GCP Workloads Hardening

Enforce Shielded VM (Secure Boot + virtual Trusted Platform Module + Integrity Monitoring) on every Compute Engine instance organisation-wide via the constraints/compute.requireShieldedVm Org Policy constraint. Shielded VM raises the boot-firmware bar — UEFI firmware with Microsoft-signed root certificate, measured boot recorded into a vTPM, integrity-monitoring baselines verified against the running guest's PCRs — and refuses to boot images whose bootloader or kernel modules fail signature verification (Google Cloud — Shielded VM documentation (accessed 2026-05)). The principle is reinforced in General Workloads — image / OS hardening: an instance whose pre-OS attack surface is not measured cannot reason about whether it has been rootkitted before the operating system even started. Confidential VM (AMD SEV / SEV-SNP, Intel TDX) is called out as the upgrade path for regulated workloads — it adds memory encryption with attestation against the platform — but it is not a replacement for the Shielded VM baseline. Confidential VM is layered on top: --confidential-compute --maintenance-policy=TERMINATE requires Shielded VM features to be enabled. CRITICAL because a non-Shielded VM accepting an unsigned bootloader or a tampered kernel is the canonical rootkit-survives-reboot scenario; CIS GCP v4.0.0 §4 codifies the requirement.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enforce constraints/compute.requireShieldedVm at the organisation scope.
cat > require-shielded-vm.yaml <<'YAML'
name: organizations/ORG_ID/policies/compute.requireShieldedVm
spec:
  rules:
  - enforce: true
YAML

gcloud org-policies set-policy require-shielded-vm.yaml \
  --organization=ORG_ID

# Step 2: create a new Shielded VM (boot must use a Shielded-VM-compatible image family).
gcloud compute instances create app-prod-01 \
  --project=svc-app-prod \
  --zone=europe-west1-b \
  --machine-type=n2-standard-4 \
  --image-family=ubuntu-2204-lts \
  --image-project=ubuntu-os-cloud \
  --shielded-secure-boot \
  --shielded-vtpm \
  --shielded-integrity-monitoring \
  --no-address \
  --service-account=sa-app-prod@svc-app-prod.iam.gserviceaccount.com \
  --scopes=cloud-platform

# Step 3: inventory existing instances missing any Shielded VM toggle.
for project in $(gcloud projects list --format='value(projectId)'); do
  gcloud compute instances list --project="$project" \
    --format="value(name,zone,shieldedInstanceConfig.enableSecureBoot,shieldedInstanceConfig.enableVtpm,shieldedInstanceConfig.enableIntegrityMonitoring)" 2>/dev/null \
    | awk -F'\t' '$3!="True" || $4!="True" || $5!="True" { print "'"$project"'\t" $0 }'
done

# Step 4: enable the three toggles on an existing stopped instance.
gcloud compute instances stop app-legacy-01 --zone=europe-west1-b --project=svc-app-prod
gcloud compute instances update app-legacy-01 \
  --project=svc-app-prod --zone=europe-west1-b \
  --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring
gcloud compute instances start app-legacy-01 --zone=europe-west1-b --project=svc-app-prod

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_org_policy_policy" "require_shielded_vm" {
  name   = "organizations/${var.org_id}/policies/compute.requireShieldedVm"
  parent = "organizations/${var.org_id}"

  spec {
    rules {
      enforce = "TRUE"
    }
  }
}

resource "google_compute_instance" "app_prod_01" {
  project      = var.app_project_id
  name         = "app-prod-01"
  zone         = "europe-west1-b"
  machine_type = "n2-standard-4"

  boot_disk {
    initialize_params {
      image = "projects/ubuntu-os-cloud/global/images/family/ubuntu-2204-lts"
    }
  }

  network_interface {
    subnetwork = var.app_subnet_self_link
    # No access_config block = no external IP.
  }

  shielded_instance_config {
    enable_secure_boot          = true
    enable_vtpm                 = true
    enable_integrity_monitoring = true
  }

  service_account {
    email  = var.app_service_account_email
    scopes = ["cloud-platform"]
  }

  metadata = {
    enable-oslogin = "TRUE"
    block-project-ssh-keys = "TRUE"
  }
}

Remediation — Config Connector

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeInstance
metadata:
  name: hardened-vm
  namespace: config-control
spec:
  zone: us-central1-a
  machineType: e2-medium
  bootDisk:
    initializeParams:
      imageRef:
        external: "projects/debian-cloud/global/images/family/debian-12"
  networkInterface:
  - networkRef:
      name: prod-vpc
  shieldedInstanceConfig:
    enableSecureBoot: true
    enableVtpm: true
    enableIntegrityMonitoring: true

Remediation — Pulumi (TypeScript)

import * as gcp from "@pulumi/gcp";

// Shielded VM with Secure Boot + vTPM + Integrity Monitoring (CIS GCP 4.8).
const hardenedVm = new gcp.compute.Instance("hardened-vm", {
    name: "hardened-vm",
    zone: "us-central1-a",
    machineType: "e2-medium",
    bootDisk: {
        initializeParams: {
            image: "projects/debian-cloud/global/images/family/debian-12",
        },
    },
    networkInterfaces: [{ network: prodVpc.id }],
    shieldedInstanceConfig: {
        enableSecureBoot: true,
        enableVtpm: true,
        enableIntegrityMonitoring: true,
    },
});

