Predefined posture for secure by default, essentials

This constraint prevents users from creating persistent keys for service accounts to decrease the risk of exposed service account credentials.

The value is true to disable service account key creation.

This constraint prevents default service accounts from receiving the overly-permissive Identity and Access Management (IAM) role Editor at creation.

The value is false to disable automatic IAM grants for default service accounts.

This constraint avoids the risk of leaked and reused custom key material in service account keys.

The value is true to disable service account key uploads.

This policy prevents Cloud Storage buckets from being open to unauthenticated public access.

The value is true to prevent public access to buckets.

This policy prevents Cloud Storage buckets from using per-object ACL (a separate system from IAM policies) to provide access, enforcing consistency for access management and auditing.

The value is true to enforce uniform bucket-level access.

This policy requires OS Login on newly created VMs to more easily manage SSH keys, provide resource-level permission with IAM policies, and log user access.

The value is true to require OS Login.

This policy prevents users from accessing the VM serial port which can be used for backdoor access from the Compute Engine API control plane.

The value is true to disable VM serial port access.

This policy prevents the accidental deletion of Shared VPC host projects by restricting the removal of project liens.

The value is true to restrict Shared VPC project lien removal.

This policy prevents the creation of Compute Engine instances with a public IP address, which can expose them to incoming internet traffic and outgoing internet traffic.

The value is denyAll to turn off all access from public IP addresses. If you want to change it to permit certain VM instances to have public access, set the allowed values:

policy_rules:
    - values:
      allowed_values:
      - is:projects/PROJECT_ID/zones/ZONE/instances/INSTANCE

This policy disables the automatic creation of a default VPC network and default firewall rules in each new project, ensuring that network and firewall rules are intentionally created.

The value is true to avoid creating the default VPC network.

This policy restricts application developers from choosing legacy DNS settings for Compute Engine instances that have lower service reliability than modern DNS settings.

The value is Zonal DNS only for new projects.

This policy prevents the creation of Cloud SQL instances with public IP addresses, which can expose them to incoming internet traffic and outgoing internet traffic.

The value is true to restrict access to Cloud SQL instances by public IP addresses.

This policy prevents public or non-RFC 1918 network ranges from accessing Cloud SQL databases.

The value is true to restrict authorized networks on Cloud SQL instances.

This policy allows VM protocol forwarding for internal IP addresses only.

The value is INTERNAL to restrict protocol forwarding based on the type of IP address.

This policy prevents the creation of external IPv6 subnets, which can be exposed to incoming and outgoing internet traffic.

The value is true to disable external IPv6 subnets.

This policy disables nested virtualization for all Compute Engine VMs to decrease the security risk related to unmonitored nested instances.

The value is true to turn off VM nested virtualization.