部署此预定义状况，则必须 自定义一些政策，以使其适用于您的环境。

政策 说明 合规性标准
iam.disableServiceAccountKeyCreation

此限制条件可防止用户为服务创建永久性密钥 降低服务账号凭据遭泄露的风险。

通过 值为 true，则禁止创建服务账号密钥。

 NIST SP 800-53 对照组：AC-2
iam.automaticIamGrantsForDefaultServiceAccounts

此限制条件会阻止默认服务账号接收 权限过高的 Identity and Access Management (IAM) Role Editor。

通过 值为 false，表示为默认服务停用自动 IAM 授权 账号。

 NIST SP 800-53 对照组：AC-3
iam.disableServiceAccountKeyUpload

此限制条件 避免服务账号中的自定义密钥材料发生泄露和重复使用的风险 键。

值为 true，表示停用服务账号密钥 上传。

 NIST SP 800-53 对照组：AC-6
storage.publicAccessPrevention

此政策可防止 Cloud Storage 存储分区从开放到未经身份验证的公开 访问权限。

值为 true，以防止公开访问 存储分区。

 NIST SP 800-53 对照组：AC-3 和 AC-6
iam.allowedPolicyMemberDomains

此政策限制 仅允许在所选 中 受管理的用户身份的 IAM 政策 网域以访问此组织内的资源。

该值为 directoryCustomerId 可限制网域间共享。

 NIST SP 800-53 控件：AC-3、AC-6 和 IA-2
essentialcontacts.allowedContactDomains

本政策 对重要联系人进行限制，仅允许在以下位置使用受管理的用户身份： 选定网域来接收平台通知。

该值为 @google.com。您必须将该值更改为 网域。

 NIST SP 800-53 控件：AC-3、AC-6 和 IA-2
storage.uniformBucketLevelAccess

本政策 可防止 Cloud Storage 存储分区使用对象 ACL（一个独立的系统 来自 IAM 政策）以提供访问权限，从而对 访问管理和审核。

值为 true，以强制执行 统一存储桶级访问权限。

 NIST SP 800-53 对照组：AC-3 和 AC-6
compute.requireOsLogin

这个 政策要求针对新创建的项目使用 OS Login 以便更轻松地管理 SSH 密钥、提供 IAM 政策，并记录用户访问权限。

该值为 true，用于要求使用 OS Login。

 NIST SP 800-53 对照组：AC-3 和 AU-12
compute.disableSerialPortAccess

本政策 禁止用户访问可用于后门程序的虚拟机串行端口 访问 Compute Engine API 控制平面

值为 true 时，禁止访问虚拟机串行端口。

 NIST SP 800-53 对照组：AC-3 和 AC-6
compute.restrictXpnProjectLienRemoval

此政策可防止意外删除共享 VPC 主机 来限制项目安全锁的移除。

该值为 true，用于限制共享 VPC 项目安全锁移除。

 NIST SP 800-53 对照组：AC-3 和 AC-6
compute.vmExternalIpAccess

此政策可防止 创建具有公共 IP 地址的 Compute Engine 实例， 将它们公开给传入的互联网流量和传出的互联网 流量。

如果值为 denyAll，则表示停用所有访问权限 公共 IP 地址

 NIST SP 800-53 对照组：AC-3 和 AC-6
compute.skipDefaultNetworkCreation

这个 政策会禁止自动创建默认 VPC 网络，并将默认设置为 防火墙规则，确保网络和防火墙规则 。

值为 true，以避免创建 默认 VPC 网络

 NIST SP 800-53 对照组：AC-3 和 AC-6
compute.setNewProjectDefaultToZonalDNSOnly

此政策限制应用开发者选择旧版 DNS 为服务可靠性低于 新型 DNS 设置。

对于新订单，该值为 Zonal DNS only 项目。

 NIST SP 800-53 对照组：AC-3 和 AC-6
sql.restrictPublicIp

此政策可防止 创建具有公共 IP 地址的 Cloud SQL 实例， 将它们公开给传入的互联网流量和传出的互联网 流量。

值为 true，用于限制 Cloud SQL 实例。

 NIST SP 800-53 对照组：AC-3 和 AC-6
sql.restrictAuthorizedNetworks

此政策可防止 公共或非 RFC 1918 网络范围访问 Cloud SQL 数据库。

值为 true，用于限制已获授权的网络 Cloud SQL 实例上的 Cloud SQL 实例。

 NIST SP 800-53 对照组：AC-3 和 AC-6
compute.restrictProtocolForwardingCreationForTypes

