Changelog

Subscribe to Turbot changelog via RSS or join #changelog on our Slack community to stay updated on everything we ship.

...

gcp v5.40.1 - Service Usage API Enabled control now updates in real time

Oct 29, 2026

guardrailsMods

Bug fixes

The GCP > Service Usage > API Enabled control now updates in real time when the Service Usage API is enabled or disabled in a project.

gcp-serviceusage v5.0.0 is now available

Oct 29, 2026

guardrailsMods

What's new?

Added the GCP > Service Usage service, with an API Enabled control to check and enforce whether the Service Usage API (serviceusage.googleapis.com) is enabled on each GCP project. A project where the Service Usage API is already disabled is reported as Disabled.

Resource Types

Added

GCP > Service Usage

Control Types

Added

GCP > Service Usage > API Enabled
GCP > Service Usage > CMDB
GCP > Service Usage > Discovery

Policy Types

Added

GCP > Service Usage > API Enabled
GCP > Service Usage > CMDB
GCP > Service Usage > Enabled
GCP > Service Usage > Permissions
GCP > Service Usage > Permissions > Levels
GCP > Service Usage > Permissions > Levels > Modifiers
GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-serviceusage
GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-serviceusage

Action Types

Added

GCP > Service Usage > Set API Enabled

AWS mods - Retired unused Usage controls and policies (ElastiCache, Events, GuardDuty, Logs, Redshift, SSM)

Oct 29, 2026

guardrailsMods

What's new?

The Usage controls and their Usage and Usage > Limit policies have been retired from the resource types in the mods listed below. The Approved > Usage policies are unaffected and remain available.

Released versions:

aws-elasticache v5.14.0
aws-events v5.19.0
aws-guardduty v5.12.0
aws-logs v5.19.0
aws-redshift v5.26.0
aws-ssm v5.18.0

Control Types

Removed

AWS > ElastiCache > Cache Cluster > Usage
AWS > ElastiCache > Cache Parameter Group > Usage
AWS > ElastiCache > Snapshot > Usage
AWS > Events > Event Bus > Usage
AWS > Events > Rule > Usage
AWS > Events > Target > Usage
AWS > GuardDuty > Detector > Usage
AWS > GuardDuty > IPSet > Usage
AWS > GuardDuty > ThreatIntelSet > Usage
AWS > Logs > Log Group > Usage
AWS > Logs > Log Stream > Usage
AWS > Logs > Metric Filter > Usage
AWS > Logs > Resource Policy > Usage
AWS > Redshift > Cluster > Usage
AWS > Redshift > Cluster Parameter Group > Usage
AWS > Redshift > Manual Cluster Snapshot > Usage
AWS > Redshift > Cluster Subnet Group > Usage
AWS > SSM > Association > Usage
AWS > SSM > Document > Usage
AWS > SSM > Maintenance Window > Usage
AWS > SSM > Parameter > Usage

Policy Types

Removed

AWS > ElastiCache > Cache Cluster > Usage
AWS > ElastiCache > Cache Cluster > Usage > Limit
AWS > ElastiCache > Cache Parameter Group > Usage
AWS > ElastiCache > Cache Parameter Group > Usage > Limit
AWS > ElastiCache > Snapshot > Usage
AWS > ElastiCache > Snapshot > Usage > Limit
AWS > Events > Event Bus > Usage
AWS > Events > Event Bus > Usage > Limit
AWS > Events > Rule > Usage
AWS > Events > Rule > Usage > Limit
AWS > Events > Target > Usage
AWS > Events > Target > Usage > Limit
AWS > GuardDuty > Detector > Usage
AWS > GuardDuty > Detector > Usage > Limit
AWS > GuardDuty > IPSet > Usage
AWS > GuardDuty > IPSet > Usage > Limit
AWS > GuardDuty > ThreatIntelSet > Usage
AWS > GuardDuty > ThreatIntelSet > Usage > Limit
AWS > Logs > Log Group > Usage
AWS > Logs > Log Group > Usage > Limit
AWS > Logs > Log Stream > Usage
AWS > Logs > Log Stream > Usage > Limit
AWS > Logs > Metric Filter > Usage
AWS > Logs > Metric Filter > Usage > Limit
AWS > Logs > Resource Policy > Usage
AWS > Logs > Resource Policy > Usage > Limit
AWS > Redshift > Cluster > Usage
AWS > Redshift > Cluster > Usage > Limit
AWS > Redshift > Cluster Parameter Group > Usage
AWS > Redshift > Cluster Parameter Group > Usage > Limit
AWS > Redshift > Manual Cluster Snapshot > Usage
AWS > Redshift > Manual Cluster Snapshot > Usage > Limit
AWS > Redshift > Cluster Subnet Group > Usage
AWS > Redshift > Cluster Subnet Group > Usage > Limit
AWS > SSM > Association > Usage
AWS > SSM > Association > Usage > Limit
AWS > SSM > Document > Usage
AWS > SSM > Document > Usage > Limit
AWS > SSM > Maintenance Window > Usage
AWS > SSM > Maintenance Window > Usage > Limit
AWS > SSM > Parameter > Usage
AWS > SSM > Parameter > Usage > Limit

gcp-vertexai v5.6.0 - Check and undeploy unapproved models on endpoints

Oct 28, 2026

guardrailsMods

What's new?

You can now check that your endpoints serve only the models you approve. List the approved models in GCP > Agent Platform > Endpoint > Deployed Models > Approved > Models by their Model Garden or Model Registry name, with an optional version. Then set GCP > Agent Platform > Endpoint > Deployed Models > Approved to Check: Approved to alarm on endpoints serving any other model, or to Enforce: Undeploy unapproved to undeploy those models. Only the unapproved models are undeployed, and their traffic moves to the models that stay. The policy defaults to Skip, so nothing changes until you set it.
If Guardrails can't yet tell which model a deployment is, it reports it in the alarm but never undeploys it.
You can now see which models are offered in each region's Model Garden, including models from publishers such as Meta, Qwen, DeepSeek and OpenAI that the global catalog doesn't list. Set GCP > Agent Platform > Region Publisher Model > CMDB to Enforce: Enabled to record them, and choose the regions in GCP > Agent Platform > Region Publisher Model > Regions. The CMDB policy defaults to Skip, so nothing is recorded until you turn it on.
Vertex AI is now called Agent Platform in Guardrails, to match Google's new name, so its policies and controls appear under GCP > Agent Platform. Your existing policy settings keep working, including values that still mention Vertex AI, so you don't need to change anything.

Bug fixes

The Allowed > Custom, Allowed > Region and Allowed > Encryption at Rest controls for endpoints no longer try to delete an endpoint that still has models deployed to it, which Google Cloud refuses. They keep the endpoint in alarm and delete it once its models are undeployed.
When Google Cloud returns a temporary error, the Delete actions for models, deployment resource pools, notebook runtime templates and endpoints now show its message instead of [object Object].
Models and publisher models no longer lose their version ID when Guardrails updates them. It is now kept as modelVersionId.
Publisher Model discovery now also finds Model Garden models from Mistral AI and xAI.
Publisher models are now refreshed every 24 hours, so models that Google adds to or removes from the global Model Garden catalog show up in Guardrails. Before, the catalog was read only once.

Resource Types

Added

GCP > Agent Platform > Region Publisher Model

Renamed

GCP > Vertex AI to GCP > Agent Platform
GCP > Vertex AI > Deployment Resource Pool to GCP > Agent Platform > Deployment Resource Pool
GCP > Vertex AI > Endpoint to GCP > Agent Platform > Endpoint
GCP > Vertex AI > Model to GCP > Agent Platform > Model
GCP > Vertex AI > Notebook Runtime Template to GCP > Agent Platform > Notebook Runtime Template
GCP > Vertex AI > Publisher Model to GCP > Agent Platform > Publisher Model

Control Types

Added

GCP > Agent Platform > Endpoint > Deployed Models
GCP > Agent Platform > Endpoint > Deployed Models > Approved
GCP > Agent Platform > Region Publisher Model > CMDB
GCP > Agent Platform > Region Publisher Model > Discovery

