Cloud infrastructure security standard Yandex Cloud

Written by

Updated at November 2, 2026

The provided rule set contains security controls based on Yandex Cloud's cloud infrastructure security standard.

Yandex Cloud's cloud infrastructure security standard provides comprehensive security requirements and best practices for protection of cloud infrastructure and applications deployed on the Yandex Cloud platform.

These controls help ensure security policy compliance and protection against common threats and security vulnerabilities in cloud environments:

Requirement ID	Security standard requirement	Check IDs in the CSPM module
Authentication and access management
`IAM1`	An identity federation (Single Sign-On, SSO) is configured	cspm.access.idp
`IAM2`	User group mapping is set up in the identity federation	cspm.access.user-groups-mapping
`IAM3`	Yandex ID accounts are only used in exceptional cases	cspm.yid.organization
`IAM4`	Cookie lifetime in a federation is less than 6 hours	cspm.cookie-timeout.organization
`IAM5`	Only appropriate administrators can manage IAM group membership	cspm.access.user-groups-access
`IAM6`	Service roles are used instead of primitive ones: admin, editor, viewer, and auditor	cspm.access.min-privileges
`IAM9`	Service accounts have minimal privileges	cspm.access.sa-privileges-org-roles cspm.access.sa-privileges-service-roles
`IAM10`	Only trusted administrators have access to service accounts	cspm.access.privileged-sa-access
`IAM11`	Service account keys are periodically rotated	cspm.iam.sa-key-rotation
`IAM12`	Minimum required scopes are configured for service account API keys	cspm.access.defined-key-scopes
`IAM16`	Getting a token via AWS IMDSv1 is disabled on the VM	cspm.aws-token
`IAM17`	Two-factor authentication for privileged accounts is in place	cspm.access.userpool-mfa
`IAM18`	Only trusted administrators have privileged roles	cspm.access.check-privileged-roles
`IAM22`	There is no public access to resources within the organization	cspm.access.public-access
`IAM24`	Resource labels are used	cspm.o11y.labeled-resources
`IAM26`	The date of last service account authentication and last access key use in Identity and Access Management are tracked	cspm.iam.unused-service-account cspm.iam.unused-key
Network security
`NET1`	Cloud objects use a firewall or security groups	cspm.network.firewall
`NET2`	A security group is created in Yandex Virtual Private Cloud; the default security group is not used	cspm.network.network-firewall
`NET3`	Security groups have no access rule that is too broad	cspm.network.network-firewall-scope cspm.k8s.network-firewall-scope
`NET4`	Access through control ports is open only for trusted IPs	cspm.trusted-ip cspm.trusted-ip-k8s
`NET5`	Protection against DDoS attacks is on	cspm.appsec.ddos-protection.l3 cspm.appsec.ddos-protection.l7
`NET10`	Outbound internet access is controlled	cspm.network.check-outgoing-internet-connection
Secure virtual environment configuration
`ENV1`	A serial console is either used under control or not used	cspm.access.serial-console
`ENV7`	There is no public access to the Object Storage bucket	cspm.access.bucket-public-access
`ENV8`	Object Storage uses bucket policies	cspm.access.bucket-access-policy
`ENV9`	The Object lock feature is enabled in Object Storage	cspm.s3.used-object-lock
`ENV14`	A security group is assigned in managed databases	cspm.network.db-security-group
`ENV15`	No public IP address is assigned in managed databases	cspm.network.db-ip
`ENV16`	The deletion protection feature is enabled	cspm.db.db-deletion-protection
`ENV17`	The setting for access from DataLens is off if not needed	cspm.access.db-datalens-access
