Google Cloud checks in Varman
Read-only monitoring of IAM access, alerting and cloud tests in Google Cloud Platform. Varman runs 9 checks against Google Cloud on a schedule and records each result as evidence.
IAM: no primitive owner/editor roles
Flags primitive role bindings (roles/owner, roles/editor) on GCP projects and their inherited folders/organization.
Cloud Storage: no public access
Verify Cloud Storage buckets are not granted to allUsers/allAuthenticatedUsers and enforce uniform bucket-level access.
VPC: no firewall rules open to the internet
Flags enabled INGRESS VPC firewall rules that allow 0.0.0.0/0 to SSH, RDP, or all ports. Evaluates VPC firewall rules only (not hierarchical/network firewall policies).
Cloud SQL: SSL/TLS enforced
Verify Cloud SQL instances require SSL/TLS for connections.
Cloud SQL: automated backups enabled
Verify Cloud SQL instances have automated backups enabled.
Cloud Monitoring: alerting and log export
Verify alert policies notify a channel and logs are exported to durable storage.
Cloud Storage: encryption at rest
Verify Cloud Storage buckets are encrypted at rest (Google-managed by default; reports CMEK).
Cloud SQL: encryption at rest
Verify Cloud SQL instances are encrypted at rest (Google-managed by default; reports CMEK).
Separation of environments: production isolated from non-production
Verify production and non-production workloads are separated across distinct GCP projects.
Connecting Google Cloud
Google Cloud connects through OAuth sign-in. This connector is not yet available to connect in the hosted app. Tell us you need it and we will let you know when it is.