Renamed

GCP > Vertex AI > API Enabled to GCP > Agent Platform > API Enabled
GCP > Vertex AI > CMDB to GCP > Agent Platform > CMDB
GCP > Vertex AI > Deployment Resource Pool > Active to GCP > Agent Platform > Deployment Resource Pool > Active
GCP > Vertex AI > Deployment Resource Pool > Allowed to GCP > Agent Platform > Deployment Resource Pool > Allowed
GCP > Vertex AI > Deployment Resource Pool > Allowed > Custom to GCP > Agent Platform > Deployment Resource Pool > Allowed > Custom
GCP > Vertex AI > Deployment Resource Pool > Allowed > Encryption at Rest to GCP > Agent Platform > Deployment Resource Pool > Allowed > Encryption at Rest
GCP > Vertex AI > Deployment Resource Pool > Allowed > Region to GCP > Agent Platform > Deployment Resource Pool > Allowed > Region
GCP > Vertex AI > Deployment Resource Pool > CMDB to GCP > Agent Platform > Deployment Resource Pool > CMDB
GCP > Vertex AI > Deployment Resource Pool > Discovery to GCP > Agent Platform > Deployment Resource Pool > Discovery
GCP > Vertex AI > Discovery to GCP > Agent Platform > Discovery
GCP > Vertex AI > Endpoint > Active to GCP > Agent Platform > Endpoint > Active
GCP > Vertex AI > Endpoint > Active > Request-Response Logging to GCP > Agent Platform > Endpoint > Active > Request-Response Logging
GCP > Vertex AI > Endpoint > Allowed to GCP > Agent Platform > Endpoint > Allowed
GCP > Vertex AI > Endpoint > Allowed > Custom to GCP > Agent Platform > Endpoint > Allowed > Custom
GCP > Vertex AI > Endpoint > Allowed > Encryption at Rest to GCP > Agent Platform > Endpoint > Allowed > Encryption at Rest
GCP > Vertex AI > Endpoint > Allowed > Region to GCP > Agent Platform > Endpoint > Allowed > Region
GCP > Vertex AI > Endpoint > Approved to GCP > Agent Platform > Endpoint > Approved
GCP > Vertex AI > Endpoint > CMDB to GCP > Agent Platform > Endpoint > CMDB
GCP > Vertex AI > Endpoint > Discovery to GCP > Agent Platform > Endpoint > Discovery
GCP > Vertex AI > Endpoint > Labels to GCP > Agent Platform > Endpoint > Labels
GCP > Vertex AI > Model > Active to GCP > Agent Platform > Model > Active
GCP > Vertex AI > Model > Allowed to GCP > Agent Platform > Model > Allowed
GCP > Vertex AI > Model > Allowed > Custom to GCP > Agent Platform > Model > Allowed > Custom
GCP > Vertex AI > Model > Allowed > Region to GCP > Agent Platform > Model > Allowed > Region
GCP > Vertex AI > Model > CMDB to GCP > Agent Platform > Model > CMDB
GCP > Vertex AI > Model > Discovery to GCP > Agent Platform > Model > Discovery
GCP > Vertex AI > Model > Labels to GCP > Agent Platform > Model > Labels
GCP > Vertex AI > Notebook Runtime Template > Active to GCP > Agent Platform > Notebook Runtime Template > Active
GCP > Vertex AI > Notebook Runtime Template > Allowed to GCP > Agent Platform > Notebook Runtime Template > Allowed
GCP > Vertex AI > Notebook Runtime Template > Allowed > Custom to GCP > Agent Platform > Notebook Runtime Template > Allowed > Custom
GCP > Vertex AI > Notebook Runtime Template > Allowed > Region to GCP > Agent Platform > Notebook Runtime Template > Allowed > Region
GCP > Vertex AI > Notebook Runtime Template > Approved to GCP > Agent Platform > Notebook Runtime Template > Approved
GCP > Vertex AI > Notebook Runtime Template > CMDB to GCP > Agent Platform > Notebook Runtime Template > CMDB
GCP > Vertex AI > Notebook Runtime Template > Discovery to GCP > Agent Platform > Notebook Runtime Template > Discovery
GCP > Vertex AI > Notebook Runtime Template > Labels to GCP > Agent Platform > Notebook Runtime Template > Labels
GCP > Vertex AI > Publisher Model > CMDB to GCP > Agent Platform > Publisher Model > CMDB
GCP > Vertex AI > Publisher Model > Discovery to GCP > Agent Platform > Publisher Model > Discovery

Policy Types

Added

GCP > Agent Platform > Endpoint > Deployed Models
GCP > Agent Platform > Endpoint > Deployed Models > Approved
GCP > Agent Platform > Endpoint > Deployed Models > Approved > Models
GCP > Agent Platform > Region Publisher Model > CMDB
GCP > Agent Platform > Region Publisher Model > Regions

Renamed

GCP > Vertex AI > API Enabled to GCP > Agent Platform > API Enabled
GCP > Vertex AI > Allowed Regions [Default] to GCP > Agent Platform > Allowed Regions [Default]
GCP > Vertex AI > Approved Regions [Default] to GCP > Agent Platform > Approved Regions [Default]
GCP > Vertex AI > CMDB to GCP > Agent Platform > CMDB
GCP > Vertex AI > Deployment Resource Pool > Active to GCP > Agent Platform > Deployment Resource Pool > Active
GCP > Vertex AI > Deployment Resource Pool > Active > Age to GCP > Agent Platform > Deployment Resource Pool > Active > Age
GCP > Vertex AI > Deployment Resource Pool > Active > Last Modified to GCP > Agent Platform > Deployment Resource Pool > Active > Last Modified
GCP > Vertex AI > Deployment Resource Pool > Allowed to GCP > Agent Platform > Deployment Resource Pool > Allowed
GCP > Vertex AI > Deployment Resource Pool > Allowed > Custom to GCP > Agent Platform > Deployment Resource Pool > Allowed > Custom
GCP > Vertex AI > Deployment Resource Pool > Allowed > Custom > Rules to GCP > Agent Platform > Deployment Resource Pool > Allowed > Custom > Rules
GCP > Vertex AI > Deployment Resource Pool > Allowed > Encryption at Rest to GCP > Agent Platform > Deployment Resource Pool > Allowed > Encryption at Rest
GCP > Vertex AI > Deployment Resource Pool > Allowed > Encryption at Rest > Level to GCP > Agent Platform > Deployment Resource Pool > Allowed > Encryption at Rest > Level
GCP > Vertex AI > Deployment Resource Pool > Allowed > Encryption at Rest > Level > Customer Managed Key to GCP > Agent Platform > Deployment Resource Pool > Allowed > Encryption at Rest > Level > Customer Managed Key
GCP > Vertex AI > Deployment Resource Pool > Allowed > Region to GCP > Agent Platform > Deployment Resource Pool > Allowed > Region
GCP > Vertex AI > Deployment Resource Pool > Allowed > Region > Regions to GCP > Agent Platform > Deployment Resource Pool > Allowed > Region > Regions
GCP > Vertex AI > Deployment Resource Pool > CMDB to GCP > Agent Platform > Deployment Resource Pool > CMDB
GCP > Vertex AI > Deployment Resource Pool > Regions to GCP > Agent Platform > Deployment Resource Pool > Regions
GCP > Vertex AI > Enabled to GCP > Agent Platform > Enabled
GCP > Vertex AI > Endpoint > Active to GCP > Agent Platform > Endpoint > Active
GCP > Vertex AI > Endpoint > Active > Age to GCP > Agent Platform > Endpoint > Active > Age
GCP > Vertex AI > Endpoint > Active > Last Modified to GCP > Agent Platform > Endpoint > Active > Last Modified
GCP > Vertex AI > Endpoint > Active > Request-Response Logging to GCP > Agent Platform > Endpoint > Active > Request-Response Logging
GCP > Vertex AI > Endpoint > Allowed to GCP > Agent Platform > Endpoint > Allowed
GCP > Vertex AI > Endpoint > Allowed > Custom to GCP > Agent Platform > Endpoint > Allowed > Custom
GCP > Vertex AI > Endpoint > Allowed > Custom > Rules to GCP > Agent Platform > Endpoint > Allowed > Custom > Rules
GCP > Vertex AI > Endpoint > Allowed > Encryption at Rest to GCP > Agent Platform > Endpoint > Allowed > Encryption at Rest
GCP > Vertex AI > Endpoint > Allowed > Encryption at Rest > Level to GCP > Agent Platform > Endpoint > Allowed > Encryption at Rest > Level
GCP > Vertex AI > Endpoint > Allowed > Encryption at Rest > Level > Customer Managed Key to GCP > Agent Platform > Endpoint > Allowed > Encryption at Rest > Level > Customer Managed Key
GCP > Vertex AI > Endpoint > Allowed > Region to GCP > Agent Platform > Endpoint > Allowed > Region
GCP > Vertex AI > Endpoint > Allowed > Region > Regions to GCP > Agent Platform > Endpoint > Allowed > Region > Regions
GCP > Vertex AI > Endpoint > Approved to GCP > Agent Platform > Endpoint > Approved
GCP > Vertex AI > Endpoint > Approved > Custom to GCP > Agent Platform > Endpoint > Approved > Custom
GCP > Vertex AI > Endpoint > Approved > Regions to GCP > Agent Platform > Endpoint > Approved > Regions
GCP > Vertex AI > Endpoint > Approved > Usage to GCP > Agent Platform > Endpoint > Approved > Usage
GCP > Vertex AI > Endpoint > CMDB to GCP > Agent Platform > Endpoint > CMDB
GCP > Vertex AI > Endpoint > Labels to GCP > Agent Platform > Endpoint > Labels
GCP > Vertex AI > Endpoint > Labels > Template to GCP > Agent Platform > Endpoint > Labels > Template
GCP > Vertex AI > Endpoint > Regions to GCP > Agent Platform > Endpoint > Regions
GCP > Vertex AI > Labels Template [Default] to GCP > Agent Platform > Labels Template [Default]
GCP > Vertex AI > Model > Active to GCP > Agent Platform > Model > Active
GCP > Vertex AI > Model > Active > Age to GCP > Agent Platform > Model > Active > Age
GCP > Vertex AI > Model > Active > Last Modified to GCP > Agent Platform > Model > Active > Last Modified
GCP > Vertex AI > Model > Allowed to GCP > Agent Platform > Model > Allowed
GCP > Vertex AI > Model > Allowed > Custom to GCP > Agent Platform > Model > Allowed > Custom
GCP > Vertex AI > Model > Allowed > Custom > Rules to GCP > Agent Platform > Model > Allowed > Custom > Rules
GCP > Vertex AI > Model > Allowed > Region to GCP > Agent Platform > Model > Allowed > Region
GCP > Vertex AI > Model > Allowed > Region > Regions to GCP > Agent Platform > Model > Allowed > Region > Regions
GCP > Vertex AI > Model > CMDB to GCP > Agent Platform > Model > CMDB
GCP > Vertex AI > Model > Labels to GCP > Agent Platform > Model > Labels
GCP > Vertex AI > Model > Labels > Template to GCP > Agent Platform > Model > Labels > Template
GCP > Vertex AI > Model > Regions to GCP > Agent Platform > Model > Regions
GCP > Vertex AI > Notebook Runtime Template > Active to GCP > Agent Platform > Notebook Runtime Template > Active
GCP > Vertex AI > Notebook Runtime Template > Active > Age to GCP > Agent Platform > Notebook Runtime Template > Active > Age
GCP > Vertex AI > Notebook Runtime Template > Active > Last Modified to GCP > Agent Platform > Notebook Runtime Template > Active > Last Modified
GCP > Vertex AI > Notebook Runtime Template > Allowed to GCP > Agent Platform > Notebook Runtime Template > Allowed
GCP > Vertex AI > Notebook Runtime Template > Allowed > Custom to GCP > Agent Platform > Notebook Runtime Template > Allowed > Custom
GCP > Vertex AI > Notebook Runtime Template > Allowed > Custom > Rules to GCP > Agent Platform > Notebook Runtime Template > Allowed > Custom > Rules
GCP > Vertex AI > Notebook Runtime Template > Allowed > Region to GCP > Agent Platform > Notebook Runtime Template > Allowed > Region
GCP > Vertex AI > Notebook Runtime Template > Allowed > Region > Regions to GCP > Agent Platform > Notebook Runtime Template > Allowed > Region > Regions
GCP > Vertex AI > Notebook Runtime Template > Approved to GCP > Agent Platform > Notebook Runtime Template > Approved
GCP > Vertex AI > Notebook Runtime Template > Approved > Custom to GCP > Agent Platform > Notebook Runtime Template > Approved > Custom
GCP > Vertex AI > Notebook Runtime Template > Approved > Regions to GCP > Agent Platform > Notebook Runtime Template > Approved > Regions
GCP > Vertex AI > Notebook Runtime Template > Approved > Usage to GCP > Agent Platform > Notebook Runtime Template > Approved > Usage
GCP > Vertex AI > Notebook Runtime Template > CMDB to GCP > Agent Platform > Notebook Runtime Template > CMDB
GCP > Vertex AI > Notebook Runtime Template > Labels to GCP > Agent Platform > Notebook Runtime Template > Labels
GCP > Vertex AI > Notebook Runtime Template > Labels > Template to GCP > Agent Platform > Notebook Runtime Template > Labels > Template
GCP > Vertex AI > Notebook Runtime Template > Regions to GCP > Agent Platform > Notebook Runtime Template > Regions
GCP > Vertex AI > Permissions to GCP > Agent Platform > Permissions
GCP > Vertex AI > Permissions > Levels to GCP > Agent Platform > Permissions > Levels
GCP > Vertex AI > Permissions > Levels > Modifiers to GCP > Agent Platform > Permissions > Levels > Modifiers
GCP > Vertex AI > Publisher Model > CMDB to GCP > Agent Platform > Publisher Model > CMDB
GCP > Vertex AI > Regions to GCP > Agent Platform > Regions

