📝 Consumer Google Accounts are used 🟢

• Contextual name: 📝 Consumer Google Accounts are used 🟢
• ID: /ce/ca/google/iam/corporate-login-credentials
• Located in: 📁 Google IAM

Flags

• 🟢 Impossible policy
• 🟢 Policy with categories
• 🟢 Policy with type

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Corporate Login Credentials In Use
• Internal
  • dec-z-79f4ab88

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-z-79f4ab88	1

Description

Open File

Description

Use corporate login credentials instead of consumer accounts, such as Gmail accounts.

Rationale

It is recommended fully-managed corporate Google accounts be used for increased visibility, auditing, and controlling access to Cloud Platform resources. Email accounts based outside of the user's organization, such as consumer accounts, should not be used for business purposes.

Impact

There will be increased overhead as maintaining accounts will now be required. For smaller organizations, this will not be an issue, but will balloon with size.

Audit

For each Google Cloud Platform project, list the accounts that have been granted access to that project:

From Google Cloud CLI

 gcloud projects get-iam-policy PROJECT_ID

Also list the accounts added on each folder:

 gcloud resource-manager folders get-iam-policy FOLDER_ID

And list your organization's IAM policy:

 gcloud organizations get-iam-policy ORGANIZATION_ID

No email accounts outside the organization domain should be granted permissions in the IAM policies. This excludes Google-owned service accounts.

... see more

Remediation

Open File

Remediation

Remove all consumer Google accounts from IAM policies. Follow the documentation and setup corporate login accounts.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS GCP v1.1.0 → 💼 1.1 Ensure that corporate login credentials are used		1	1
💼 CIS GCP v1.2.0 → 💼 1.1 Ensure that corporate login credentials are used - Level 1 (Automated)		1	1
💼 CIS GCP v1.3.0 → 💼 1.1 Ensure that Corporate Login Credentials are Used - Level 1 (Manual)		1	1
💼 CIS GCP v3.0.0 → 💼 1.1 Ensure that Corporate Login Credentials are Used - Level 1 (Manual)			1
💼 Cloudaware Framework → 💼 Credential Lifecycle Management			17
💼 FedRAMP High Security Controls → 💼 IA-2 Identification and Authentication (Organizational Users) (L)(M)(H)	6	1	3
💼 FedRAMP High Security Controls → 💼 IA-4 Identifier Management (L)(M)(H)	1	1	1
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	6	14	20
💼 FedRAMP Low Security Controls → 💼 IA-4 Identifier Management (L)(M)(H)			1
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	1		20
💼 FedRAMP Moderate Security Controls → 💼 IA-2 Identification and Authentication (Organizational Users) (L)(M)(H)	6		3
💼 FedRAMP Moderate Security Controls → 💼 IA-4 Identifier Management (L)(M)(H)	1		1
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	4		20
💼 ISO/IEC 27001:2013 → 💼 A.9.2.1 User registration and de-registration		1	1
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes		19	22
💼 NIST CSF v1.1 → 💼 PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions		4	8
💼 NIST CSF v1.1 → 💼 PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)		19	22
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented		43	51
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization			23
💼 NIST CSF v2.0 → 💼 PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions			8
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated			22
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties			58
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			82
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			69
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			67
💼 PCI DSS v3.2.1 → 💼 8.1.1 Assign all users a unique ID before allowing them to access system components or cardholder data.		2	2
💼 PCI DSS v4.0.1 → 💼 8.2.1 All users are assigned a unique ID before access to system components or cardholder data is allowed.			2
💼 PCI DSS v4.0 → 💼 8.2.1 All users are assigned a unique ID before access to system components or cardholder data is allowed.			2