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND protoPayload.methodName=~"v1.compute.instances.updateShieldedInstanceConfig"
          AND (protoPayload.request.enableSecureBoot=false
               OR protoPayload.request.enableIntegrityMonitoring=false)

Equivalent on: AWS · Azure · OCI

Enforce OS Login organisation-wide via the constraints/compute.requireOsLogin Org Policy constraint, require 2-Step Verification (enable-oslogin-2fa = TRUE as project or instance metadata), deny metadata-based SSH keys (block-project-ssh-keys = TRUE), and access workload VMs exclusively through Identity-Aware Proxy (IAP) TCP forwarding — no external IPs on workload VMs (Google Cloud — OS Login documentation (accessed 2026-05); Google Cloud — IAP TCP forwarding documentation (accessed 2026-05)). OS Login ties SSH access to Google Cloud IAM: a user with the roles/compute.osLogin (or roles/compute.osAdminLogin for sudo) role on a project or instance can SSH, and their POSIX uid/gid is provisioned from their Google identity rather than from an instance-local authorized_keys file. IAP TCP forwarding tunnels SSH (and any other TCP protocol) through an IAP front-end that checks IAM (roles/iap.tunnelResourceAccessor) before the connection ever reaches the VM; workload VMs can therefore live in subnets with no external IPs. Anti-conflation: OS Login is the identity-binding layer (who can SSH); IAP is the network-path layer (how the SSH connection arrives). Both are required: OS Login alone leaves you needing external IPs or a self-managed bastion; IAP alone leaves you with instance-local SSH keys and the offboarding gap they imply.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enforce OS Login organisation-wide via Org Policy.
cat > require-oslogin.yaml <<'YAML'
name: organizations/ORG_ID/policies/compute.requireOsLogin
spec:
  rules:
  - enforce: true
YAML
gcloud org-policies set-policy require-oslogin.yaml --organization=ORG_ID

# Step 2: require 2-Step Verification and block metadata SSH keys at project scope.
gcloud compute project-info add-metadata --project=svc-app-prod \
  --metadata=enable-oslogin=TRUE,enable-oslogin-2fa=TRUE,block-project-ssh-keys=TRUE

# Step 3: grant a user the OS-Login role + the IAP tunnel role at project scope.
gcloud projects add-iam-policy-binding svc-app-prod \
  --member='user:alice@example.com' \
  --role='roles/compute.osLogin'

gcloud projects add-iam-policy-binding svc-app-prod \
  --member='user:alice@example.com' \
  --role='roles/iap.tunnelResourceAccessor'

# Step 4: connect to a VM with no external IP through IAP TCP forwarding.
gcloud compute ssh app-prod-01 \
  --project=svc-app-prod --zone=europe-west1-b \
  --tunnel-through-iap

# Step 5: audit instances that still carry external IPs (no workload VM should).
for project in $(gcloud projects list --format='value(projectId)'); do
  gcloud compute instances list --project="$project" \
    --format="value(name,zone,networkInterfaces[].accessConfigs[].natIP)" 2>/dev/null \
    | awk -F'\t' 'NF==3 && $3!="" { print "'"$project"'\t" $0 }'
done

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_org_policy_policy" "require_oslogin" {
  name   = "organizations/${var.org_id}/policies/compute.requireOsLogin"
  parent = "organizations/${var.org_id}"

  spec {
    rules {
      enforce = "TRUE"
    }
  }
}

resource "google_compute_project_metadata" "oslogin_metadata" {
  project = var.app_project_id

  metadata = {
    enable-oslogin         = "TRUE"
    enable-oslogin-2fa     = "TRUE"
    block-project-ssh-keys = "TRUE"
  }
}

resource "google_project_iam_member" "oslogin_alice" {
  project = var.app_project_id
  role    = "roles/compute.osLogin"
  member  = "user:alice@example.com"
}

resource "google_project_iam_member" "iap_tunnel_alice" {
  project = var.app_project_id
  role    = "roles/iap.tunnelResourceAccessor"
  member  = "user:alice@example.com"
}

# Explicit per-instance IAP tunnel grant (defence in depth).
resource "google_iap_tunnel_instance_iam_member" "alice_to_app_prod_01" {
  project  = var.app_project_id
  zone     = "europe-west1-b"
  instance = "app-prod-01"
  role     = "roles/iap.tunnelResourceAccessor"
  member   = "user:alice@example.com"
}

Remediation — Config Connector

apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
kind: OrgPolicyPolicy
metadata:
  name: require-os-login
  namespace: config-control
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "organizations/ORG_ID"
  spec:
    rules:
    - enforce: true
  name: "organizations/ORG_ID/policies/compute.requireOsLogin"

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND protoPayload.methodName=~"v1.compute.(instances|projects).setMetadata"
          AND (protoPayload.request.items.key="block-project-ssh-keys"
               OR protoPayload.request.items.key="enable-oslogin")
          AND (protoPayload.request.items.value="false"
               OR protoPayload.request.items.value="FALSE")

