Google CloudOverview
Subnetwork-level hardening should include private service access and network telemetry for monitoring and forensic use.
Remediation guidance
Google Cloud Remediation
Service-Wide (Recommended)
Apply organization standards requiring Private Google Access and VPC Flow Logs on in-scope subnetworks.
Google Cloud Console (Asset-Level)
- Open VPC network -> VPC networks -> target subnet.
- Enable Private Google Access.
- Enable Flow logs and set retention/export policy.
Google Cloud CLI (Asset-Level)
gcloud compute networks subnets update <subnet-name> --region=<region> --enable-private-ip-google-access --enable-flow-logs
References
- https://cloud.google.com/vpc/docs/private-google-access
- https://cloud.google.com/vpc/docs/using-flow-logs
Query logic
These are the stored checks tied to this control.
Subnets without Private Google Access or Flow Logs
Connectors
Google Cloud
Covered asset types
Subnetwork
Expected check: eq []
{ subnetworks(where: { OR: [ { privateIpGoogleAccess: false }, { enableFlowLogs: false } ] }) { ...AssetFragment } }
