Google Cloud
Google Cloud, checked without a single service-account key.
ACSE connects to your projects through workload identity federation, as a read-only service account that has no key. It checks Compute Engine, IAM, Cloud Storage and VPC networks, and feeds every result into the same frameworks and fix queue as the rest of your estate.
No keys to leak
The service account ACSE uses has no key. Only your own ACSE runtime can federate into it, and only for read-only calls.
A whole organization in one connection
Connect a single project or every active project under your organization, and see each one’s posture in the same view.
The settings that matter, no more
Where a check needs instance metadata, ACSE keeps only the two settings it reads and drops everything else before anything is stored.
What the checks cover
21 checks across four services
Each check declares the read-only permissions it needs. Together they make up the custom role ACSE asks you to create, and nothing beyond it.
Compute Engine
OS Login, serial port access, Shielded VM, project-wide SSH keys, public IPs, IP forwarding, and instances running as the default service account or with full API access.
IAM
Basic roles in use, user-managed service-account keys and their rotation, service accounts with administrator roles, and impersonation granted at project level.
Cloud Storage
Buckets readable by anyone, public access prevention, uniform bucket-level access and retention policies.
VPC networks
Firewall rules open to administration or database ports, VPC flow logs and the default network left in place.
Keyless by design
Federated, read-only and scoped to your runtime
The setup creates a custom role, acseReadOnlyScanner, and a service account with no key. A workload identity pool trusts your ACSE runtime, and its attribute condition admits only your runtime’s own identity.
Tokens are issued with the read-only cloud-platform scope. Even if a role were broadened by mistake, the token could not write.
- Delivered as a
gcloudscript and a Terraform module - Project or organization scope
- Safe to re-run if you change scope later
Connect a project
From Setup to first scan in three steps
Your administrators run the generated setup in your own project. ACSE never asks for an administrator credential.
- Choose the cloud and the scopeIn Setup › Connect cloud, a Tenant Admin picks the provider and what to cover. ACSE lists every permission it will need and who in your team can grant them, before anything is created.
- Run the generated setup in your cloudACSE generates a read-only setup bound to your tenant’s own runtime identity. Your team reviews and runs it. ACSE never runs it for you and never sees a key.
- Test the connection and confirm with MFATest connection checks every permission and reports exactly what is missing. The Tenant Admin confirms with MFA, and the connection settings are recorded on your evidence chain.
Scope
One account, or every account in an AWS Organization or organizational unit.
What the setup creates
- A read-only role, ACSEReadOnlyScanner, in each account in scope
- A trust policy that lets only your own ACSE runtime assume it
- A permissions boundary, so the role can never gain write access
Read-only by design. ACSE delivers fixes as pull requests to your code, so the connection never needs write access to your cloud.
Scope
One project, or every active project in a Google Cloud organization.
What the setup creates
- A workload identity pool and provider that trust your ACSE runtime
- A service account with read-only roles, which only that pool may impersonate
- No service-account keys, ever
Read-only by design. ACSE delivers fixes as pull requests to your code, so the connection never needs write access to your cloud.
Scope
One subscription, or a whole tenant.
What the setup creates
- An app registration with a federated credential for your ACSE runtime
- A custom role with exactly the read actions ACSE needs, at the scope you chose
- No client secrets or certificates
Read-only by design. ACSE delivers fixes as pull requests to your code, so the connection never needs write access to your cloud.
Framework coverage on Google Cloud
Controls with a check behind them
Counts of the controls ACSE lists for each framework that at least one Google Cloud check evaluates. The rest show as manual controls.
- CIS Google Cloud benchmark
- 18 of 38 tracked recommendations
- PCI DSS 4.0.1
- 15 of 48 tracked requirements
- NIST SP 800-53 Rev. 5
- 15 of 45 tracked controls
- FedRAMP Moderate
- 15 of 45 tracked controls
- CCCS Medium
- 15 of 45 tracked controls
- SOC 2
- 7 of 38 tracked criteria
- ISO/IEC 27001:2022
- 8 of 93 Annex A controls
Questions
What people ask us
Does ACSE need a service-account key?
No. The setup creates the service account without a key, and ACSE never asks for one. Your runtime reaches it through workload identity federation.
Can I connect a whole organization?
Yes. Choose organization scope and ACSE scans every active project under it. If some projects are not visible, Test connection reports a partial scope with counts, never a full connection.
Which Google Cloud fixes come as code?
Turning on OS Login, public access prevention and uniform bucket-level access arrive as Terraform changes for your team to review. Other findings come with a runbook a person follows.
Why does ACSE drop instance metadata?
Instance metadata can hold startup scripts and other values ACSE has no reason to keep. The pack keeps only the OS Login and serial-port settings its checks read, drops the rest before staging, and records that it did so.
Keep reading
Related
Read-only and keyless
ACSE connects to AWS, Google Cloud and Azure through short-lived, read-only access you create. No long-lived keys, no admin credentials, no cloud writes.
ReadPlatformDetect
ACSE checks every resource in your clouds against the frameworks you choose, from inside your own account, and explains each finding in plain words.
ReadFrameworksNIST SP 800-53
ACSE maps cloud checks to the NIST SP 800-53 Rev. 5 technical controls it tracks across ten families, and shows each control as evaluated or manual.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.