Equivalent on: AWS · Azure · OCI

Two-part supply-chain control: (a) every Artifact Registry repository has the Container Analysis API automatic vulnerability scanning enabled (CVE matches against OS-package indexes plus Go / Java / Node.js / Python language dependencies are persisted as Note + Occurrence resources tied to the image digest; Container Analysis — container scanning overview (accessed 2026-05)), AND (b) every GKE cluster and every Cloud Run service that consumes those images has a Binary Authorization policy in PROJECT_SINGLETON_POLICY_ENFORCE mode requiring attestations from one or more named attestors. The attestor encodes "image built by the trusted CI/CD pipeline AND CVE-scanned" using Sigstore cosign signatures (keyless via OIDC, or KMS-backed via Cloud KMS); the in-toto attestation produced by a hardened, isolated builder is the current Google-recommended SLSA Build Level 3 evidence (SLSA v1.0 — build levels (accessed 2026-05); Google Cloud — Software Delivery Shield overview (accessed 2026-05)). DETECTIVE on the scanning half (the scanner surfaces CVEs already in the image), PREVENTIVE-equivalent on the admission half (BinAuthz blocks deploys that fail the attestation check) — the control is typed DETECTIVE because the surface that names it is the scanner; the policy is the natural enforcement pair. Repository keys should be CMEK (kms_key_name) for regulated workloads. Cite the Binary Authorization key concepts reference for policy-evaluation semantics.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create a CMEK-encrypted Artifact Registry repository.
gcloud artifacts repositories create app-images \
  --repository-format=docker \
  --location=europe-west1 \
  --kms-key=projects/svc-kms-prod/locations/europe-west1/keyRings/app-prod/cryptoKeys/artifacts \
  --project=svc-app-prod

# Step 2: enable Container Analysis API (scanning is automatic once enabled).
gcloud services enable containeranalysis.googleapis.com \
  artifactregistry.googleapis.com binaryauthorization.googleapis.com \
  --project=svc-app-prod

# Step 3: query vulnerabilities for a specific image digest.
gcloud artifacts docker images list \
  europe-west1-docker.pkg.dev/svc-app-prod/app-images/api \
  --include-tags --show-occurrences

gcloud artifacts docker images describe \
  europe-west1-docker.pkg.dev/svc-app-prod/app-images/api@sha256:DIGEST \
  --show-package-vulnerability

# Step 4: define + import a Binary Authorization policy that requires attestations.
cat > binauthz-policy.yaml <<'YAML'
defaultAdmissionRule:
  evaluationMode: REQUIRE_ATTESTATION
  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
  requireAttestationsBy:
  - projects/svc-app-prod/attestors/built-by-prod-ci
clusterAdmissionRules:
  europe-west1.gke-prod:
    evaluationMode: REQUIRE_ATTESTATION
    enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
    requireAttestationsBy:
    - projects/svc-app-prod/attestors/built-by-prod-ci
globalPolicyEvaluationMode: ENABLE
YAML

gcloud container binauthz policy import binauthz-policy.yaml --project=svc-app-prod

# Step 5: create an attestor backed by a Cloud KMS key (cosign-compatible).
gcloud container binauthz attestors create built-by-prod-ci \
  --attestation-authority-note=projects/svc-app-prod/notes/built-by-prod-ci-note \
  --project=svc-app-prod

# Step 6: sign an image post-CVE-scan in CI (cosign with a Cloud KMS key).
cosign sign --key gcpkms://projects/svc-kms-prod/locations/global/keyRings/attest/cryptoKeys/ci/cryptoKeyVersions/1 \
  europe-west1-docker.pkg.dev/svc-app-prod/app-images/api@sha256:DIGEST

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_artifact_registry_repository" "app_images" {
  project       = var.app_project_id
  location      = "europe-west1"
  repository_id = "app-images"
  format        = "DOCKER"
  kms_key_name  = var.artifact_kms_key_id
  description   = "Production application images; CMEK + scanned"
}

resource "google_container_analysis_note" "built_by_prod_ci_note" {
  project = var.app_project_id
  name    = "built-by-prod-ci-note"

  attestation_authority {
    hint {
      human_readable_name = "Built by trusted production CI"
    }
  }
}

resource "google_binary_authorization_attestor" "built_by_prod_ci" {
  project = var.app_project_id
  name    = "built-by-prod-ci"

  attestation_authority_note {
    note_reference = google_container_analysis_note.built_by_prod_ci_note.name

    public_keys {
      id = data.google_kms_crypto_key_version.ci_attest.id

      pkix_public_key {
        public_key_pem      = data.google_kms_crypto_key_version.ci_attest.public_key[0].pem
        signature_algorithm = data.google_kms_crypto_key_version.ci_attest.public_key[0].algorithm
      }
    }
  }
}

resource "google_binary_authorization_policy" "policy" {
  project = var.app_project_id

  default_admission_rule {
    evaluation_mode  = "REQUIRE_ATTESTATION"
    enforcement_mode = "ENFORCED_BLOCK_AND_AUDIT_LOG"

    require_attestations_by = [
      google_binary_authorization_attestor.built_by_prod_ci.name,
    ]
  }

  global_policy_evaluation_mode = "ENABLE"
}

Remediation — Config Connector

apiVersion: artifactregistry.cnrm.cloud.google.com/v1beta1
kind: ArtifactRegistryRepository
metadata:
  name: prod-containers
  namespace: config-control
spec:
  location: us-central1
  format: DOCKER
  description: "Production container repository (Container Analysis enabled)"

