GCP Policies

GCP policies set what a scan collects and checks in GCP environments.

---

Edit Scan Policy (GCP)

On the General tab you enable or disable the scan modules and define exclusions. Unlike the other policy types, a GCP policy has no Options section. The Edit Scan Policy page has four tabs: General, Vulnerability, Tier 0 Assets and Compliance (see Compliance Frameworks).

GCP Scan Policy Settings

---

Vulnerability Policies and Tiering (GCP)

The Vulnerability tab sets which GCP checks run during the scan (see Vulnerability Policies). The Tier 0 Assets tab marks your most critical identities.

---

GCP Scan Modules

IAM Assessment: Checks vulnerabilities, misconfigurations and access relationships in GCP, including IAM, resources, roles and permissions across organizations, folders and projects. It is the core module and cannot be disabled.

Tier0 Analysis: Optional. An analytics-only module that calculates the attack paths from Tier 2 identities to Tier 0 assets from the data collected by IAM Assessment.

Both modules are enabled in the GCP Default Policy.

---

Exclusions (GCP)

Click Add New to add an exclusion row, then select the entity type and enter the entity. The types and their identifiers are listed under General Exclusions.

---

Tier 0 Assets (GCP)

On the Tier 0 Assets tab you mark critical GCP identities as privileged. The types are GCPUser, GCPGroup, GCPServiceAccount and GCPRole. Tier 0 assets are treated as high-impact identities in the attack path analysis.