Ensure that the set of shared VPC subnetworks that eligible Google Cloud resources can use, are defined using the "Restrict Shared VPC Subnetworks" constraint policy. The allowed list of VPC subnetworks must be specified in the following form: projects/<project-id>/regions/<subnetwork-region>/subnetworks/<subnetwork-name>. You can also define the list of allowed subnetworks in a project, folder, or organization, using the following format: under:organizations/<organization-id>, under:folders/<folder-id>, under:projects/<project-id>. The set of shared VPC subnetworks that your cloud resources can use must be configured in the conformity rule settings, on the Trend Micro Cloud One™ – Conformity account console.
By default, eligible Google Cloud resources can use any shared Virtual Private Cloud (VPC) subnetwork. With "Restrict Shared VPC Subnetworks" constraint policy you can define the set of shared VPC subnetworks that your cloud resources can use within your GCP organization.
Audit
To determine if shared VPC subnetwork restriction is enforced at the GCP organization level, perform the following actions:
Remediation / Resolution
To enforce shared VPC subnetwork restriction at the Google Cloud organization level, enable and configure the "Restrict Shared VPC Subnetworks" constraint policy by performing the following actions:
References
- Google Cloud Platform (GCP) Documentation
- VPC network overview
- Resource Manager
- Organization policy constraints
- Creating and managing organization policies
- GCP Command Line Interface (CLI) Documentation
- gcloud organizations list
- gcloud alpha resource-manager org-policies describe
- gcloud beta resource-manager org-policies set-policy
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Restrict Shared VPC Subnetworks
Risk Level: Medium