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND ((protoPayload.serviceName="containeranalysis.googleapis.com"
                AND protoPayload.methodName=~".*Occurrences.Delete")
               OR (protoPayload.serviceName="artifactregistry.googleapis.com"
                   AND protoPayload.methodName=~".*SetIamPolicy"
                   AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/artifactregistry.writer"))

Equivalent on: AWS · Azure · OCI

Enable VM Manager across every project hosting Compute Engine workloads: deploy the Ops Agent (or the legacy Monitoring/Logging agents) via a managed policy, enable OS Config Inventory so the running package set is reported back, and enable OS Config Compliance to evaluate the running configuration against an OS Policy Assignment (CIS-hardened baseline; required sshd hardening; required auditd configuration) (Google Cloud — Manage OS with VM Manager (accessed 2026-05)). The compliance results surface in Security Command Center as Security Command Center findings, closing the detection loop from "package installed on a running VM" to "audit-ready dashboard at organisation scope". This is the detection / posture side of VM Manager; the patch-application side is gcp-work-08. Anti-conflation: OS Config Inventory reports what is installed (raw package list, kernel version, agent versions); OS Config Compliance evaluates that inventory against policy (is openssh-server the expected version? does /etc/ssh/sshd_config enforce PermitRootLogin no?); OS Config Patch Deployments (the -08 control) is the remediation surface that closes the loop on a recurring schedule. Same product family, three distinct workflows.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enable the VM Manager APIs.
gcloud services enable osconfig.googleapis.com containeranalysis.googleapis.com \
  --project=svc-app-prod

# Step 2: enable OS Config on the project (per-instance metadata or project metadata).
gcloud compute project-info add-metadata --project=svc-app-prod \
  --metadata=enable-osconfig=TRUE,enable-guest-attributes=TRUE

# Step 3: deploy the Ops Agent across the fleet via an OS Policy Assignment.
cat > ops-agent-policy.yaml <<'YAML'
osPolicies:
- id: install-ops-agent
  mode: ENFORCEMENT
  resourceGroups:
  - resources:
    - id: ops-agent
      repository:
        apt:
          archiveType: DEB
          uri: https://packages.cloud.google.com/apt
          distribution: google-cloud-ops-agent-focal-all
          components: [main]
          gpgKey: https://packages.cloud.google.com/apt/doc/apt-key.gpg
    - id: ops-agent-pkg
      pkg:
        desiredState: INSTALLED
        apt:
          name: google-cloud-ops-agent
instanceFilter:
  all: true
rollout:
  disruptionBudget:
    percent: 25
  minWaitDuration: 300s
YAML

gcloud compute os-config os-policy-assignments create install-ops-agent \
  --location=europe-west1 \
  --project=svc-app-prod \
  --file=ops-agent-policy.yaml

# Step 4: query OS inventory for a single VM.
gcloud compute os-config inventories describe app-prod-01 \
  --location=europe-west1-b --project=svc-app-prod

# Step 5: query OS compliance for the fleet.
gcloud compute os-config os-policy-assignment-reports list \
  --location=europe-west1 --project=svc-app-prod

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_project_service" "osconfig" {
  project = var.app_project_id
  service = "osconfig.googleapis.com"
}

resource "google_compute_project_metadata_item" "enable_osconfig" {
  project = var.app_project_id
  key     = "enable-osconfig"
  value   = "TRUE"
}

resource "google_os_config_os_policy_assignment" "install_ops_agent" {
  project  = var.app_project_id
  name     = "install-ops-agent"
  location = "europe-west1"

  os_policies {
    id   = "install-ops-agent"
    mode = "ENFORCEMENT"

    resource_groups {
      resources {
        id = "ops-agent-pkg"

        pkg {
          desired_state = "INSTALLED"

          apt {
            name = "google-cloud-ops-agent"
          }
        }
      }
    }
  }

  instance_filter {
    all = true
  }

  rollout {
    disruption_budget {
      percent = 25
    }
    min_wait_duration = "300s"
  }
}

Remediation — Config Connector

apiVersion: osconfig.cnrm.cloud.google.com/v1beta1
kind: OSConfigOSPolicyAssignment
metadata:
  name: baseline-os-policy
  namespace: config-control
spec:
  location: us-central1
  projectRef:
    external: "projects/PROJECT_ID"
  instanceFilter:
    inclusionLabels:
    - labels:
        env: prod
  osPolicies:
  - id: ensure-osconfig-agent
    mode: ENFORCEMENT
    resourceGroups:
    - resources:
      - id: osconfig-agent-running
        exec:
          validate:
            interpreter: SHELL
            script: "systemctl is-active google-osconfig-agent && exit 100 || exit 101"
  rollout:
    disruptionBudget:
      percent: 10
    minWaitDuration: "300s"

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="osconfig.googleapis.com"
          AND (protoPayload.methodName=~".*PatchDeployments.(delete|patch)"
               OR protoPayload.methodName=~".*OSPolicyAssignments.(delete|patch)")

