Ensure that "Disable Guest Attributes of Compute Engine Metadata" organization policy is enforced in order to disable Compute Engine API access to the guest attributes configured for the virtual machines instances that belong to your project, folder, or organization.
Guest attributes are a specific type of custom metadata that your cloud applications can write to while running on your virtual machine (VM) instance. Any application or user on your VM instance can both read and write data to the guest attribute metadata values. Guest attributes are generally used for virtual machine startup scripts, configuration management agents, inventory management agents, and workload orchestration software. By default, the Compute Engine API can be used to access virtual machine guest attributes without restrictions. To ensure that users cannot configure guest attributes for your virtual machine instances in order to meet security and compliance requirements, disable the feature at the organization level by enforcing "Disable Guest Attributes of Compute Engine Metadata" policy.
Audit
To determine if "Disable Guest Attributes of Compute Engine Metadata" constraint policy is enabled for your GCP organizations, perform the following operations:
Remediation / Resolution
To ensure that GCP users cannot configure guest attributes for Compute Engine virtual machines, enable the "Disable Guest Attributes of Compute Engine Metadata" organization policy by performing the following operations:
References
- Google Cloud Platform (GCP) Documentation
- Storing and retrieving instance metadata
- Organization policy constraints
- Using constraints
- Creating and managing organization policies
- GCP Command Line Interface (CLI) Documentation
- gcloud organizations list
- gcloud alpha resource-manager org-policies describe
- gcloud alpha resource-manager org-policies enable-enforce
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Disable Guest Attributes of Compute Engine Metadata
Risk Level: Medium