1.16 Ensure Essential Contacts is Configured for Organization

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.

Rationale:

Many Google Cloud services, such as Cloud Billing, send out notifications to share important information with Google Cloud users. By default, these notifications are sent to members with certain Identity and Access Management (IAM) roles. With Essential Contacts, you can customize who receives notifications by providing your own list of contacts.

Impact:

There is no charge for Essential Contacts.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

From Console:

Go to Essential Contacts by visiting https://console.cloud.google.com/iam-admin/essential-contacts

Make sure the organization appears in the resource selector at the top of the page. The resource selector tells you what project, folder, or organization you are currently managing contacts for.

Click +Add contact

In the Email and Confirm Email fields, enter the email address of the contact.

From the Notification categories drop-down menu, select the notification categories that you want the contact to receive communications for.

Click Save

From Command Line:

To add an organization Essential Contacts run a command:

gcloud essential-contacts create --email='<EMAIL>' \
--notification-categories='<NOTIFICATION_CATEGORIES>' \
--organization=<ORGANIZATION_ID>

Default Value:

By default, there are no Essential Contacts configured.

In the absence of an Essential Contact, the following IAM roles are used to identify users to notify for the following categories:

Legal: roles/billing.admin

Security: roles/resourcemanager.organizationAdmin

Suspension: roles/owner

Technical: roles/owner

Technical Incidents: roles/owner

See Also

https://workbench.cisecurity.org/files/3817