Equivalent on: AWS · Azure · OCI

Every Cloud Run service runs under its own dedicated, least-privileged service account — NOT the Compute Engine default service account, which ships with roles/editor across the entire project. Ingress is restricted to internal-and-cloud-load-balancing (the service is fronted by an external HTTPS Load Balancer with Cloud Armor) or internal (only callers from the same VPC, Shared VPC, or VPC SC perimeter); never the default all for any service that does not legitimately need to be reachable from the public internet. Secrets are injected via Secret Manager references using the run.googleapis.com/secrets annotation or the equivalent --set-secrets binding on gcloud run deploy — never as plaintext environment variables in the service revision (Google Cloud — Cloud Run service identity (accessed 2026-05); Google Cloud — Cloud Run secrets (accessed 2026-05)). The IAM invoker binding enumerates explicit principals; allUsers (anonymous) and allAuthenticatedUsers (any Google account on the internet) are forbidden unless the service is genuinely intended to be public, in which case authorisation is layered behind an external HTTPS Load Balancer with Cloud Armor and IAP. VPC connectors (or Direct VPC egress) route the service to private resources without exposing them publicly. This control DOES NOT re-author the canonical Secrets Manager + KMS reference architecture — that lives at general/iam — secrets management (canonical-content rule).

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create a dedicated service account for the Cloud Run service.
gcloud iam service-accounts create sa-api-prod \
  --display-name="Cloud Run: api-prod" \
  --project=svc-app-prod

# Step 2: grant ONLY the narrow IAM roles this service needs.
gcloud projects add-iam-policy-binding svc-app-prod \
  --member='serviceAccount:sa-api-prod@svc-app-prod.iam.gserviceaccount.com' \
  --role='roles/secretmanager.secretAccessor' \
  --condition='expression=resource.name.startsWith("projects/svc-app-prod/secrets/api-prod-"),title=api-prod-secrets-only'

# Step 3: grant the Cloud Run service permission to access the database secret.
gcloud secrets add-iam-policy-binding api-prod-db-url \
  --member='serviceAccount:sa-api-prod@svc-app-prod.iam.gserviceaccount.com' \
  --role='roles/secretmanager.secretAccessor' \
  --project=svc-app-prod

# Step 4: deploy with dedicated SA, internal ingress, Secret Manager refs, no public.
gcloud run deploy api-prod \
  --image=europe-west1-docker.pkg.dev/svc-app-prod/app-images/api:v1.0.0 \
  --service-account=sa-api-prod@svc-app-prod.iam.gserviceaccount.com \
  --region=europe-west1 \
  --project=svc-app-prod \
  --ingress=internal-and-cloud-load-balancing \
  --no-allow-unauthenticated \
  --set-secrets=DATABASE_URL=api-prod-db-url:latest \
  --vpc-connector=projects/svc-net-prod/locations/europe-west1/connectors/vpc-conn-prod \
  --vpc-egress=private-ranges-only

# Step 5: grant the invoker role to a specific principal (NEVER allUsers).
gcloud run services add-iam-policy-binding api-prod \
  --region=europe-west1 --project=svc-app-prod \
  --member='serviceAccount:sa-frontend-prod@svc-app-prod.iam.gserviceaccount.com' \
  --role='roles/run.invoker'

# Step 6: audit all Cloud Run services for forbidden invoker bindings (allUsers/allAuth).
for project in $(gcloud projects list --format='value(projectId)'); do
  for svc in $(gcloud run services list --project="$project" --format='value(metadata.name,metadata.namespace)' 2>/dev/null); do
    gcloud run services get-iam-policy "$svc" --project="$project" --format=json 2>/dev/null \
      | jq -r '.bindings[]? | select(.members[]? | test("allUsers|allAuthenticatedUsers")) | "'"$project"'/'"$svc"': " + .role'
  done
done

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_service_account" "sa_api_prod" {
  project      = var.app_project_id
  account_id   = "sa-api-prod"
  display_name = "Cloud Run: api-prod"
}

resource "google_secret_manager_secret_iam_member" "api_prod_db_url_access" {
  project   = var.app_project_id
  secret_id = google_secret_manager_secret.api_prod_db_url.id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.sa_api_prod.email}"
}

resource "google_cloud_run_v2_service" "api_prod" {
  project  = var.app_project_id
  name     = "api-prod"
  location = "europe-west1"
  ingress  = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"

  template {
    service_account = google_service_account.sa_api_prod.email

    vpc_access {
      connector = var.vpc_connector_id
      egress    = "PRIVATE_RANGES_ONLY"
    }

    containers {
      image = "europe-west1-docker.pkg.dev/${var.app_project_id}/app-images/api:v1.0.0"

      env {
        name = "DATABASE_URL"

        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.api_prod_db_url.secret_id
            version = "latest"
          }
        }
      }
    }
  }
}

# Explicit invoker binding — NEVER allUsers / allAuthenticatedUsers for internal APIs.
resource "google_cloud_run_v2_service_iam_member" "api_prod_invoker" {
  project  = var.app_project_id
  location = google_cloud_run_v2_service.api_prod.location
  name     = google_cloud_run_v2_service.api_prod.name
  role     = "roles/run.invoker"
  member   = "serviceAccount:sa-frontend-prod@${var.app_project_id}.iam.gserviceaccount.com"
}

Remediation — Config Connector

apiVersion: run.cnrm.cloud.google.com/v1beta1
kind: RunService
metadata:
  name: hardened-run-service
  namespace: config-control
spec:
  location: us-central1
  template:
    serviceAccountRef:
      name: cloudrun-runtime-sa
    containers:
    - image: us-central1-docker.pkg.dev/PROJECT_ID/prod-containers/app:1.0.0
      resources:
        limits:
          cpu: "1"
          memory: "512Mi"
  ingress: INGRESS_TRAFFIC_INTERNAL_ONLY