此政策允许内部 IP 地址的虚拟机协议转发 。

值为 INTERNAL，用于限制协议转发 根据 IP 地址的类型来确定

 NIST SP 800-53 对照组：AC-3 和 AC-6
compute.disableVpcExternalIpv6

此政策可防止创建外部 IPv6 子网， 可向传入和传出互联网流量公开

该值为 使用 true 停用外部 IPv6 子网。

 NIST SP 800-53 对照组：AC-3 和 AC-6
compute.disableNestedVirtualization

本政策 停用嵌套虚拟化，以降低因未被监控而导致的安全风险 嵌套实例。

值为 true，用于关闭嵌套虚拟机 虚拟化。

 NIST SP 800-53 对照组：AC-3 和 AC-6

YAML 定义

以下是默认设置的预定义状况的 YAML 定义。

name: organizations/123/locations/global/postureTemplates/secure_by_default
description: Posture Template to make your cloud environment more secure.
revision_id: v.1.0
state: ACTIVE
policy_sets:
- policy_set_id: Secure-By-Default policy_set
  description: 18 org policies that new customers can automatically enable.
  policies:
  - policy_id: Disable service account key creation
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-2
    constraint:
      org_policy_constraint:
        canned_constraint_id: iam.disableServiceAccountKeyCreation
        policy_rules:
        - enforce: true
    description: Prevent users from creating persistent keys for service accounts to decrease the risk of exposed service account credentials.
  - policy_id: Disable Automatic IAM Grants for Default Service Accounts
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    constraint:
      org_policy_constraint:
        canned_constraint_id: iam.automaticIamGrantsForDefaultServiceAccounts
        policy_rules:
        - enforce: true
    description: Prevent default service accounts from receiving the overly-permissive IAM role Editor at creation.
  - policy_id: Disable Service Account Key Upload
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: iam.disableServiceAccountKeyUpload
        policy_rules:
        - enforce: true
    description: Avoid the risk of leaked and reused custom key material in service account keys.
  - policy_id: Enforce Public Access Prevention
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: storage.publicAccessPrevention
        policy_rules:
        - enforce: true
    description: Enforce that Storage Buckets cannot be configured as open to unauthenticated public access.
  - policy_id: Domain restricted sharing
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    - standard: NIST SP 800-53
      control: IA-2
    constraint:
      org_policy_constraint:
        canned_constraint_id: iam.allowedPolicyMemberDomains
        policy_rules:
        - values:
            allowed_values:
            - directoryCustomerId
    description: Limit IAM policies to only allow managed user identities in my selected domain(s) to access resources inside this organization.
  - policy_id: Domain restricted contacts
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    - standard: NIST SP 800-53
      control: IA-2
    constraint:
      org_policy_constraint:
        canned_constraint_id: essentialcontacts.allowedContactDomains
        policy_rules:
        - values:
            allowed_values:
            - "@google.com"
    description: Limit Essential Contacts to only allow managed user identities in my selected domain(s) to receive platform notifications.
  - policy_id: Enforce uniform bucket-level access
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: storage.uniformBucketLevelAccess
        policy_rules:
        - enforce: true
    description: Prevent GCS buckets from using per-object ACL (a separate system from IAM policies) to provide access, enforcing a consistency for access management and auditing.
  - policy_id: Require OS Login
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AU-12
    constraint:
      org_policy_constraint:
        canned_constraint_id: compute.requireOsLogin
        policy_rules:
        - enforce: true
    description: Require OS Login on newly created VMs to more easily manage SSH keys, provide resource-level permission with IAM policies, and log user access.
  - policy_id: Disable VM serial port access
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: compute.disableSerialPortAccess
        policy_rules:
        - enforce: true
    description: Prevent users from accessing the VM serial port which can be used for backdoor access from the Compute Engine API control plane
  - policy_id: Restrict shared VPC project lien removal
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: compute.restrictXpnProjectLienRemoval
        policy_rules:
        - enforce: true
    description: Prevent the accidental deletion of Shared VPC host projects by restricting the removal of project liens.
  - policy_id: Define allowed external IPs for VM instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: compute.vmExternalIpAccess
        policy_rules:
        - deny_all: true
    description: Prevent the creation of Compute instances with a public IP, which can expose them to internet ingress and egress.
  - policy_id: Skip default network creation
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: compute.skipDefaultNetworkCreation
        policy_rules:
        - enforce: true
    description: Disable the automatic creation of a default VPC network and default firewall rules in each new project, ensuring that my network and firewall rules are intentionally created.
  - policy_id: Sets the internal DNS setting for new projects to Zonal DNS Only
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: compute.setNewProjectDefaultToZonalDNSOnly
        policy_rules:
        - enforce: true
    description: Set guardrails that application developers cannot choose legacy DNS settings for compute instances that have lower service reliability than modern DNS settings.
  - policy_id: Restrict Public IP access on Cloud SQL instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: sql.restrictPublicIp
        policy_rules:
        - enforce: true
    description: Prevent the creation of Cloud SQL instances with a public IP, which can expose them to internet ingress and egress.
  - policy_id: Restrict Authorized Networks on Cloud SQL instances
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: sql.restrictAuthorizedNetworks
        policy_rules:
        - enforce: true
    description: Prevent public or non-RFC 1918 network ranges from accessing my Cloud SQL databases.
  - policy_id: Restrict Protocol Forwarding Based on type of IP Address
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: compute.restrictProtocolForwardingCreationForTypes
        policy_rules:
        - values:
            allowed_values:
            - INTERNAL
    description: Allow VM protocol forwarding for internal IP addresses only.
  - policy_id: Disable VPC External IPv6 usage
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: compute.disableVpcExternalIpv6
        policy_rules:
        - enforce: true
    description: Prevent the creation of external IPv6 subnets, which can be exposed to internet ingress and egress.
  - policy_id: Disable VM nested virtualization
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-6
    constraint:
      org_policy_constraint:
        canned_constraint_id: compute.disableNestedVirtualization
        policy_rules:
        - enforce: true
    description: Disable nested virtualization to decrease my security risk due to unmonitored nested instances.

后续步骤