Action Types

Added

GCP > Agent Platform > Endpoint > Undeploy Model

Renamed

GCP > Vertex AI > Deployment Resource Pool > Delete to GCP > Agent Platform > Deployment Resource Pool > Delete
GCP > Vertex AI > Deployment Resource Pool > Router to GCP > Agent Platform > Deployment Resource Pool > Router
GCP > Vertex AI > Endpoint > Delete to GCP > Agent Platform > Endpoint > Delete
GCP > Vertex AI > Endpoint > Router to GCP > Agent Platform > Endpoint > Router
GCP > Vertex AI > Endpoint > Set Labels to GCP > Agent Platform > Endpoint > Set Labels
GCP > Vertex AI > Model > Delete to GCP > Agent Platform > Model > Delete
GCP > Vertex AI > Model > Router to GCP > Agent Platform > Model > Router
GCP > Vertex AI > Model > Set Labels to GCP > Agent Platform > Model > Set Labels
GCP > Vertex AI > Notebook Runtime Template > Delete to GCP > Agent Platform > Notebook Runtime Template > Delete
GCP > Vertex AI > Notebook Runtime Template > Router to GCP > Agent Platform > Notebook Runtime Template > Router
GCP > Vertex AI > Notebook Runtime Template > Set Labels to GCP > Agent Platform > Notebook Runtime Template > Set Labels
GCP > Vertex AI > Set API Enabled to GCP > Agent Platform > Set API Enabled

AzureAD plugin v1.10.0 - Fixed azuread_directory_audit_report pagination and upgraded to steampipe-plugin-sdk v6.0.0

Oct 26, 2026

steampipe

Bug fixes

Fixed the azuread_directory_audit_report table to return all results instead of only the first page. (#325) (Thanks @amit-experimenting for the contribution!)

Dependencies

Recompiled plugin with Go version 1.26. (#307)
Recompiled plugin with steampipe-plugin-sdk v6.0.0 which fixes a data race on connection config during query execution.

Azure plugin v1.16.1 - Fixed client certificate authentication for password-protected PKCS#12 certificates

Oct 26, 2026

steampipe

Enhancements

Updated the docs/index.md file to clarify that client certificate authentication requires a PKCS#12 (.pfx) file, and that files created with OpenSSL 3 must be exported with the -legacy flag.

Bug fixes

Fixed client certificate authentication failing with pkcs12: decryption password incorrect for password-protected PKCS#12 (.pfx) certificates in some tables, as the certificate_password config argument and AZURE_CERTIFICATE_PASSWORD environment variable were being ignored. (#1023) (Thanks @cristianchiriac for the contribution!)

AWS plugin v1.34.1 - Fixed endpoint_url config argument ignoring connection credentials

Oct 26, 2026

steampipe

Bug fixes

Fixed the endpoint_url config argument to keep the connection's access_key, secret_key, session_token, and profile. Previously, connections that set endpoint_url ignored these and used the default AWS credential chain instead, which either silently used the wrong identity or failed with a no EC2 IMDS role found error. (#2807)
Fixed the aws_s3_bucket table to fall back to the connection's default region when ListBuckets fails with a region mismatch error, e.g., in networks that can only reach a single region's S3 VPC endpoint. In this case, the creation_date column returns the bucket's last modified time instead of its creation time. (#2791) (Thanks @sol791 for the contribution!)
Fixed the aws_connect_instance_attribute table to return rows when filtered by instance_id. (#2800) (Thanks @RaphaelFakhri for the contribution!)

Dependencies

Recompiled plugin with google.golang.org/grpc v1.82.1. (#2784)
Updated soupsieve to v2.8.4 in the generate_parliament_iam_permissions script. (#2779)

Azure Compliance mod v2.5.3 - Fixed Application Gateway WAF and TLS queries and missing service tags in CIS v5.0.0 benchmarks

Oct 26, 2026

powerpipe

Bug fixes

Added missing service tags to the CIS v5.0.0 Analytics Services (section 2), Compute Services (section 3), and Management and Governance Services (section 6) benchmarks and controls.
Fixed the application_gateway_min_tls_1_2 query to pass Application Gateways that use a predefined SSL policy with a minimum TLS version of 1.2 (AppGwSslPolicy20170401S, AppGwSslPolicy20220101 or AppGwSslPolicy20220101S), removing false positives in the CIS v5.0.0 7.12 control. (#376) (Thanks @blacksoxx for the contribution!)
Fixed the application_gateway_waf_enabled query to alarm for Application Gateways whose legacy WAF configuration is disabled.
Fixed the application_gateway_waf_enabled query to pass Application Gateways that use an attached WAF policy, removing false positives in the CIS v5.0.0 7.10 control. Gateways whose attached WAF policy is disabled now alarm. (#378) (Thanks @cristianchiriac for the contribution!)
Fixed the application_gateway_waf_uses_specified_mode query, which alarmed for every Application Gateway because it read a WAF mode key that doesn't exist. The query now checks the mode of the attached WAF policy, or of the legacy WAF configuration.
Fixed the service tag on the CIS v1.3.0 1.7 and CIS v1.4.0 1.7 controls from Azure/ActiveDirectoryM to Azure/ActiveDirectory.
Fixed the service tag on the CIS v5.0.0 Identity Services (section 5) benchmarks and controls to Azure/ActiveDirectory. (#377) (Thanks @blacksoxx for the contribution!)