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="run.googleapis.com"
          AND ((protoPayload.methodName=~".*services.setIamPolicy"
                AND protoPayload.serviceData.policyDelta.bindingDeltas.member="allUsers")
               OR protoPayload.request.spec.template.spec.serviceAccountName=~".*-compute@developer.gserviceaccount.com"
               OR protoPayload.request.metadata.annotations."run.googleapis.com/ingress"="all")

Equivalent on: AWS · Azure · OCI

GKE cluster is hardened as a single umbrella control combining five inseparable surfaces. (a) Workload Identity Federation for GKE — clusters created with --workload-pool=PROJECT_ID.svc.id.goog bind Kubernetes Service Accounts (KSAs) to Google Service Accounts (GSAs) via the iam.workloadIdentityUser role; pods request short-lived OAuth2 tokens from the GKE metadata server using their KSA identity. The current syntax is --workload-pool=PROJECT_ID.svc.id.goog; the legacy identity-namespace flag form is deprecated and a G12 violation on this corpus (Google Cloud — GKE Workload Identity (accessed 2026-05)). (b) Private cluster topology — --enable-private-endpoint with master-authorized networks restricts the API server to a private IP plus a small allowlist of management CIDRs; nodes have no external IPs. (c) Binary Authorization integration — binary_authorization { evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE" } ensures pod admission consults the project's BinAuthz policy (the one configured in gcp-work-03). (d) GKE Dataplane V2 — --datapath-provider=ADVANCED_DATAPATH swaps kube-proxy/iptables for Cilium-based eBPF, enabling native NetworkPolicy enforcement with default-deny pod-to-pod plus FQDN egress policies; cluster authors must ship a default-deny NetworkPolicy per namespace. (e) Shielded GKE Nodes — shielded_nodes { enabled = true } with integrity monitoring + secure boot on every node. Autopilot vs Standard in prose: Autopilot eliminates control-plane and node operator burden (Google manages the node pool, no SSH or DaemonSet privileges for the customer; bills per-pod resource request) and is the preferred default for stateless web workloads; Standard is required for privileged DaemonSets (eBPF agents not from the curated GKE Autopilot allowlist), custom OS images, GPU pools, large persistent stateful workloads, and any scenario needing direct node access. Both modes support the full set of hardening toggles above. Single umbrella, NOT split into two controls.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create a hardened GKE Standard cluster with the full umbrella.
gcloud container clusters create gke-prod-euw1 \
  --project=svc-app-prod --region=europe-west1 \
  --workload-pool=svc-app-prod.svc.id.goog \
  --enable-private-nodes --enable-private-endpoint \
  --master-ipv4-cidr=172.16.0.0/28 \
  --master-authorized-networks=10.50.0.0/24 \
  --enable-binauthz \
  --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE \
  --datapath-provider=ADVANCED_DATAPATH \
  --enable-shielded-nodes \
  --shielded-secure-boot --shielded-integrity-monitoring \
  --release-channel=regular \
  --enable-network-policy

# Step 2: alternative — Autopilot cluster (Google-managed nodes; same toggles inherited).
gcloud container clusters create-auto gke-prod-autopilot \
  --project=svc-app-prod --region=europe-west1 \
  --workload-pool=svc-app-prod.svc.id.goog \
  --enable-private-nodes --enable-private-endpoint \
  --master-ipv4-cidr=172.16.0.16/28 \
  --master-authorized-networks=10.50.0.0/24 \
  --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE \
  --release-channel=regular

# Step 3: bind a Kubernetes Service Account to a Google Service Account.
kubectl create namespace api
kubectl create serviceaccount ksa-api -n api

gcloud iam service-accounts add-iam-policy-binding \
  sa-api-prod@svc-app-prod.iam.gserviceaccount.com \
  --role=roles/iam.workloadIdentityUser \
  --member='serviceAccount:svc-app-prod.svc.id.goog[api/ksa-api]'

kubectl annotate serviceaccount ksa-api -n api \
  iam.gke.io/gcp-service-account=sa-api-prod@svc-app-prod.iam.gserviceaccount.com

# Step 4: ship a default-deny NetworkPolicy in every namespace.
cat <<'YAML' | kubectl apply -n api -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
YAML

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_container_cluster" "gke_prod_euw1" {
  project  = var.app_project_id
  name     = "gke-prod-euw1"
  location = "europe-west1"

  # G12: ONLY workload-pool syntax. Legacy identity-namespace flag is forbidden.
  workload_identity_config {
    workload_pool = "${var.app_project_id}.svc.id.goog"
  }

  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = true
    master_ipv4_cidr_block  = "172.16.0.0/28"
  }

  master_authorized_networks_config {
    cidr_blocks {
      cidr_block   = "10.50.0.0/24"
      display_name = "ops-mgmt-cidr"
    }
  }

  binary_authorization {
    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
  }

  datapath_provider = "ADVANCED_DATAPATH"

  network_policy {
    enabled = true
  }

  node_config {
    shielded_instance_config {
      enable_secure_boot          = true
      enable_integrity_monitoring = true
    }
  }

  release_channel {
    channel = "REGULAR"
  }

  remove_default_node_pool = true
  initial_node_count       = 1

  deletion_protection = true
}

Remediation — Config Connector

apiVersion: container.cnrm.cloud.google.com/v1beta1
kind: ContainerCluster
metadata:
  name: wi-gke
  namespace: config-control
spec:
  location: us-central1
  initialNodeCount: 1
  workloadIdentityConfig:
    workloadPool: "PROJECT_ID.svc.id.goog"
  nodeConfig:
    workloadMetadataConfig:
      mode: GKE_METADATA

