1. Docs
  2. Reference
  3. Pre-built Policy Packs
  4. Pulumi Best Practices
  5. Google Cloud

Pulumi Best Practices - Google Cloud

    This page lists all 35 policies in the Pulumi Best Practices pack for Google Cloud.

    Policy NameDescriptionFramework ReferenceFramework Specification
    bucket-iam-least-privilegeEnforce least privilege access for Cloud Storage bucket IAM policies1. Least PrivilegeEnsure all identities and services have only the minimum permissions required to perform their tasks.
    iam-no-broad-rolesEnforce least privilege access control by prohibiting overly broad roles1. Least PrivilegeEnsure all identities and services have only the minimum permissions required to perform their tasks.
    pubsub-topic-iam-least-privilegeEnforce least privilege IAM policies for Pub/Sub topics1. Least PrivilegeEnsure all identities and services have only the minimum permissions required to perform their tasks.
    compute-instance-encrypted-attached-diskRequire Compute Engine instances to have encrypted attached disks2. Resource Encryption at RestEncrypt all stored data using approved encryption mechanisms to protect against unauthorized access.
    compute-instance-encrypted-boot-diskRequire Compute Engine instances to have encrypted boot disks2. Resource Encryption at RestEncrypt all stored data using approved encryption mechanisms to protect against unauthorized access.
    gke-secrets-encryptionRequire GKE clusters to have Application-layer Secrets Encryption enabled2. Resource Encryption at RestEncrypt all stored data using approved encryption mechanisms to protect against unauthorized access.
    bucket-customer-managed-kmsRequire Cloud Storage buckets to use customer-managed Cloud KMS keys for encryption2. Resource Encryption at RestEncrypt all stored data using approved encryption mechanisms to protect against unauthorized access.
    cloudsql-sslRequire Cloud SQL connections to use SSL/TLS encryption3. Transport Layer EncryptionRequire secure protocols (e.g., TLS) for all data in transit to prevent interception or tampering.
    cloud-cdn-origin-tlsRequire Cloud CDN to use secure TLS to origin3. Transport Layer EncryptionRequire secure protocols (e.g., TLS) for all data in transit to prevent interception or tampering.
    load-balancer-tlsRequire Cloud Load Balancers to disallow unencrypted traffic3. Transport Layer EncryptionRequire secure protocols (e.g., TLS) for all data in transit to prevent interception or tampering.
    gke-private-endpointsRequire GKE cluster API endpoints to be private4. No Public AccessProhibit direct public exposure of resources unless explicitly approved and required.
    bucket-no-public-readRequire Cloud Storage buckets to disallow public read access4. No Public AccessProhibit direct public exposure of resources unless explicitly approved and required.
    cloudsql-private-ipRequire Cloud SQL instances to be deployed with private IP only4. No Public AccessProhibit direct public exposure of resources unless explicitly approved and required.
    compute-no-public-ipRequire Compute Engine instances to disallow public IP addresses4. No Public AccessProhibit direct public exposure of resources unless explicitly approved and required.
    resource-labelingRequire all GCP resources to have proper labeling for change tracking5. TaggingEnforce standardized resource tags for ownership, environment, and compliance tracking.
    environment-labelRequire all labelable resources to have an environment label5. TaggingEnforce standardized resource tags for ownership, environment, and compliance tracking.
    cloud-build-loggingRequire Cloud Build triggers to have secure logging configurations6. Enforce LoggingEnable and retain audit logs for all security-relevant actions and events.
    bucket-access-loggingRequire Cloud Storage buckets to have access logging enabled for audit trails6. Enforce LoggingEnable and retain audit logs for all security-relevant actions and events.
    load-balancer-loggingRequire Cloud Load Balancers to configure access logging6. Enforce LoggingEnable and retain audit logs for all security-relevant actions and events.
    cloudsql-high-availabilityRequire Cloud SQL instances to have high availability configuration across zones7. High AvailabilityDeploy resources in redundant, fault-tolerant configurations to ensure service continuity.
    load-balancer-multi-zoneRequire Cloud Load Balancers to be configured across multiple zones for high availability7. High AvailabilityDeploy resources in redundant, fault-tolerant configurations to ensure service continuity.
    load-balancer-health-checksRequire Cloud Load Balancers to enable health checks for monitoring backend instance health7. High AvailabilityDeploy resources in redundant, fault-tolerant configurations to ensure service continuity.
    bucket-multi-regionRequire Cloud Storage buckets to have multi-region replication for business continuity7. High AvailabilityDeploy resources in redundant, fault-tolerant configurations to ensure service continuity.
    pubsub-dead-letter-queueRequire Pub/Sub subscriptions to have dead letter queue configuration8. Require DLQEnsure all asynchronous messaging systems are configured with a dead-letter queue to handle failures.
    cloud-tasks-retry-configurationRequire Cloud Tasks queues to have proper retry configuration for business continuity9. Resource AvailabilityDefine and enforce timeouts, quotas, and capacity limits to prevent resource exhaustion.
    firewall-ssh-rdpEnforce firewall rule restrictions for SSH and RDP access11. NetworkingOnly allow required inbound and outbound traffic through network security groups, firewalls, or ACLs.
    firewall-strictEnforce strict firewall rules with explicit allow/deny configuration11. NetworkingOnly allow required inbound and outbound traffic through network security groups, firewalls, or ACLs.
    firewall-no-http-ingressRequire firewall rules to disallow inbound HTTP traffic from unauthorized sources11. NetworkingOnly allow required inbound and outbound traffic through network security groups, firewalls, or ACLs.
    firewall-no-public-ingressRequire firewall rules to disallow public internet ingress unless specifically authorized11. NetworkingOnly allow required inbound and outbound traffic through network security groups, firewalls, or ACLs.
    cloudfunctions-documentationRequire Cloud Functions to have adequate documentation12. DocumentationMaintain up-to-date documentation of architectures, configurations, policies, and procedures to ensure clarity, consistency, and auditability.
    bucket-versioningRequire Cloud Storage buckets to have versioning enabled for data protection13. Data Backup and RecoveryRegularly back up critical data and systems, store backups securely, and test recovery procedures to ensure timely restoration after failures or disasters.
    cloudsql-backupRequire Cloud SQL instances to have backup retention enabled13. Data Backup and RecoveryRegularly back up critical data and systems, store backups securely, and test recovery procedures to ensure timely restoration after failures or disasters.
    kms-key-rotationRequire Cloud KMS keys to have key rotation enabled14. Key Management & RotationManage encryption keys securely and enforce periodic key rotation to reduce the risk of compromise.
    kms-key-configurationRequire proper Cloud KMS key creation and configuration14. Key Management & RotationManage encryption keys securely and enforce periodic key rotation to reduce the risk of compromise.
    kms-key-lifecycleRequire proper Cloud KMS key deletion and lifecycle management14. Key Management & RotationManage encryption keys securely and enforce periodic key rotation to reduce the risk of compromise.
      Neo just got smarter about infrastructure policy automation