Steampipe mods are now Powerpipe →

Plugins Docs Home

turbot/gcp_compliance

app_engine_application_iap_enabled audit_logging_configured_for_all_service bigquery_dataset_encrypted_with_cmk bigquery_dataset_not_publicly_accessible bigquery_dataset_restrict_gmail bigquery_dataset_restrict_googlegroups bigquery_table_encrypted_with_cmk cloudfunction_function_no_deployments_manager_permission cloudfunction_function_no_disrupt_logging_permission cloudfunction_function_no_ingress_settings_allow_all cloudfunction_function_restrict_public_access cloudfunction_function_restricted_permission cloudfunction_function_vpc_connector_enabled cloudrun_service_restrict_public_access compute_backend_bucket_no_dangling_storage_bucket compute_disk_encrypted_with_csk compute_external_backend_service_iap_enabled compute_firewall_allow_connections_proxied_by_iap compute_firewall_allow_tcp_connections_proxied_by_iap compute_firewall_default_rule_restrict_ingress_access_except_http_and_https compute_firewall_rule_ingress_access_restricted_to_dns_port_53 compute_firewall_rule_ingress_access_restricted_to_ftp_port_21 compute_firewall_rule_ingress_access_restricted_to_http_port_80 compute_firewall_rule_ingress_access_restricted_to_microsoft_ds_port_445 compute_firewall_rule_ingress_access_restricted_to_mongo_db_port_27017 compute_firewall_rule_ingress_access_restricted_to_mysql_db_port_3306 compute_firewall_rule_ingress_access_restricted_to_netbios_snn_port_139 compute_firewall_rule_ingress_access_restricted_to_oracle_db_port_1521 compute_firewall_rule_ingress_access_restricted_to_pop3_port_110 compute_firewall_rule_ingress_access_restricted_to_postgresql_port_10250 compute_firewall_rule_ingress_access_restricted_to_postgresql_port_10255 compute_firewall_rule_ingress_access_restricted_to_postgresql_port_5432 compute_firewall_rule_ingress_access_restricted_to_smtp_port_25 compute_firewall_rule_ingress_access_restricted_to_telnet_port_23 compute_firewall_rule_rdp_access_restricted compute_firewall_rule_restrict_ingress_all compute_firewall_rule_restrict_ingress_all_with_no_specific_target compute_firewall_rule_ssh_access_restricted compute_https_load_balancer_logging_enabled compute_instance_block_project_wide_ssh_enabled compute_instance_confidential_computing_enabled compute_instance_ip_forwarding_disabled compute_instance_no_data_destruction_permission compute_instance_no_database_write_permission compute_instance_no_deployments_manager_permission compute_instance_no_disrupt_logging_permission compute_instance_no_iam_write_permission compute_instance_no_service_account_impersonate_permission compute_instance_no_write_permission_on_deny_policy compute_instance_oslogin_enabled compute_instance_preemptible_termination_disabled compute_instance_serial_port_connection_disabled compute_instance_shielded_vm_enabled compute_instance_template_ip_forwarding_disabled compute_instance_with_custom_metadata compute_instance_with_no_default_service_account compute_instance_with_no_default_service_account_with_full_access compute_instance_with_no_public_ip_addresses compute_instance_wth_no_high_level_basic_role compute_network_auto_create_subnetwork_enabled compute_network_contains_no_default_network compute_network_contains_no_legacy_network compute_network_dns_logging_enabled compute_ssl_policy_with_no_weak_cipher compute_subnetwork_flow_log_enabled compute_subnetwork_private_ip_google_access compute_target_https_proxy_quic_protocol_enabled compute_target_https_proxy_quic_protocol_no_default_ssl_policy compute_target_https_uses_latest_tls_version dataproc_cluster_encryption_with_cmek dns_managed_zone_dnssec_enabled dns_managed_zone_key_signing_not_using_rsasha1 dns_managed_zone_zone_signing_not_using_rsasha1 iam_api_key_age_90 iam_api_key_restricts_apis iam_api_key_restricts_websites_hosts_apps iam_service_account_gcp_managed_key iam_service_account_key_age_100 iam_service_account_key_age_90 iam_service_account_without_admin_privilege iam_user_denylist_public iam_user_kms_separation_of_duty_enforced iam_user_not_assigned_service_account_user_role_project_level iam_user_separation_of_duty_enforced iam_user_uses_corporate_login_credentials kms_key_not_publicly_accessible kms_key_rotated_within_100_day kms_key_rotated_within_90_day kms_key_separation_of_duties_enforced kubernetes_cluster_auto_repair_enabled kubernetes_cluster_auto_upgrade_enabled kubernetes_cluster_binary_authorization_enabled kubernetes_cluster_client_certificate_authentication_enabled kubernetes_cluster_dashboard_disabled kubernetes_cluster_database_encryption_enabled