๐ก๏ธ Consumer Google Accounts are used๐ขโช
- Contextual name: ๐ก๏ธ Consumer Google Accounts are used๐ขโช
- ID:
/ce/ca/google/iam/corporate-login-credentials - Tags:
- โช Impossible policy
- ๐ข Policy with categories
- ๐ข Policy with type
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Similar Policiesโ
- Cloud Conformity: Corporate Login Credentials In Use
- Internal:
dec-z-79f4ab88
Similar Internal Rulesโ
| Rule | Policies | Flags |
|---|---|---|
| โ๏ธ dec-z-79f4ab88 | 1 |
Descriptionโ
Descriptionโ
Use corporate login credentials instead of consumer accounts, such as Gmail accounts.
Rationaleโ
It is recommended fully-managed corporate Google accounts be used for increased visibility, auditing, and controlling access to Cloud Platform resources. Email accounts based outside of the user's organization, such as consumer accounts, should not be used for business purposes.
Impactโ
There will be increased overhead as maintaining accounts will now be required. For smaller organizations, this will not be an issue, but will balloon with size.
Auditโ
For each Google Cloud Platform project, list the accounts that have been granted access to that project:
From Google Cloud CLIโ
```sh
gcloud projects get-iam-policy {{project-id}}
```Also list the accounts added on each folder:
```sh
gcloud resource-manager folders get-iam-policy {{folder-id}}
```And list your organization's IAM policy:
```sh
gcloud organizations get-iam-policy {{organization-id}}
```No email accounts outside the organization domain should be granted permissions in the IAM policies. This excludes Google-owned service accounts.
... see more
Remediationโ
Remediationโ
Remove all consumer Google accounts from IAM policies. Follow the documentation and setup corporate login accounts.