AWS Compliance mod v1.14.0 - Updated foundational_security_opensearch_8 control to require the latest TLS security policy and fixed several query bugs

Oct 26, 2026

powerpipe

Thanks to @cristianchiriac for contributing most of the fixes in this release!

Enhancements

Added the opensearch_domain_uses_latest_tls_security_policy control to the All AWS Compliance Controls benchmark.
Updated the foundational_security_opensearch_8 control to match the current AWS Security Hub control, "Connections to OpenSearch domains should be encrypted using the latest TLS security policy". The control now passes only OpenSearch domains that enforce HTTPS and use Policy-Min-TLS-1-2-PFS-2023-10, which can be changed with the new opensearch_domain_latest_tls_security_policies variable.

Bug fixes

Fixed the api_gatewayv2_route_authorization_type_configured query to alarm when a route's authorization_type is NONE. (#1016)
Fixed the iam_root_last_used query to alarm when a root access key was used in the last 90 days, instead of when it was last used more than 90 days ago. (#1010)
Fixed the kinesis_stream_retention_period_168_hours query to pass streams with a retention period longer than 168 hours. (#1013)
Fixed the lightsail_instance_ssh_rdp_http_ports_disabled query to check port 3389 instead of 338 for RDP. (#1009)
Fixed the opensearch_domain_audit_logging_enabled query always returning ok. OpenSearch domains without audit logging enabled now alarm. (#1011)
Fixed the opensearch_domain_data_node_fault_tolerance query comparing InstanceCount as text, which alarmed for domains with 10 or more data nodes. (#1014)
Fixed the opensearch_domain_https_required query comparing the TLS security policy with a literal string, which alarmed for every OpenSearch domain that enforces HTTPS. Domains now pass when they enforce HTTPS with a TLS 1.2 or later security policy. (#1017)

Turbot Guardrails Enterprise (TE) v5.60.11 - AI model update and reliability fixes

Oct 23, 2026

guardrailsTE

What's new?

Server
- AI features now default to Claude Haiku 5.5.

Bug fixes

Server
- Installing or updating a mod no longer re-runs every control of a type when only the mod's logic changes.
- Improved discovery efficiency for resources with multiple identifiers.
- Improved list filtering: filters that share the same key now combine with AND, and the Resource Type filter no longer includes descendant types.
UI
- Fixed the policy pack summary card to show the correct policy type, and now require a destination folder when importing a GitHub organization.
- Fixed display of long actor names and long policy setting values so they stay within their columns, and corrected the Smart Folders dashboard card to count only smart folders.

Requirements

Upgrade to 5.60.11 requires your workspace to be on 5.54.x
PostgreSQL (RDS engine): >= 15
TEF: 1.71.0
TED: 1.37.0
Mods:
- @turbot/turbot: 5.61.0

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

azure-compute v5.31.0 - Check and enforce data access authentication mode on disks

Oct 23, 2026

guardrailsMods

What's new?

Disk export and upload URLs can now be required to use Microsoft Entra ID sign-in. Set the new Azure > Compute > Disk > Data Access Authentication Mode policy to Check: Azure Active Directory to alarm on disks whose URLs work without sign-in, or to Enforce: Azure Active Directory to update them. Disks that never had the setting count as None.
Azure Backup and Azure Site Recovery don't support disks set to Azure Active Directory, so check those disks before enforcing.

Control Types

Added

Azure > Compute > Disk > Data Access Authentication Mode

Policy Types

Added

Azure > Compute > Disk > Data Access Authentication Mode

Action Types

Added

Azure > Compute > Disk > Update Data Access Authentication Mode

aws-cloudformation v5.15.1 - Stacks no longer get stuck at an in-progress status

Oct 15, 2026

guardrailsMods

Bug fixes

AWS > CloudFormation > Stack > CMDB and AWS > CloudFormation > StackSet > CMDB no longer go into an error state for a deleted stack or stack set whose name has been reused. Deleted stacks and stack sets are now removed from the CMDB as expected.
Stacks no longer stay at an in-progress status, such as CREATE_IN_PROGRESS, after AWS has finished creating, updating or rolling them back.
AWS > CloudFormation > Hook > Active no longer goes into an error state when the AWS > CloudFormation > Hook > Active policy is set to an enforce option.

turbot v5.61.1 - Claude Haiku 5.5 becomes the default AI model from TE 5.60.11

Oct 14, 2026

guardrailsMods

What's new?

Guardrails AI features will use Claude Haiku 5.5 by default once your workspace is on Turbot Enterprise (TE) 5.60.11 or later. The new defaults are global.anthropic.claude-haiku-5-5 for Turbot > AI > Configuration > AWS > Bedrock > Inference Profile ID and claude-haiku-5-5 for Turbot > AI > Configuration > Anthropic > Model. Workspaces on earlier TE versions stay on Claude Haiku 4.5, and if you have set a model yourself, nothing changes.

Requirements

TE: 5.35.4 or higher

GitHub plugin v1.11.0 - Added github_project_v2 and github_project_v2_item tables

Oct 13, 2026

steampipe

What's new?

New tables added
- github_project_v2 (#548) (Thanks @dark-panda for the contribution!)
- github_project_v2_item (#567)

Bug fixes

Fixed the github_issue and github_pull_request tables to no longer error when querying by repository_full_name and number. (#567)

AWS mods - Retired unused Usage controls and policies (CloudFront, DynamoDB, ECR, ECS, VPC Core, VPC Security)

Oct 12, 2026

guardrailsMods

What's new?

The Usage controls and their Usage and Usage > Limit policies have been retired from the resource types in the mods listed below. The Approved > Usage policies are unaffected and remain available.

Released versions:

aws-cloudfront v5.10.0
aws-dynamodb v5.19.0
aws-ecr v5.18.0
aws-ecs v5.12.0
aws-vpc-core v5.25.0
aws-vpc-security v5.17.0

Control Types

Removed

AWS > CloudFront > CloudFront Origin Access Identity > Usage
AWS > CloudFront > Distribution > Usage
AWS > CloudFront > Streaming Distribution > Usage
AWS > DynamoDB > Backup > Usage
AWS > DynamoDB > Global Table > Usage
AWS > DynamoDB > Table > Usage
AWS > ECR > Image > Usage
AWS > ECR > Public Repository > Usage
AWS > ECR > Repository > Usage
AWS > ECS > Cluster > Usage
AWS > ECS > Container Instance > Usage
AWS > ECS > Task Definition > Usage
AWS > VPC > DHCP Options > Usage
AWS > VPC > Flow Log > Usage
AWS > VPC > Network ACL > Usage
AWS > VPC > Route Table > Usage
AWS > VPC > Security Group > Usage
AWS > VPC > Subnet > Usage
AWS > VPC > VPC > Usage

Policy Types

Removed

AWS > CloudFront > CloudFront Origin Access Identity > Usage
AWS > CloudFront > CloudFront Origin Access Identity > Usage > Limit
AWS > CloudFront > Distribution > Usage
AWS > CloudFront > Distribution > Usage > Limit
AWS > CloudFront > Streaming Distribution > Usage
AWS > CloudFront > Streaming Distribution > Usage > Limit
AWS > DynamoDB > Backup > Usage
AWS > DynamoDB > Backup > Usage > Limit
AWS > DynamoDB > Global Table > Usage
AWS > DynamoDB > Global Table > Usage > Limit
AWS > DynamoDB > Table > Usage
AWS > DynamoDB > Table > Usage > Limit
AWS > ECR > Image > Usage
AWS > ECR > Image > Usage > Limit
AWS > ECR > Public Repository > Usage
AWS > ECR > Public Repository > Usage > Limit
AWS > ECR > Repository > Usage
AWS > ECR > Repository > Usage > Limit
AWS > ECS > Cluster > Usage
AWS > ECS > Cluster > Usage > Limit
AWS > ECS > Container Instance > Usage
AWS > ECS > Container Instance > Usage > Limit
AWS > ECS > Task Definition > Usage
AWS > ECS > Task Definition > Usage > Limit
AWS > VPC > DHCP Options > Usage
AWS > VPC > DHCP Options > Usage > Limit
AWS > VPC > Flow Log > Usage
AWS > VPC > Flow Log > Usage > Limit
AWS > VPC > Network ACL > Usage
AWS > VPC > Network ACL > Usage > Limit
AWS > VPC > Route Table > Usage
AWS > VPC > Route Table > Usage > Limit
AWS > VPC > Security Group > Usage
AWS > VPC > Security Group > Usage > Limit
AWS > VPC > Subnet > Usage
AWS > VPC > Subnet > Usage > Limit
AWS > VPC > VPC > Usage
AWS > VPC > VPC > Usage > Limit

Azure plugin v1.16.0 - Added azure_security_center_assessment table

Oct 12, 2026

steampipe

What's new?

