feat(CG-1302): add gcp cis 1.30 3.10

Author: james-zhou-inspire11

src/gcp/cis-1.3.0/README.md

@@ -93,6 +93,7 @@ Policy Pack based on the GCP Foundations 1.3.0 benchmark provided by the [Center
 | GCP CIS 3.7    | Ensure that RDP access is restricted from the internet                                                                                                              |
 | GCP CIS 3.8    | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network                                                                                              |
 | GCP CIS 3.9    | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites                                                                             |
+| GCP CIS 3.10   | Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'                                                                        |
 | GCP CIS 4.1    | Ensure that instances are not configured to use the default service account                                                                                         |
 | GCP CIS 4.2    | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs                                                      |
 | GCP CIS 4.3    | Ensure "Block Project-wide SSH keys" is enabled for VM instances                                                                                                    |

src/gcp/cis-1.3.0/rules/gcp-cis-1.3.0-3.10.ts

@@ -0,0 +1,63 @@
+export default {
+  id: 'gcp-cis-1.3.0-3.10',
+  title:
+    'Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are \'Allowed\'',
+  description: `IAP authenticates the user requests to your apps via a Google single sign in. You can then 
+  manage these users with permissions to control access. It is recommended to use both IAP 
+  permissions and firewalls to restrict this access to your apps with sensitive information.`,
+
+  audit: `**From Console:**
+
+  1. For each of your apps that have IAP enabled go to the Cloud Console VPC network > Firewall rules.
+  2. Verify that the only rules correspond to the following values:
+    o *Targets:* All instances in the network
+    o *Source IP ranges IAP Proxy Addresses*
+      ▪ 35.235.240.0/20 Google Health Check
+    o 130.211.0.0/22 Google Health Check
+    o 35.191.0.0/16 
+    o Protocols and ports:
+      ▪ Specified protocols and ports required for access and management of your app. For example most health check connection protocols would be covered by;
+      ▪ tcp:80 (Default HTTP Health Check port)
+    o tcp:443--(Default HTTPS Health Check port)
+      
+    Note: if you have custom ports used by your load balancers, you will need to list them here`,
+  rationale: `IAP ensure that access to VMs is controlled by authenticating incoming requests. Access to 
+  your apps and the VMs should be restricted by firewall rules that allow only the proxy IAP 
+  IP addresses contained in the 35.235.240.0/20 subnet. Otherwise, unauthenticated 
+  requests can be made to your apps. To ensure that load balancing works correctly health 
+  checks should also be allowed.`,
+  remediation: `**From Console:**
+
+  1. Go to the Cloud Console VPC network > Firewall rules.
+  2. Select the checkbox next to the following rules:
+    o default-allow-http
+    o default-allow-https
+    o default-allow-internal
+  3. Click *Delete.*
+  4. Click *Create firewall rule* and set the following values:
+    o *Name:* allow-iap-traffic
+    o *Targets:* All instances in the network
+      • Source IP ranges (press Enter after you paste each value in the box, copy the value below the bold text including the dash):
+        *IAP Proxy Addresses*
+      - 35.235.240.0/20
+        *Google Health Check*
+    o 130.211.0.0/22 Google Health Check
+    o Protocols and ports:
+      ▪ Specified protocols and ports required for access and management of your app. For example most health check connection protocols would be covered by;
+      ▪ tcp:80 (Default HTTP Health Check port)
+    o tcp:443--(Default HTTPS Health Check port)
+      *Note: if you have custom ports used by your load balancers, you will need to list them here*
+  5. When you're finished updating values, click Create.
+  
+  *Default Value:*
+
+    By default all traffic is allowed.`,
+  references: [
+    'https://cloud.google.com/iap/docs/concepts-overview',
+    'https://cloud.google.com/iap/docs/concepts-overview',
+    'https://cloud.google.com/iap/docs/load-balancer-howto',
+    'https://cloud.google.com/load-balancing/docs/health-checks',
+    'https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts',
+  ],
+  severity: 'medium',
+}

src/gcp/cis-1.3.0/rules/index.ts

@@ -36,6 +36,7 @@ import Gcp_CIS_130_36 from './gcp-cis-1.3.0-3.6'
 import Gcp_CIS_130_37 from './gcp-cis-1.3.0-3.7'
 import Gcp_CIS_130_38 from './gcp-cis-1.3.0-3.8'
 import Gcp_CIS_130_39 from './gcp-cis-1.3.0-3.9'
+import Gcp_CIS_130_310 from './gcp-cis-1.3.0-3.10'
 import Gcp_CIS_130_41 from './gcp-cis-1.3.0-4.1'
 import Gcp_CIS_130_42 from './gcp-cis-1.3.0-4.2'
 import Gcp_CIS_130_43 from './gcp-cis-1.3.0-4.3'
@@ -114,6 +115,7 @@ export default [
   Gcp_CIS_130_37,
   Gcp_CIS_130_38,
   Gcp_CIS_130_39,
+  Gcp_CIS_130_310,
   Gcp_CIS_130_41,
   Gcp_CIS_130_42,
   Gcp_CIS_130_43,