CSPACE-VPCSC-01: KMS / Secret Manager / GCS are inside a VPC Service Controls perimeter¶
| Property | Value |
|---|---|
| Severity | medium |
| Platform | GCP Confidential Space (AMD SEV-SNP) |
| Lifecycle stage | deploy |
| Mode | Passive: read-only cloud API calls. |
What it checks¶
It passes when:
- A VPC-SC perimeter restricts KMS, Secret Manager, and GCS.
How to fix¶
- Add the project to a VPC Service Controls perimeter whose restrictedServices include cloudkms, secretmanager, and storage.
- Add the project to a VPC-SC perimeter restricting cloudkms, secretmanager, and storage.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- Need --gcp-project and --access-policy; skipping check.
ERROR:
- Could not read VPC-SC perimeters: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--access-policy |
Access Context Manager policy/perimeter for VPC-SC checks. |
--gcp-project |
GCP project ID. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| Google Cloud | accesscontextmanager.accessPolicies.servicePerimeters.list |
accesscontextmanager.servicePerimeters.list |
read |
See Required permissions for every check on this platform.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).