New tables added
- azure_security_center_assessment (#992) (Thanks @dark-panda for the contribution!)

gcp-cisv5-0 v5.0.0 is now available

Oct 09, 2026

guardrailsMods

Control Types

Added

GCP > CIS v5.0
GCP > CIS v5.0 > 1 - Identity and Access Management
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.01 - Ensure Super Admin Email Address Is Not Tied To A Single User
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.02 - Ensure Super Admin Account Is Not Used For Google Cloud Administration
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.03 - Ensure Folders Are Structured By Environment And Sensitivity
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.04 - Ensure Organization Policies Are Configured For Centralized Constraints
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.02 - Ensure that Corporate Login Credentials are Used
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.03 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.04 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.05 - Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.06 - Ensure That Service Account Has No Admin Privileges
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.07 - Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.08 - Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.09 - Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.10 - Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.11 - Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.12 - Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Only Exist for Active Services
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.16 - Ensure API Keys Are Rotated Every 90 Days
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.17 - Ensure Essential Contacts is Configured for Organization
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager
GCP > CIS v5.0 > 2 - Logging and Monitoring
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.01 - Ensure That Cloud Audit Logging Is Configured Properly
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.02 - Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.03 - Ensure That Sinks Are Configured for All Log Entries
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.04 - Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.05 - Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.06 - Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.07 - Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.08 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.09 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.10 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.11 - Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.12 - Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.13 - Ensure That Cloud DNS Logging Is Enabled for All VPC Networks
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.14 - Ensure Cloud Asset Inventory Is Enabled
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.15 - Ensure 'Access Transparency' is 'Enabled'
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.16 - Ensure 'Access Approval' is 'Enabled'
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.17 - Ensure Logging is enabled for HTTP(S) Load Balancer
GCP > CIS v5.0 > 3 - Networking
GCP > CIS v5.0 > 3 - Networking > 3.01 - Ensure That the Default Network Does Not Exist in a Project
GCP > CIS v5.0 > 3 - Networking > 3.02 - Ensure Legacy Networks Do Not Exist for Older Projects
GCP > CIS v5.0 > 3 - Networking > 3.03 - Ensure That DNSSEC Is Enabled for Cloud DNS
GCP > CIS v5.0 > 3 - Networking > 3.04 - Ensure That RSASHA1 Is Not Used for the Key-Signing Key in Cloud DNS DNSSEC
GCP > CIS v5.0 > 3 - Networking > 3.05 - Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC
GCP > CIS v5.0 > 3 - Networking > 3.06 - Ensure That SSH Access Is Restricted From the Internet
GCP > CIS v5.0 > 3 - Networking > 3.07 - Ensure That RDP Access Is Restricted From the Internet
GCP > CIS v5.0 > 3 - Networking > 3.08 - Ensure VPC Service Controls Is Enabled for Supported Google Cloud Services
GCP > CIS v5.0 > 3 - Networking > 3.09 - Ensure Private Service Connect is Used for Access to Google APIs
GCP > CIS v5.0 > 3 - Networking > 3.10 - Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network
GCP > CIS v5.0 > 3 - Networking > 3.11 - Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites
GCP > CIS v5.0 > 3 - Networking > 3.12 - Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
GCP > CIS v5.0 > 4 - Virtual Machines
GCP > CIS v5.0 > 4 - Virtual Machines > 4.01 - Ensure That Instances Are Not Configured To Use the Default Service Account
GCP > CIS v5.0 > 4 - Virtual Machines > 4.02 - Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs
GCP > CIS v5.0 > 4 - Virtual Machines > 4.03 - Ensure "Block Project-Wide SSH Keys" Is Enabled for VM Instances
GCP > CIS v5.0 > 4 - Virtual Machines > 4.04 - Ensure Oslogin Is Enabled for a Project
GCP > CIS v5.0 > 4 - Virtual Machines > 4.05 - Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance
GCP > CIS v5.0 > 4 - Virtual Machines > 4.06 - Ensure That IP Forwarding Is Not Enabled on Instances
GCP > CIS v5.0 > 4 - Virtual Machines > 4.07 - Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)
GCP > CIS v5.0 > 4 - Virtual Machines > 4.08 - Ensure Compute Instances Are Launched With Shielded VM Enabled
GCP > CIS v5.0 > 4 - Virtual Machines > 4.09 - Ensure That Compute Instances Do Not Have Public IP Addresses
GCP > CIS v5.0 > 4 - Virtual Machines > 4.10 - Ensure That App Engine Applications Enforce HTTPS Connections
GCP > CIS v5.0 > 4 - Virtual Machines > 4.11 - Ensure That Compute Instances Have Confidential Computing Enabled
GCP > CIS v5.0 > 4 - Virtual Machines > 4.12 - Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects
GCP > CIS v5.0 > 5 - Storage
GCP > CIS v5.0 > 5 - Storage > 5.01 - Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 5 - Storage > 5.02 - Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.01 - Ensure That a MySQL Instance Does Not Allow Anyone To Connect With Administrative Privileges
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.02 - Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.03 - Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.01 - Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.02 - Ensure That the 'Log_connections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.03 - Ensure That the 'Log_disconnections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.04 - Ensure 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.05 - Ensure that the 'Log_min_messages' Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.06 - Ensure 'Log_min_error_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'Error' or Stricter
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.07 - Ensure That the 'Log_min_duration_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1' (Disabled)
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.08 - Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.01 - Ensure 'external scripts enabled' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.02 - Ensure 'cross db ownership chaining' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.03 - Ensure 'user Connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.04 - Ensure 'user options' Database Flag for Cloud SQL SQL Server Instance Is Not Configured
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.05 - Ensure 'remote access' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.06 - Ensure '3625 (trace flag)' Database Flag for all Cloud SQL SQL Server Instances Is Set to 'on'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.07 - Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.04 - Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.05 - Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.06 - Ensure Cloud SQL Database Instances Have IAM Database Authentication Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.07 - Ensure That Cloud SQL Database Instances Do Not Have Public IPs
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.08 - Ensure That Cloud SQL Database Instances Are Configured With Automated Backups
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.09 - Ensure Cloud SQL Database Instances Have Deletion Protection Enabled
GCP > CIS v5.0 > 7 - BigQuery
GCP > CIS v5.0 > 7 - BigQuery > 7.01 - Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 7 - BigQuery > 7.02 - Ensure That All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK)
GCP > CIS v5.0 > 7 - BigQuery > 7.03 - Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets
GCP > CIS v5.0 > 7 - BigQuery > 7.04 - Ensure all data in BigQuery has been classified
GCP > CIS v5.0 > 8 - Dataproc
GCP > CIS v5.0 > 8 - Dataproc > 8.01 - Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key