kubernetes_cluster_http_load_balancing_enabled kubernetes_cluster_incoming_traffic_open_to_all kubernetes_cluster_intra_node_visibility_enabled kubernetes_cluster_kubernetes_alpha_enabled kubernetes_cluster_legacy_abac_enabled kubernetes_cluster_legacy_endpoints_disabled kubernetes_cluster_logging_enabled kubernetes_cluster_master_authorized_networks_config_enabled kubernetes_cluster_monitoring_enabled kubernetes_cluster_network_policy_enabled kubernetes_cluster_network_policy_installed kubernetes_cluster_no_default_network kubernetes_cluster_node_config_image_cos_containerd kubernetes_cluster_node_no_default_service_account kubernetes_cluster_private_cluster_config_enabled kubernetes_cluster_private_nodes_configured kubernetes_cluster_release_channel_configured kubernetes_cluster_service_account_default kubernetes_cluster_shielded_instance_integrity_monitoring_enabled kubernetes_cluster_shielded_node_secure_boot_enabled kubernetes_cluster_shielded_nodes_enabled kubernetes_cluster_use_ip_aliases kubernetes_cluster_with_less_than_three_node_auto_upgrade_enabled kubernetes_cluster_with_resource_labels kubernetes_cluster_zone_redundant logging_bucket_retention_policy_enabled logging_metric_alert_audit_configuration_changes logging_metric_alert_custom_role_changes logging_metric_alert_firewall_rule_changes logging_metric_alert_network_changes logging_metric_alert_network_route_changes logging_metric_alert_project_ownership_assignment logging_metric_alert_sql_instance_configuration_changes logging_metric_alert_storage_iam_permission_changes logging_sink_configured_for_all_resource manual_control organization_essential_contacts_configured project_access_approval_settings_enabled project_no_api_key project_service_cloudasset_api_enabled project_service_container_scanning_api_enabled sql_instance_automated_backups_enabled sql_instance_mysql_binary_log_enabled sql_instance_mysql_local_infile_database_flag_off sql_instance_mysql_skip_show_database_flag_on sql_instance_not_open_to_internet sql_instance_not_publicly_accessible sql_instance_postgresql_cloudsql_pgaudit_database_flag_enabled sql_instance_postgresql_log_checkpoints_database_flag_on sql_instance_postgresql_log_connections_database_flag_on sql_instance_postgresql_log_disconnections_database_flag_on sql_instance_postgresql_log_duration_database_flag_on sql_instance_postgresql_log_error_verbosity_database_flag_default_or_stricter sql_instance_postgresql_log_executor_stats_database_flag_off sql_instance_postgresql_log_hostname_database_flag_configured sql_instance_postgresql_log_lock_waits_database_flag_on sql_instance_postgresql_log_min_duration_statement_database_flag_disabled sql_instance_postgresql_log_min_error_statement_database_flag_configured sql_instance_postgresql_log_min_messages_database_flag_error sql_instance_postgresql_log_parser_stats_database_flag_off sql_instance_postgresql_log_planner_stats_database_flag_off sql_instance_postgresql_log_statement_database_flag_ddl sql_instance_postgresql_log_statement_stats_database_flag_off sql_instance_postgresql_log_temp_files_database_flag_0 sql_instance_require_ssl_enabled sql_instance_sql_3625_trace_database_flag_off sql_instance_sql_3625_trace_database_flag_on sql_instance_sql_contained_database_authentication_database_flag_off sql_instance_sql_cross_db_ownership_chaining_database_flag_off sql_instance_sql_external_scripts_enabled_database_flag_off sql_instance_sql_remote_access_database_flag_off sql_instance_sql_user_connections_database_flag_configured sql_instance_sql_user_options_database_flag_not_configured sql_instance_with_labels sql_instance_with_no_public_ips storage_bucket_bucket_policy_only_enabled storage_bucket_log_retention_policy_enabled storage_bucket_log_retention_policy_lock_enabled storage_bucket_not_publicly_accessible storage_bucket_uniform_access_enabled

Query: kubernetes_cluster_node_config_image_cos_containerd

Usage

powerpipe query gcp_compliance.query.kubernetes_cluster_node_config_image_cos_containerd

Steampipe Tables

gcp_kubernetes_cluster

GCP plugin

SQL

select
  self_link resource,
  case
    when node_config ->> 'ImageType' = 'COS_CONTAINERD' then 'ok'
    else 'alarm'
  end as status,
  case
    when node_config ->> 'ImageType' = 'COS_CONTAINERD' then title || ' Container-Optimized OS(COS) is used.'
    else title || ' Container-Optimized OS(COS) not used.'
  end as reason,
  location as location,
  project as project
from
  gcp_kubernetes_cluster;

Controls

The query is being used by the following controls:

Ensure Container-Optimized OS (cos) is used for Kubernetes engine clusters