Ensure that Corporate Login Credentials are Used

Trung bìnhCấp 1Xem xét thủ cônggcp

Mô tả

Use corporate login credentials instead of consumer accounts, such as Gmail accounts. It is recommended fully-managed corporate Google accounts be used for increased visibility, auditing, and controlling access to Cloud Platform resources. Email accounts based outside of the user's organization, such as consumer accounts, should not be used for business purposes.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

For each Google Cloud Platform project, list the accounts that have been granted access to that project: From Google Cloud CLI gcloud projects get-iam-policy PROJECT_ID Also list the accounts added on each folder: gcloud resource-manager folders get-iam-policy FOLDER_ID And list your organization's IAM policy: gcloud organizations get-iam-policy ORGANIZATION_ID No email accounts outside the organization domain should be granted permissions in the IAM policies. This excludes Google-owned service accounts.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Remove all consumer Google accounts from IAM policies. Follow the documentation and setup corporate login accounts. Prevention: To ensure that no email addresses outside the organization can be granted IAM permissions to its Google Cloud projects, folders or organization, turn on the Organization Policy for Domain Restricted Sharing. Learn more at: https://cloud.google.com/resource-manager/docs/organization-policy/restricting- domains

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: cloudgcplogging
Tham chiếu: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - 1.2 Ensure that Corporate Login Credentials are Used