Policy Types

Added

GCP > CIS v5.0
GCP > CIS v5.0 > 1 - Identity and Access Management
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.01 - Ensure Super Admin Email Address Is Not Tied To A Single User
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.01 - Ensure Super Admin Email Address Is Not Tied To A Single User > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.02 - Ensure Super Admin Account Is Not Used For Google Cloud Administration
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.02 - Ensure Super Admin Account Is Not Used For Google Cloud Administration > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.03 - Ensure Folders Are Structured By Environment And Sensitivity
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.03 - Ensure Folders Are Structured By Environment And Sensitivity > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.04 - Ensure Organization Policies Are Configured For Centralized Constraints
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.04 - Ensure Organization Policies Are Configured For Centralized Constraints > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > Maximum Attestation Duration
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.02 - Ensure that Corporate Login Credentials are Used
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.02 - Ensure that Corporate Login Credentials are Used > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.03 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.03 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.04 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.04 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.05 - Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.06 - Ensure That Service Account Has No Admin Privileges
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.07 - Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.08 - Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.09 - Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.10 - Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.11 - Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.12 - Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Only Exist for Active Services
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.16 - Ensure API Keys Are Rotated Every 90 Days
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.17 - Ensure Essential Contacts is Configured for Organization
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.17 - Ensure Essential Contacts is Configured for Organization > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > Maximum Attestation Duration
GCP > CIS v5.0 > 2 - Logging and Monitoring
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.01 - Ensure That Cloud Audit Logging Is Configured Properly
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.02 - Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.02 - Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging > Attestation
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.03 - Ensure That Sinks Are Configured for All Log Entries
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.04 - Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.05 - Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.06 - Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.07 - Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.08 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.09 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.10 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.11 - Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.12 - Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.13 - Ensure That Cloud DNS Logging Is Enabled for All VPC Networks
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.14 - Ensure Cloud Asset Inventory Is Enabled
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.15 - Ensure 'Access Transparency' is 'Enabled'
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.15 - Ensure 'Access Transparency' is 'Enabled' > Attestation
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.16 - Ensure 'Access Approval' is 'Enabled'
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.17 - Ensure Logging is enabled for HTTP(S) Load Balancer
GCP > CIS v5.0 > 2 - Logging and Monitoring > Maximum Attestation Duration
GCP > CIS v5.0 > 3 - Networking
GCP > CIS v5.0 > 3 - Networking > 3.01 - Ensure That the Default Network Does Not Exist in a Project
GCP > CIS v5.0 > 3 - Networking > 3.02 - Ensure Legacy Networks Do Not Exist for Older Projects
GCP > CIS v5.0 > 3 - Networking > 3.03 - Ensure That DNSSEC Is Enabled for Cloud DNS
GCP > CIS v5.0 > 3 - Networking > 3.04 - Ensure That RSASHA1 Is Not Used for the Key-Signing Key in Cloud DNS DNSSEC
GCP > CIS v5.0 > 3 - Networking > 3.05 - Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC
GCP > CIS v5.0 > 3 - Networking > 3.06 - Ensure That SSH Access Is Restricted From the Internet
GCP > CIS v5.0 > 3 - Networking > 3.07 - Ensure That RDP Access Is Restricted From the Internet
GCP > CIS v5.0 > 3 - Networking > 3.08 - Ensure VPC Service Controls Is Enabled for Supported Google Cloud Services
GCP > CIS v5.0 > 3 - Networking > 3.08 - Ensure VPC Service Controls Is Enabled for Supported Google Cloud Services > Attestation
GCP > CIS v5.0 > 3 - Networking > 3.09 - Ensure Private Service Connect is Used for Access to Google APIs
GCP > CIS v5.0 > 3 - Networking > 3.09 - Ensure Private Service Connect is Used for Access to Google APIs > Attestation
GCP > CIS v5.0 > 3 - Networking > 3.10 - Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network
GCP > CIS v5.0 > 3 - Networking > 3.11 - Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites
GCP > CIS v5.0 > 3 - Networking > 3.12 - Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
GCP > CIS v5.0 > 3 - Networking > 3.12 - Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed' > Attestation
GCP > CIS v5.0 > 3 - Networking > Maximum Attestation Duration
GCP > CIS v5.0 > 4 - Virtual Machines
GCP > CIS v5.0 > 4 - Virtual Machines > 4.01 - Ensure That Instances Are Not Configured To Use the Default Service Account
GCP > CIS v5.0 > 4 - Virtual Machines > 4.02 - Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs
GCP > CIS v5.0 > 4 - Virtual Machines > 4.03 - Ensure "Block Project-Wide SSH Keys" Is Enabled for VM Instances
GCP > CIS v5.0 > 4 - Virtual Machines > 4.04 - Ensure Oslogin Is Enabled for a Project
GCP > CIS v5.0 > 4 - Virtual Machines > 4.05 - Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance
GCP > CIS v5.0 > 4 - Virtual Machines > 4.06 - Ensure That IP Forwarding Is Not Enabled on Instances
GCP > CIS v5.0 > 4 - Virtual Machines > 4.07 - Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)
GCP > CIS v5.0 > 4 - Virtual Machines > 4.08 - Ensure Compute Instances Are Launched With Shielded VM Enabled
GCP > CIS v5.0 > 4 - Virtual Machines > 4.09 - Ensure That Compute Instances Do Not Have Public IP Addresses
GCP > CIS v5.0 > 4 - Virtual Machines > 4.10 - Ensure That App Engine Applications Enforce HTTPS Connections
GCP > CIS v5.0 > 4 - Virtual Machines > 4.10 - Ensure That App Engine Applications Enforce HTTPS Connections > Attestation
GCP > CIS v5.0 > 4 - Virtual Machines > 4.11 - Ensure That Compute Instances Have Confidential Computing Enabled
GCP > CIS v5.0 > 4 - Virtual Machines > 4.12 - Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects
GCP > CIS v5.0 > 4 - Virtual Machines > 4.12 - Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects > Attestation
GCP > CIS v5.0 > 4 - Virtual Machines > Maximum Attestation Duration
GCP > CIS v5.0 > 5 - Storage
GCP > CIS v5.0 > 5 - Storage > 5.01 - Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 5 - Storage > 5.02 - Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.01 - Ensure That a MySQL Instance Does Not Allow Anyone To Connect With Administrative Privileges
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.01 - Ensure That a MySQL Instance Does Not Allow Anyone To Connect With Administrative Privileges > Attestation
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.02 - Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.03 - Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > Maximum Attestation Duration
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.01 - Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.02 - Ensure That the 'Log_connections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.03 - Ensure That the 'Log_disconnections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.04 - Ensure 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.05 - Ensure that the 'Log_min_messages' Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.06 - Ensure 'Log_min_error_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'Error' or Stricter
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.07 - Ensure That the 'Log_min_duration_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1' (Disabled)
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.08 - Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.01 - Ensure 'external scripts enabled' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.02 - Ensure 'cross db ownership chaining' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.03 - Ensure 'user Connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.04 - Ensure 'user options' Database Flag for Cloud SQL SQL Server Instance Is Not Configured
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.05 - Ensure 'remote access' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.06 - Ensure '3625 (trace flag)' Database Flag for all Cloud SQL SQL Server Instances Is Set to 'on'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.07 - Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.04 - Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.05 - Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.06 - Ensure Cloud SQL Database Instances Have IAM Database Authentication Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.07 - Ensure That Cloud SQL Database Instances Do Not Have Public IPs
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.08 - Ensure That Cloud SQL Database Instances Are Configured With Automated Backups
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.09 - Ensure Cloud SQL Database Instances Have Deletion Protection Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > Maximum Attestation Duration
GCP > CIS v5.0 > 7 - BigQuery
GCP > CIS v5.0 > 7 - BigQuery > 7.01 - Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 7 - BigQuery > 7.02 - Ensure That All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK)
GCP > CIS v5.0 > 7 - BigQuery > 7.03 - Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets
GCP > CIS v5.0 > 7 - BigQuery > 7.04 - Ensure all data in BigQuery has been classified
GCP > CIS v5.0 > 7 - BigQuery > 7.04 - Ensure all data in BigQuery has been classified > Attestation
GCP > CIS v5.0 > 7 - BigQuery > Maximum Attestation Duration
GCP > CIS v5.0 > 8 - Dataproc
GCP > CIS v5.0 > 8 - Dataproc > 8.01 - Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key
GCP > CIS v5.0 > Maximum Attestation Duration

aws-grafana v5.0.0 is now available

Oct 09, 2026

guardrailsMods

What's new?

Added support for Amazon Managed Grafana workspaces, including the new AWS > Grafana > Workspace > Allowed > Public control to alarm on or delete workspaces with no VPC connection. Set AWS > Grafana > Workspace > CMDB to Enforce: Enabled to start tracking workspaces, as it defaults to Skip.

Resource Types

Added

AWS > Grafana
AWS > Grafana > Workspace

Control Types

Added

AWS > Grafana > Workspace > Active
AWS > Grafana > Workspace > Allowed
AWS > Grafana > Workspace > Allowed > Custom
AWS > Grafana > Workspace > Allowed > Public
AWS > Grafana > Workspace > Allowed > Region
AWS > Grafana > Workspace > CMDB
AWS > Grafana > Workspace > Discovery
AWS > Grafana > Workspace > Tags

Policy Types

Added

AWS > Grafana > API Enabled
AWS > Grafana > Allowed Regions [Default]
AWS > Grafana > Enabled
AWS > Grafana > Permissions
AWS > Grafana > Permissions > Levels
AWS > Grafana > Permissions > Levels > Modifiers
AWS > Grafana > Permissions > Lockdown
AWS > Grafana > Permissions > Lockdown > API Boundary
AWS > Grafana > Regions
AWS > Grafana > Tags Template [Default]
AWS > Grafana > Workspace > Active
AWS > Grafana > Workspace > Active > Age
AWS > Grafana > Workspace > Active > Budget
AWS > Grafana > Workspace > Active > Last Modified
AWS > Grafana > Workspace > Allowed
AWS > Grafana > Workspace > Allowed > Custom
AWS > Grafana > Workspace > Allowed > Custom > Rules
AWS > Grafana > Workspace > Allowed > Public
AWS > Grafana > Workspace > Allowed > Region
AWS > Grafana > Workspace > Allowed > Region > Regions
AWS > Grafana > Workspace > CMDB
AWS > Grafana > Workspace > Regions
AWS > Grafana > Workspace > Tags
AWS > Grafana > Workspace > Tags > Template
AWS > Turbot > Event Handlers > Events > Rules > Custom Event Patterns > @turbot/aws-grafana
AWS > Turbot > Permissions > Compiled > API Boundary > @turbot/aws-grafana
AWS > Turbot > Permissions > Compiled > Levels > @turbot/aws-grafana
AWS > Turbot > Permissions > Compiled > Service Permissions > @turbot/aws-grafana

Action Types

Added

AWS > Grafana > Workspace > Delete
AWS > Grafana > Workspace > Delete from AWS
AWS > Grafana > Workspace > Router
AWS > Grafana > Workspace > Set Tags
AWS > Grafana > Workspace > Skip alarm for Active control
AWS > Grafana > Workspace > Skip alarm for Active control [90 days]
AWS > Grafana > Workspace > Skip alarm for Tags control
AWS > Grafana > Workspace > Skip alarm for Tags control [90 days]
AWS > Grafana > Workspace > Update Tags

Turbot Guardrails Enterprise (TE) v5.60.8 - GovCloud GCP onboarding and reliability fixes

Oct 08, 2026

guardrailsTE

Bug fixes

Server
- Fixed an issue where the connectivity test in the GCP project connection wizard failed for Workload Identity Federation when Guardrails runs in AWS GovCloud (US).
- Improved the reliability of scheduled control runs by reviving stranded monitors and clearing orphaned pending runs.
UI
- The GCP Workload Identity Federation setup script now uses the correct AWS partition when Guardrails runs in AWS GovCloud (US), so Google Cloud accepts Guardrails' credentials. If you created a workload identity pool provider in GovCloud with an earlier version of the script, update its attribute condition to start with arn:aws-us-gov:sts::.
- Fixed broken console links and theme mismatches on pages served through the new console experience.