`ENV18`	Access from the management console is disabled in managed databases	cspm.access.db-console-access
`ENV19`	Serverless Containers/Cloud Functions uses the internal VPC network	cspm.network.serverless-uses-vpc
`ENV26`	No public access is allowed for YDB	cspm.network.ydb-public
`ENV28`	ACL configured by IP addresses for Yandex Container Registry	cspm.access.acl-container-registry
`ENV29`	Yandex Certificate Manager certificate is valid for at least 30 days	cspm.crypto.certificate-validity
`ENV30`	Yandex Managed Service for GitLab instance security recommendations are followed	cspm.o11y.gitlab-audited
`ENV33`	OS Login is used for connection to a VM or Kubernetes node	cspm.access.os-login-onto-hosts.vm
`ENV37`	Cloud Backup or scheduled snapshots are used	cspm.backup.compute-disks
Data encryption and key management
`CRYPT1`	At-rest encryption with a KMS key is enabled in Yandex Object Storage	cspm.data.object-storage-encryption
`CRYPT2`	HTTPS for static website hosting is enabled in Yandex Object Storage	cspm.data.storage-https
`CRYPT3`	Yandex Application Load Balancer uses HTTPS	cspm.appsec.alb-https
`CRYPT4`	Yandex API Gateway uses HTTPS and its own domain	cspm.appsec.api-gateway-https
`CRYPT5`	Yandex Cloud CDN uses HTTPS and its own SSL certificate	cspm.appsec.cdn-https
`CRYPT8`	Disk and virtual machine snapshot encryption is used	cspm.crypto.managed-vm-kms
`CRYPT9`	Key Management Service keys are stored in a Hardware Security Module (HSM)	cspm.crypto.keys-hsm
`CRYPT10`	Permissions to manage keys in KMS are issued to controlled users	cspm.access.kms-keys-access
`CRYPT11`	Rotation is enabled for KMS keys	cspm.crypto.keys-rotation
`CRYPT12`	Deletion protection is enabled for KMS keys	cspm.crypto.keys-deletion-protection
`CRYPT13`	The organization uses Yandex Lockbox for secure secret storage	cspm.crypto.secrets-lockbox
`CRYPT14`	For Serverless Containers and Cloud Functions, Lockbox secrets are used	cspm.crypto.secrets-serverless
`CRYPT16`	Cloud administrator is instructed what to do if cloud secrets get compromised	cspm.crypto.leaked-secrets-detection
Collection, monitoring, and analysis of audit logs
`AUDIT1`	Yandex Audit Trails is enabled at the organization level	cspm.o11y.audit-trails cspm.o11y.audit-trails-no-errors cspm.o11y.gitlab-audited
`AUDIT3`	Response to Yandex Audit Trails events has been configured	cspm.o11y.audit-trails-reactions
`AUDIT8`	Data events are monitored	cspm.o11y.data-plane-events
Application security
`APPSEC1`	Yandex SmartCaptcha is used	cspm.appsec.use-smartcaptcha
`APPSEC2`	Docker images are scanned when uploaded to Yandex Container Registry	cspm.appsec.secure-registry
`APPSEC3`	Docker images stored in Container Registry are regularly scanned	cspm.appsec.periodic-scan
`APPSEC4`	Container images used in production environment were last scanned one week ago or less	cspm.appsec.registry-recently-scan
`APPSEC9`	A Yandex Smart Web Security profile is used	cspm.appsec.use-sws
`APPSEC10`	A web application firewall is used	cspm.appsec.use-waf
`APPSEC11`	Advanced Rate Limiter is used	cspm.appsec.use-arl
Kubernetes security
`K8S3`	There is no access to the Kubernetes API and node groups from untrusted networks	cspm.k8s.api-security
`K8S4`	Authentication and access management are configured in Managed Service for Kubernetes	cspm.k8s.access
`K8S5`	Yandex Managed Service for Kubernetes uses a safe configuration	cspm.k8s.secure-configuration cspm.k8s.cis
`K8S11`	A Kubernetes security policy is used	cspm.k8s.kspm cspm.k8s.disallow-k8s-not-regional

Cloud infrastructure security standard Yandex Cloud

Was the article helpful?