Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Custom Sha Module Firewall Ssh Cel 2

Section: Managing policy and drift detection at scale (e.g., cloud security posture management, custom organization policies and custom modules for Security Health Analytics).

A financial enterprise is implementing continuous configuration drift detection across its Google Cloud organization using Security Command Center. To mitigate risks highlighted in recent security bulletins concerning OpenSSH vulnerabilities, the security team needs to deploy a custom Security Health Analytics (SHA) detection module.

The module must evaluate all Compute Engine firewall rules across projects and automatically generate a CRITICAL finding whenever an active ingress rule allows unrestricted traffic from the public internet (0.0.0.0/0) to TCP port 22.

How should the custom SHA module and its Common Expression Language (CEL) expression be configured?

Set the resource selector to compute.googleapis.com/Firewall, set the severity to CRITICAL, and define a CEL expression that evaluates to false when an ingress rule contains 0.0.0.0/0 and allows TCP port 22.

Set the resource selector to compute.googleapis.com/Instance, set the severity to CRITICAL, and define a CEL expression checking resource.data.tags.items.exists(tag, tag == 'allow-ssh').

Set the resource selector to compute.googleapis.com/Firewall, set the severity to CRITICAL, and define a CEL expression that evaluates to true when an enabled ingress rule includes 0.0.0.0/0 in sourceRanges and allows TCP port 22.

Create a custom Organization Policy boolean constraint using CEL on compute.googleapis.com/Firewall with enforcement set to audit to generate findings in Security Command Center.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Custom Sha Module Firewall Ssh Cel 2

Section: Managing policy and drift detection at scale (e.g., cloud security posture management, custom organization policies and custom modules for Security Health Analytics).

How should the custom SHA module and its Common Expression Language (CEL) expression be configured?

Set the resource selector to compute.googleapis.com/Instance, set the severity to CRITICAL, and define a CEL expression checking resource.data.tags.items.exists(tag, tag == 'allow-ssh').

Create a custom Organization Policy boolean constraint using CEL on compute.googleapis.com/Firewall with enforcement set to audit to generate findings in Security Command Center.

Explanations

What Custom Security Health Analytics Modules Are

Security Health Analytics (SHA) custom modules allow organizations to extend Security Command Center's built-in vulnerability scanning by creating custom rules. These modules use Common Expression Language (CEL) to continuously evaluate asset configurations and metadata reported by Cloud Asset Inventory (CAI).

How It Meets the Requirements

Resource Targeting: Setting the resource_types to compute.googleapis.com/Firewall instructs the SHA engine to evaluate all firewall assets within the organization or folder scope.
Violation Logic: In Security Health Analytics custom modules, the predicate.expression must evaluate to true when a vulnerability or misconfiguration exists. When the condition evaluates to true, Security Command Center automatically creates an active finding.
CEL Expression: The expression checks that the rule is enabled (!resource.data.disabled), enforces incoming traffic (resource.data.direction == "INGRESS"), contains the public IP range (resource.data.sourceRanges.exists(r, r == "0.0.0.0/0")), and permits port 22 (resource.data.allowed.exists(a, a.IPProtocol == "tcp" && a.ports.exists(p, p == "22"))).
Severity Assignment: Configuring severity: "CRITICAL" categorizes the finding appropriately in the Security Command Center dashboard and triggers corresponding alerts.

Key Advantages

Continuous and Real-Time: Evaluates resources automatically upon creation or modification without custom cron jobs.
Native Integration: Findings seamlessly integrate into SCC posture dashboards, exports, and Pub/Sub notification pipelines.
Declarative Governance: Enables infrastructure security teams to manage detection policies as code alongside deployment pipelines.

View source documentation

Professional Cloud Security Engineer

Custom Sha Module Firewall Ssh Cel 2

Professional Cloud Security Engineer

Custom Sha Module Firewall Ssh Cel 2

What Custom Security Health Analytics Modules Are

How It Meets the Requirements

Key Advantages

Related questions