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="cloudfunctions.googleapis.com"
          AND (protoPayload.methodName=~".*functions.(create|update)"
               AND (protoPayload.request.function.runtime=~"nodejs10|python37|go113|nodejs12"
                    OR protoPayload.request.function.ingressSettings="ALLOW_ALL"))

Equivalent on: AWS · Azure · OCI

Image curation runs through a hardened pipeline: Cloud Build consumes pinned base images from the CIS-hardened Public Image Project (or an internal curated image family), produces immutable artefacts in Artifact Registry, signs them via Sigstore cosign against a Binary Authorization attestor (the same one consumed by gcp-work-03), and emits an SLSA in-toto provenance attestation that survives in Container Analysis as a Note / Occurrence pair. Community-provided OS images and "latest"-tagged base images are forbidden for production workloads — pin to image digests or to an organisation-owned image family that has been baseline-scanned. For regulated workloads, layer Confidential VM (AMD SEV / SEV-SNP, Intel TDX) on top of the Shielded VM baseline — confidential nodes encrypt memory in use with attestation against the platform, closing the host-administrator-can-read-RAM blast radius (Google Cloud — Confidential VM overview (accessed 2026-05)). This control pairs with gcp-work-03: that one is the runtime admission gate; this one is the build-time provenance generator. Anti-conflation: "we use signed images" without an attestation policy enforcing the signature is theatre; "we have a Binary Authorization policy" without a build pipeline producing the attestations is unenforceable. Both halves are required.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: trigger a Cloud Build that scans + signs + pushes.
cat > cloudbuild.yaml <<'YAML'
steps:
# Build stage — pinned base image (no :latest).
- name: 'gcr.io/cloud-builders/docker'
  args: ['build', '-t', 'europe-west1-docker.pkg.dev/$PROJECT_ID/app-images/api:$SHORT_SHA', '.']
# Push stage.
- name: 'gcr.io/cloud-builders/docker'
  args: ['push', 'europe-west1-docker.pkg.dev/$PROJECT_ID/app-images/api:$SHORT_SHA']
# Sign with cosign + Cloud KMS.
- name: 'gcr.io/projectsigstore/cosign'
  args:
  - 'sign'
  - '--key=gcpkms://projects/svc-kms-prod/locations/global/keyRings/attest/cryptoKeys/ci/cryptoKeyVersions/1'
  - 'europe-west1-docker.pkg.dev/$PROJECT_ID/app-images/api:$SHORT_SHA'
# Attest under the Binary Authorization attestor.
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
  entrypoint: 'gcloud'
  args:
  - 'beta'
  - 'container'
  - 'binauthz'
  - 'attestations'
  - 'sign-and-create'
  - '--artifact-url=europe-west1-docker.pkg.dev/$PROJECT_ID/app-images/api:$SHORT_SHA'
  - '--attestor=projects/$PROJECT_ID/attestors/built-by-prod-ci'
  - '--keyversion=projects/svc-kms-prod/locations/global/keyRings/attest/cryptoKeys/ci/cryptoKeyVersions/1'
options:
  requestedVerifyOption: VERIFIED
  logging: CLOUD_LOGGING_ONLY
YAML

gcloud builds submit --config=cloudbuild.yaml --project=svc-app-prod

# Step 2: launch a Confidential VM for a regulated workload (Shielded VM still required).
gcloud compute instances create app-confidential-01 \
  --project=svc-app-prod --zone=europe-west1-b \
  --machine-type=n2d-standard-4 \
  --confidential-compute --maintenance-policy=TERMINATE \
  --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring \
  --image-family=ubuntu-2204-lts-amd-confidential \
  --image-project=ubuntu-os-cloud \
  --no-address

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_artifact_registry_repository" "base_images" {
  project       = var.app_project_id
  location      = "europe-west1"
  repository_id = "base-images"
  format        = "DOCKER"
  kms_key_name  = var.artifact_kms_key_id
  description   = "Curated CIS-hardened base images; signed + attested"
}

resource "google_binary_authorization_attestor" "golden_image_attestor" {
  project = var.app_project_id
  name    = "golden-image-attestor"

  attestation_authority_note {
    note_reference = google_container_analysis_note.golden_image_note.name

    public_keys {
      id = data.google_kms_crypto_key_version.attest.id

      pkix_public_key {
        public_key_pem      = data.google_kms_crypto_key_version.attest.public_key[0].pem
        signature_algorithm = data.google_kms_crypto_key_version.attest.public_key[0].algorithm
      }
    }
  }
}