Requirements

Upgrade to 5.60.8 requires your workspace to be on 5.54.x
PostgreSQL (RDS engine): >= 15
TEF: 1.71.0
TED: 1.37.0
Mods:
- @turbot/turbot: 5.61.0

Base images

Alpine: 3.17.5 Ubuntu: 22.04.3

gcp-vertexai v5.5.1 - Fixed Vertex AI models and endpoints going out of date

Oct 07, 2026

guardrailsMods

Bug fixes

Vertex AI endpoints, models, deployment resource pools and notebook runtime templates now stay up to date with GCP on every CMDB run. Previously some kept the details captured when they were first discovered, and endpoints kept details removed in GCP, such as deployed models after the last undeploy, or request-response logging after it was turned off.
Guardrails now picks up these Vertex AI changes in real time: new models (including Model Garden deploys) and deployment resource pools, models being deployed to or undeployed from an endpoint, and updates or deletions of endpoints, models, model versions, deployment resource pools and notebook runtime templates. Deploying from Model Garden, or creating a notebook runtime template with gcloud or the API, no longer adds an unnamed resource to Guardrails.

Control Types

Added

GCP > CIS v5.0
GCP > CIS v5.0 > 1 - Identity and Access Management
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.01 - Ensure Super Admin Email Address Is Not Tied To A Single User
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.02 - Ensure Super Admin Account Is Not Used For Google Cloud Administration
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.03 - Ensure Folders Are Structured By Environment And Sensitivity
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.04 - Ensure Organization Policies Are Configured For Centralized Constraints
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.02 - Ensure that Corporate Login Credentials are Used
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.03 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.04 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.05 - Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.06 - Ensure That Service Account Has No Admin Privileges
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.07 - Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.08 - Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.09 - Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.10 - Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.11 - Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.12 - Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Only Exist for Active Services
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.16 - Ensure API Keys Are Rotated Every 90 Days
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.17 - Ensure Essential Contacts is Configured for Organization
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager
GCP > CIS v5.0 > 2 - Logging and Monitoring
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.01 - Ensure That Cloud Audit Logging Is Configured Properly
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.02 - Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.03 - Ensure That Sinks Are Configured for All Log Entries
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.04 - Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.05 - Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.06 - Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.07 - Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.08 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.09 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.10 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.11 - Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.12 - Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.13 - Ensure That Cloud DNS Logging Is Enabled for All VPC Networks
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.14 - Ensure Cloud Asset Inventory Is Enabled
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.15 - Ensure 'Access Transparency' is 'Enabled'
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.16 - Ensure 'Access Approval' is 'Enabled'
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.17 - Ensure Logging is enabled for HTTP(S) Load Balancer
GCP > CIS v5.0 > 3 - Networking
GCP > CIS v5.0 > 3 - Networking > 3.01 - Ensure That the Default Network Does Not Exist in a Project
GCP > CIS v5.0 > 3 - Networking > 3.02 - Ensure Legacy Networks Do Not Exist for Older Projects
GCP > CIS v5.0 > 3 - Networking > 3.03 - Ensure That DNSSEC Is Enabled for Cloud DNS
GCP > CIS v5.0 > 3 - Networking > 3.04 - Ensure That RSASHA1 Is Not Used for the Key-Signing Key in Cloud DNS DNSSEC
GCP > CIS v5.0 > 3 - Networking > 3.05 - Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC
GCP > CIS v5.0 > 3 - Networking > 3.06 - Ensure That SSH Access Is Restricted From the Internet
GCP > CIS v5.0 > 3 - Networking > 3.07 - Ensure That RDP Access Is Restricted From the Internet
GCP > CIS v5.0 > 3 - Networking > 3.08 - Ensure VPC Service Controls Is Enabled for Supported Google Cloud Services
GCP > CIS v5.0 > 3 - Networking > 3.09 - Ensure Private Service Connect is Used for Access to Google APIs
GCP > CIS v5.0 > 3 - Networking > 3.10 - Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network
GCP > CIS v5.0 > 3 - Networking > 3.11 - Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites
GCP > CIS v5.0 > 3 - Networking > 3.12 - Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
GCP > CIS v5.0 > 4 - Virtual Machines
GCP > CIS v5.0 > 4 - Virtual Machines > 4.01 - Ensure That Instances Are Not Configured To Use the Default Service Account
GCP > CIS v5.0 > 4 - Virtual Machines > 4.02 - Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs
GCP > CIS v5.0 > 4 - Virtual Machines > 4.03 - Ensure "Block Project-Wide SSH Keys" Is Enabled for VM Instances
GCP > CIS v5.0 > 4 - Virtual Machines > 4.04 - Ensure Oslogin Is Enabled for a Project
GCP > CIS v5.0 > 4 - Virtual Machines > 4.05 - Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance
GCP > CIS v5.0 > 4 - Virtual Machines > 4.06 - Ensure That IP Forwarding Is Not Enabled on Instances
GCP > CIS v5.0 > 4 - Virtual Machines > 4.07 - Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)
GCP > CIS v5.0 > 4 - Virtual Machines > 4.08 - Ensure Compute Instances Are Launched With Shielded VM Enabled
GCP > CIS v5.0 > 4 - Virtual Machines > 4.09 - Ensure That Compute Instances Do Not Have Public IP Addresses
GCP > CIS v5.0 > 4 - Virtual Machines > 4.10 - Ensure That App Engine Applications Enforce HTTPS Connections
GCP > CIS v5.0 > 4 - Virtual Machines > 4.11 - Ensure That Compute Instances Have Confidential Computing Enabled
GCP > CIS v5.0 > 4 - Virtual Machines > 4.12 - Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects
GCP > CIS v5.0 > 5 - Storage
GCP > CIS v5.0 > 5 - Storage > 5.01 - Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 5 - Storage > 5.02 - Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.01 - Ensure That a MySQL Instance Does Not Allow Anyone To Connect With Administrative Privileges
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.02 - Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.03 - Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.01 - Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.02 - Ensure That the 'Log_connections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.03 - Ensure That the 'Log_disconnections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.04 - Ensure 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.05 - Ensure that the 'Log_min_messages' Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.06 - Ensure 'Log_min_error_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'Error' or Stricter
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.07 - Ensure That the 'Log_min_duration_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1' (Disabled)
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.08 - Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.01 - Ensure 'external scripts enabled' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.02 - Ensure 'cross db ownership chaining' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.03 - Ensure 'user Connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.04 - Ensure 'user options' Database Flag for Cloud SQL SQL Server Instance Is Not Configured
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.05 - Ensure 'remote access' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.06 - Ensure '3625 (trace flag)' Database Flag for all Cloud SQL SQL Server Instances Is Set to 'on'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.07 - Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.04 - Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.05 - Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.06 - Ensure Cloud SQL Database Instances Have IAM Database Authentication Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.07 - Ensure That Cloud SQL Database Instances Do Not Have Public IPs
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.08 - Ensure That Cloud SQL Database Instances Are Configured With Automated Backups
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.09 - Ensure Cloud SQL Database Instances Have Deletion Protection Enabled
GCP > CIS v5.0 > 7 - BigQuery
GCP > CIS v5.0 > 7 - BigQuery > 7.01 - Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 7 - BigQuery > 7.02 - Ensure That All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK)
GCP > CIS v5.0 > 7 - BigQuery > 7.03 - Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets
GCP > CIS v5.0 > 7 - BigQuery > 7.04 - Ensure all data in BigQuery has been classified
GCP > CIS v5.0 > 8 - Dataproc
GCP > CIS v5.0 > 8 - Dataproc > 8.01 - Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key

