Manage a security posture

This page describes how you can configure and use the security posture service after you activate Security Command Center. To start, you must create a posture that includes your policies, organized in policy sets, and then deploy the posture using a posture deployment. After a posture is deployed, you can monitor for drift and further refine your posture over time.

You can't use security posture management with project-level activations. For more information, see Feature availability with project-level activations.

Before you begin

Complete these tasks before you complete the remaining tasks on this page.

Activate Security Command Center

Verify that you have activated Security Command Center at the organization level.

If you want to use Security Health Analytics detectors as policies, select the Security Health Analytics service during the activation process.

Set up permissions

To get the permissions that you need to use posture, ask your administrator to grant you the Security Posture Admin (roles/securityposture.admin) IAM role. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

For more information about security posture roles and security posture permissions, see IAM for organization-level activations.

Set up Google Cloud CLI

In the Google Cloud console, activate Cloud Shell.

Activate Cloud Shell

At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

To set up the gcloud CLI to use service account impersonation to authenticate to Google APIs, rather than your user credentials, run the following command:

gcloud config set auth/impersonate_service_account SERVICE_ACCT_EMAIL

For more information, see Service account impersonation.

Enable APIs

Enable the Organization Policy Service and the security posture service APIs:

gcloud services enable orgpolicy.googleapis.com  securityposture.googleapis.com

Configure connection to AWS

To use built-in Security Health Analytics detectors that are specific to AWS, you must connect to AWS for configuration and resource data collection.

Create and deploy a posture

To start using a security posture, you must complete the following:

Create a posture YAML file that defines the policies that apply to your security posture.
Create a posture in Google Cloud that is based on the posture YAML file.
Deploy the posture.

The following sections provide detailed instructions.

Create a posture YAML file

A posture consists of one or more policy sets that you deploy together. These policy sets include all the preventative and detective policies that you want to include in your posture.

To create your posture, do one of the following:

Copy a predefined posture template. If required, make any edits to the policies so that they apply to your environment and comply with your business's regulatory and security standards. For instructions, see Create a posture file from a predefined posture template.
Extract existing policies from your environment. If required, make any edits to the policies so that they comply with your business's regulatory and security standards. For instructions, see Create a posture file by extracting policies from an existing environment.
Create a Terraform resource that defines the posture. For instructions, see Create a Terraform resource with policy definitions.

For details about the fields that you can use in a posture, see the Posture reference and the PolicySet reference.

Create a posture file from a predefined posture template

You can use a predefined posture template to create a posture file.

Console

In the Google Cloud console, go to the Posture Management page.

Go to Posture Management
Select an organization.
In the Templates tab, click the template that you want to use.
In the Template details page, click Create Posture.

Note: If you don't see Create Posture, create the posture using Google Cloud CLI instead.
Provide a unique name for the posture and click Create. The Posture details page opens.
Complete one of the following actions:
- If you can use the posture without making any changes (for example, you used one of the _essentials templates), you can deploy the posture. For instructions, see Deploy a posture.
- If you need to modify any of the policy sets or policies (for example, you used one of the _enhanced templates), complete Modify a posture YAML file and set the posture state to ACTIVE.

gcloud

Review the predefined posture templates to determine which ones apply to your environment. You can apply some of them without making any changes, but others require you to customize the policies to match your environment.
Use one of the following methods to copy the YAML files into your own text editor:
- Copy the YAML file from the reference content in predefined posture templates.
- Run the gcloud scc posture-templates describe command to copy the YAML file.
```
gcloud scc posture-templates describe \
    organizations/ORGANIZATION_ID/locations/global/postureTemplates/POSTURE_TEMPLATE \
    --revision-id=REVISION_ID
```
Replace the following values:
- ORGANIZATION_ID is the organization where you activated Security Command Center.
- POSTURE_TEMPLATE is the template name of the predefined posture template, as described in Predefined posture templates.
- REVISION_ID is the revision version for the predefined posture template. If you don't include the revision ID, the latest version of the predefined posture template is displayed.
For example, to view the secure AI, essentials predefined posture template under the 3589215982 organization, run the following:
```
gcloud scc posture-templates describe \
    organizations/3589215982/locations/global/postureTemplates/secure_ai_essential \
    --revision-id=v.1.0
```
Complete one of the following actions:
- If you can use the posture without making any changes (for example, you used one of the _essentials templates), you can create the posture. For instructions, see Create a posture.
- If you need to modify any of the policy sets or policies, complete Modify a posture YAML file.

Create a posture file by extracting policies from an existing environment

You can extract the policies (organization policies, including custom policies and all Security Health Analytics detectors, including custom detectors) that you configured in an existing project, folder, or organization to create a posture file. You can't extract policies from an organization, folder, or project that already has a posture applied to it.

This command only extracts the policies that you previously configured for the organization, folder, or project and doesn't extract policies from parent folders or organization.

If you connected to AWS, this command also extracts the detectors that are specific to AWS (Preview).

Run the gcloud scc postures extract command to extract the existing organization policies and Security Health Analytics detectors in your environment.
```
gcloud scc postures extract POSTURE_NAME \
    --workload=WORKLOAD
```
Replace the following values:
- POSTURE_NAME is the relative resource name of the posture. For example, organizations/ORGANIZATION_ID/locations/global/postures/POSTURE_ID.
  - POSTURE_ID is an alphanumeric name for your posture that is unique to your organization.