Connector · Google Cloud
CIS benchmark for Google Cloud.
Read-only. Every project.
ConfigCobra scans your Google Cloud organization against the CIS Google Cloud Platform Foundation Benchmark v5.0.0 — 93 controls — with a read-only service account.
- CIS controls
- 93
- Benchmark sections
- 8
- Access
- Read-only
- Or selected projects
- Org-wide
93 controls in 8 sections. One scan.
The CIS Google Cloud Platform Foundation Benchmark v5.0.0 — 54 Level 1 and 39 Level 2 controls.
See the benchmark breakdown →Every project, every section.
Scan every project in the organization, or a selected list.
Connect
A read-only service account. Nothing more.
A dedicated service account with viewer-level roles for the whole organization or the projects you choose. ConfigCobra never writes to your Google Cloud.
Scan
93 controls, from IAM to Dataproc.
One scan covers all 8 sections, from Identity and Access Management to Cloud SQL, BigQuery and Dataproc.
Benchmark sections →Evidence
See exactly what failed.
Each finding comes with its evidence: the setting, what the benchmark expects and what the scan found.
Cloud Security Posture Management →Priority
Fix the important ones first.
Every control carries a severity estimate — ConfigCobra's prioritisation, since CIS publishes no severity.
Inventory
Your Google Cloud resources, in one inventory.
Google Cloud resources sit next to your other clouds, with a per-cloud and an "All clouds" view and findings linked to the objects they concern.
Explore the inventory →Impact
See what a fix changes before you apply it.
For a failing control, ConfigCobra lists the resources and identities the fix would affect, with an impact level, so nothing breaks by surprise.
Remediation impact analysis →Read-only. Never writes to your Google Cloud.
Viewer-level roles only, for the whole organization or a selected list of projects.
- Read-only
Service accountA dedicated, read-only service account for ConfigCobra.
- Configuration only
Viewer-level rolesViewer-level roles let ConfigCobra read configuration — nothing more.
- Or selected projects
Organization-wideEvery project in the organization, or a selected list.
What you can do on Google Cloud.
Assess your projects against the CIS benchmark and see every resource in the inventory.
- Assess
Cloud Security Posture Management (CSPM)
CIS benchmark assessment with a score, findings and a severity estimate per control
Learn more → - See
Inventory & Insights
Every user, app, device and resource in one inventory, with built-in risk views
Learn more → - Fix
Remediation
See what a fix changes in your tenant before you apply it, then use the generated script
Learn more → - Keep
Monitoring & Drift
Daily scans, drift detection and email alerts when a control regresses
Learn more → - Prove
Reports & Evidence
PDF reports with evidence and a timestamped snapshot, plus a read-only auditor seat
Learn more → - Ask
AI Assistant (MCP)
Ask your AI assistant about your posture, using live ConfigCobra scan data
Learn more →
One console for
- Microsoft 365160 CIS controls
- Microsoft Azure339 CIS controls
- Google Cloud93 CIS controls
- AWS306 CIS controls
- Google WorkspaceComing soon
Frequently asked questions
Is Google Cloud support available?
Yes. ConfigCobra for Google Cloud is available. Start a free trial, or ask us for a quote.
Which CIS benchmark does ConfigCobra check for Google Cloud?
The CIS Google Cloud Platform Foundation Benchmark v5.0.0 — 93 controls, 54 Level 1 and 39 Level 2, across 8 sections.
What access does ConfigCobra need in Google Cloud?
A read-only service account with viewer-level roles. Access is read-only — ConfigCobra never writes to your Google Cloud.
Can I scan more than one project?
Yes. A scan can cover the whole organization — every project — or a selected list of projects.
Does Google Cloud appear in the ConfigCobra inventory?
Yes. Google Cloud resources appear in the inventory next to your other connected clouds, with a per-cloud view and an "All clouds" view.
See it on your own tenant
Read-only access — ConfigCobra never changes your tenant.