# Confidential VM example — layered on top of Shielded VM baseline.
resource "google_compute_instance" "app_confidential_01" {
  project      = var.app_project_id
  name         = "app-confidential-01"
  zone         = "europe-west1-b"
  machine_type = "n2d-standard-4"

  confidential_instance_config {
    enable_confidential_compute = true
  }

  scheduling {
    on_host_maintenance = "TERMINATE"
  }

  shielded_instance_config {
    enable_secure_boot          = true
    enable_vtpm                 = true
    enable_integrity_monitoring = true
  }

  boot_disk {
    initialize_params {
      image = "projects/ubuntu-os-cloud/global/images/family/ubuntu-2204-lts-amd-confidential"
    }
  }

  network_interface {
    subnetwork = var.app_subnet_self_link
  }
}

Remediation — Config Connector

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeInstance
metadata:
  name: confidential-vm
  namespace: config-control
spec:
  zone: us-central1-a
  machineType: n2d-standard-2
  bootDisk:
    initializeParams:
      imageRef:
        external: "projects/confidential-vm-images/global/images/family/ubuntu-2204-lts"
  networkInterface:
  - networkRef:
      name: prod-vpc
  confidentialInstanceConfig:
    enableConfidentialCompute: true
  shieldedInstanceConfig:
    enableSecureBoot: true
    enableVtpm: true
    enableIntegrityMonitoring: true

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND protoPayload.methodName="v1.compute.instances.insert"
          AND protoPayload.request.networkInterfaces.subnetwork=~".*confidential.*"
          AND NOT protoPayload.request.confidentialInstanceConfig.enableConfidentialCompute=true

Equivalent on: AWS · Azure · OCI

The patch-application surface of VM Manager Patch Deployments closes the loop that gcp-work-04 opens. A recurring Patch Deployment runs on a cron-style schedule, targets an instance filter (all instances; a specific zone; a tag), executes the platform-appropriate package-manager update (apt / yum / dnf / Windows Update / zypper) inside a maintenance window, and reports compliance back to Security Command Center. Rolling-restart semantics on managed instance groups keep production fleets serving traffic during the patch run. Anti-conflation: gcp-work-04 is the inventory + compliance side ("what's installed and does it match policy"); gcp-work-08 is the patch-application side ("apply the missing CVE fixes on this schedule"). The same VM Manager product, two distinct review rituals — mirroring the Phase 6 Systems Manager Patch Manager split and the Phase 7 Azure Update Manager split. DETECTIVE because the compliance dashboard surfaces patch-state drift; the auto-remediation aspect (the deploy itself) is the natural pair to the detection. Cite VM Manager — schedule patch jobs (accessed 2026-05) for the schedule semantics.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create a recurring monthly Patch Deployment with a maintenance window.
cat > monthly-patch.yaml <<'YAML'
patchConfig:
  apt:
    type: DIST
  yum:
    security: true
    minimal: false
  rebootConfig: DEFAULT
duration: 3600s
instanceFilter:
  all: true
recurringSchedule:
  timeZone:
    id: Europe/Brussels
  timeOfDay:
    hours: 2
    minutes: 0
  frequency: MONTHLY
  monthly:
    weekDayOfMonth:
      weekOrdinal: 1
      dayOfWeek: SUNDAY
  startTime: '2026-06-01T02:00:00Z'
YAML

gcloud compute os-config patch-deployments create monthly-patch \
  --file=monthly-patch.yaml --project=svc-app-prod

# Step 2: run a one-off emergency patch job (out-of-cycle CVE response).
gcloud compute os-config patch-jobs execute \
  --description="Emergency regreSSHion patch" \
  --instance-filter-all \
  --duration=1800s \
  --reboot-config=DEFAULT \
  --project=svc-app-prod

# Step 3: query compliance after a patch run.
gcloud compute os-config patch-jobs list --project=svc-app-prod --limit=5
gcloud compute os-config patch-jobs describe JOB_ID --project=svc-app-prod

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_os_config_patch_deployment" "monthly_patch" {
  project             = var.app_project_id
  patch_deployment_id = "monthly-patch"

  instance_filter {
    all = true
  }

  patch_config {
    reboot_config = "DEFAULT"

    apt {
      type = "DIST"
    }

    yum {
      security = true
      minimal  = false
    }
  }

  duration = "3600s"

  recurring_schedule {
    time_zone {
      id = "Europe/Brussels"
    }

    time_of_day {
      hours   = 2
      minutes = 0
    }

    frequency  = "MONTHLY"
    start_time = "2026-06-01T02:00:00Z"

    monthly {
      week_day_of_month {
        week_ordinal = 1
        day_of_week  = "SUNDAY"
      }
    }
  }
}

Remediation — Config Connector

apiVersion: osconfig.cnrm.cloud.google.com/v1beta1
kind: OSConfigPatchDeployment
metadata:
  name: monthly-patch
  namespace: config-control
spec:
  projectRef:
    external: "projects/PROJECT_ID"
  patchDeploymentId: monthly-patch
  instanceFilter:
    all: true
  patchConfig:
    rebootConfig: ALWAYS
    apt:
      type: DIST
    yum:
      security: true
      minimal: true
  recurringSchedule:
    timeZone:
      id: "Etc/UTC"
    timeOfDay:
      hours: 3
    monthly:
      monthDay: 15

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND protoPayload.methodName=~"v1.compute.(instances|projects).setMetadata"
          AND (protoPayload.request.items.key="ssh-keys"
               OR protoPayload.request.items.key="serial-port-enable")

Equivalent on: AWS · Azure · OCI