Policy Types

Added

GCP > CIS v5.0
GCP > CIS v5.0 > 1 - Identity and Access Management
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.01 - Ensure Super Admin Email Address Is Not Tied To A Single User
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.01 - Ensure Super Admin Email Address Is Not Tied To A Single User > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.02 - Ensure Super Admin Account Is Not Used For Google Cloud Administration
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.02 - Ensure Super Admin Account Is Not Used For Google Cloud Administration > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.03 - Ensure Folders Are Structured By Environment And Sensitivity
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.03 - Ensure Folders Are Structured By Environment And Sensitivity > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.04 - Ensure Organization Policies Are Configured For Centralized Constraints
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > 1.01.04 - Ensure Organization Policies Are Configured For Centralized Constraints > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.01 - Organization Resource > Maximum Attestation Duration
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.02 - Ensure that Corporate Login Credentials are Used
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.02 - Ensure that Corporate Login Credentials are Used > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.03 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.03 - Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.04 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.04 - Ensure that Security Key Enforcement is Enabled for All Admin Accounts > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.05 - Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.06 - Ensure That Service Account Has No Admin Privileges
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.07 - Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.08 - Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.09 - Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.10 - Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.11 - Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.12 - Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.13 - Ensure API Keys Only Exist for Active Services
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.14 - Ensure API Keys Are Restricted To Use by Only Specified Hosts and Apps
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.15 - Ensure API Keys Are Restricted to Only APIs That Application Needs Access
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.16 - Ensure API Keys Are Rotated Every 90 Days
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.17 - Ensure Essential Contacts is Configured for Organization
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.17 - Ensure Essential Contacts is Configured for Organization > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager
GCP > CIS v5.0 > 1 - Identity and Access Management > 1.18 - Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager > Attestation
GCP > CIS v5.0 > 1 - Identity and Access Management > Maximum Attestation Duration
GCP > CIS v5.0 > 2 - Logging and Monitoring
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.01 - Ensure That Cloud Audit Logging Is Configured Properly
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.02 - Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.02 - Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging > Attestation
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.03 - Ensure That Sinks Are Configured for All Log Entries
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.04 - Ensure That Retention Policies on Cloud Storage Buckets Used for Exporting Logs Are Configured Using Bucket Lock
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.05 - Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.06 - Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.07 - Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.08 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.09 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.10 - Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.11 - Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.12 - Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.13 - Ensure That Cloud DNS Logging Is Enabled for All VPC Networks
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.14 - Ensure Cloud Asset Inventory Is Enabled
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.15 - Ensure 'Access Transparency' is 'Enabled'
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.15 - Ensure 'Access Transparency' is 'Enabled' > Attestation
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.16 - Ensure 'Access Approval' is 'Enabled'
GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.17 - Ensure Logging is enabled for HTTP(S) Load Balancer
GCP > CIS v5.0 > 2 - Logging and Monitoring > Maximum Attestation Duration
GCP > CIS v5.0 > 3 - Networking
GCP > CIS v5.0 > 3 - Networking > 3.01 - Ensure That the Default Network Does Not Exist in a Project
GCP > CIS v5.0 > 3 - Networking > 3.02 - Ensure Legacy Networks Do Not Exist for Older Projects
GCP > CIS v5.0 > 3 - Networking > 3.03 - Ensure That DNSSEC Is Enabled for Cloud DNS
GCP > CIS v5.0 > 3 - Networking > 3.04 - Ensure That RSASHA1 Is Not Used for the Key-Signing Key in Cloud DNS DNSSEC
GCP > CIS v5.0 > 3 - Networking > 3.05 - Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC
GCP > CIS v5.0 > 3 - Networking > 3.06 - Ensure That SSH Access Is Restricted From the Internet
GCP > CIS v5.0 > 3 - Networking > 3.07 - Ensure That RDP Access Is Restricted From the Internet
GCP > CIS v5.0 > 3 - Networking > 3.08 - Ensure VPC Service Controls Is Enabled for Supported Google Cloud Services
GCP > CIS v5.0 > 3 - Networking > 3.08 - Ensure VPC Service Controls Is Enabled for Supported Google Cloud Services > Attestation
GCP > CIS v5.0 > 3 - Networking > 3.09 - Ensure Private Service Connect is Used for Access to Google APIs
GCP > CIS v5.0 > 3 - Networking > 3.09 - Ensure Private Service Connect is Used for Access to Google APIs > Attestation
GCP > CIS v5.0 > 3 - Networking > 3.10 - Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network
GCP > CIS v5.0 > 3 - Networking > 3.11 - Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites
GCP > CIS v5.0 > 3 - Networking > 3.12 - Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
GCP > CIS v5.0 > 3 - Networking > 3.12 - Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed' > Attestation
GCP > CIS v5.0 > 3 - Networking > Maximum Attestation Duration
GCP > CIS v5.0 > 4 - Virtual Machines
GCP > CIS v5.0 > 4 - Virtual Machines > 4.01 - Ensure That Instances Are Not Configured To Use the Default Service Account
GCP > CIS v5.0 > 4 - Virtual Machines > 4.02 - Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs
GCP > CIS v5.0 > 4 - Virtual Machines > 4.03 - Ensure "Block Project-Wide SSH Keys" Is Enabled for VM Instances
GCP > CIS v5.0 > 4 - Virtual Machines > 4.04 - Ensure Oslogin Is Enabled for a Project
GCP > CIS v5.0 > 4 - Virtual Machines > 4.05 - Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance
GCP > CIS v5.0 > 4 - Virtual Machines > 4.06 - Ensure That IP Forwarding Is Not Enabled on Instances
GCP > CIS v5.0 > 4 - Virtual Machines > 4.07 - Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)
GCP > CIS v5.0 > 4 - Virtual Machines > 4.08 - Ensure Compute Instances Are Launched With Shielded VM Enabled
GCP > CIS v5.0 > 4 - Virtual Machines > 4.09 - Ensure That Compute Instances Do Not Have Public IP Addresses
GCP > CIS v5.0 > 4 - Virtual Machines > 4.10 - Ensure That App Engine Applications Enforce HTTPS Connections
GCP > CIS v5.0 > 4 - Virtual Machines > 4.10 - Ensure That App Engine Applications Enforce HTTPS Connections > Attestation
GCP > CIS v5.0 > 4 - Virtual Machines > 4.11 - Ensure That Compute Instances Have Confidential Computing Enabled
GCP > CIS v5.0 > 4 - Virtual Machines > 4.12 - Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects
GCP > CIS v5.0 > 4 - Virtual Machines > 4.12 - Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects > Attestation
GCP > CIS v5.0 > 4 - Virtual Machines > Maximum Attestation Duration
GCP > CIS v5.0 > 5 - Storage
GCP > CIS v5.0 > 5 - Storage > 5.01 - Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 5 - Storage > 5.02 - Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.01 - Ensure That a MySQL Instance Does Not Allow Anyone To Connect With Administrative Privileges
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.01 - Ensure That a MySQL Instance Does Not Allow Anyone To Connect With Administrative Privileges > Attestation
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.02 - Ensure 'Skip_show_database' Database Flag for Cloud SQL MySQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > 6.01.03 - Ensure That the 'Local_infile' Database Flag for a Cloud SQL MySQL Instance Is Set to 'Off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.01 - MySQL Database > Maximum Attestation Duration
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.01 - Ensure 'Log_error_verbosity' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'DEFAULT' or Stricter
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.02 - Ensure That the 'Log_connections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.03 - Ensure That the 'Log_disconnections' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'On'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.04 - Ensure 'Log_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.05 - Ensure that the 'Log_min_messages' Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.06 - Ensure 'Log_min_error_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to 'Error' or Stricter
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.07 - Ensure That the 'Log_min_duration_statement' Database Flag for Cloud SQL PostgreSQL Instance Is Set to '-1' (Disabled)
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.02 - PostgreSQL Database > 6.02.08 - Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.01 - Ensure 'external scripts enabled' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.02 - Ensure 'cross db ownership chaining' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.03 - Ensure 'user Connections' Database Flag for Cloud SQL SQL Server Instance Is Set to a Non-limiting Value
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.04 - Ensure 'user options' Database Flag for Cloud SQL SQL Server Instance Is Not Configured
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.05 - Ensure 'remote access' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.06 - Ensure '3625 (trace flag)' Database Flag for all Cloud SQL SQL Server Instances Is Set to 'on'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.03 - SQL Server > 6.03.07 - Ensure 'contained database authentication' Database Flag for Cloud SQL SQL Server Instance Is Set to 'off'
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.04 - Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.05 - Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.06 - Ensure Cloud SQL Database Instances Have IAM Database Authentication Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.07 - Ensure That Cloud SQL Database Instances Do Not Have Public IPs
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.08 - Ensure That Cloud SQL Database Instances Are Configured With Automated Backups
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > 6.09 - Ensure Cloud SQL Database Instances Have Deletion Protection Enabled
GCP > CIS v5.0 > 6 - Cloud SQL Database Services > Maximum Attestation Duration
GCP > CIS v5.0 > 7 - BigQuery
GCP > CIS v5.0 > 7 - BigQuery > 7.01 - Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible
GCP > CIS v5.0 > 7 - BigQuery > 7.02 - Ensure That All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK)
GCP > CIS v5.0 > 7 - BigQuery > 7.03 - Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets
GCP > CIS v5.0 > 7 - BigQuery > 7.04 - Ensure all data in BigQuery has been classified
GCP > CIS v5.0 > 7 - BigQuery > 7.04 - Ensure all data in BigQuery has been classified > Attestation
GCP > CIS v5.0 > 7 - BigQuery > Maximum Attestation Duration
GCP > CIS v5.0 > 8 - Dataproc
GCP > CIS v5.0 > 8 - Dataproc > 8.01 - Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key
GCP > CIS v5.0 > Maximum Attestation Duration