Policy types for @turbot/gcp-build

• GCP > Build > API Enabled
• GCP > Build > Approved Regions [Default]
• GCP > Build > CMDB
• GCP > Build > Enabled
• GCP > Build > Labels Template [Default]
• GCP > Build > Permissions
• GCP > Build > Permissions > Levels
• GCP > Build > Permissions > Levels > Modifiers
• GCP > Build > Regions
• GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-build
• GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-build

GCP > Build > API Enabled

Check whether GCP Build Service API is enabled.

API Enabled refers specifically to the API state of a service in a cloud project.
This control determines whether the API state is set as per desired level.

The GCP > Build Service > API Enabled control compares
the API state against the API Enabled policies,
raises an alarm, and takes the defined enforcement action.

[
  "Skip",
  "Check: Disabled",
  "Check: Enabled",
  "Check: Enabled if Build Service > Enabled",
  "Enforce: Disabled",
  "Enforce: Enabled",
  "Enforce: Enabled if Build Service > Enabled"
]

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Disabled",
    "Check: Enabled",
    "Check: Enabled if Build Service > Enabled",
    "Enforce: Disabled",
    "Enforce: Enabled",
    "Enforce: Enabled if Build Service > Enabled"
  ],
  "default": "Skip"
}

GCP > Build > Approved Regions [Default]

A list of GCP regions in which GCP Build resources are approved for use.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

This policy is the default value for all GCP Build resources' Approved > Regions policies.

"{\n  regions: policyValue(uri:\"tmod:@turbot/gcp#/policy/types/approvedRegionsDefault\") {\n    value\n  }\n}\n"

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- '{{ item }}'\n{% endfor %}"

GCP > Build > CMDB

Configure whether to record and synchronize details for the GCP Build build into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in GCP > Build > Build > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

GCP > Build > Enabled

Enabled Build Service.

[
  "Enabled",
  "Enabled: Metadata Only",
  "Disabled"
]

{
  "type": "string",
  "enum": [
    "Enabled",
    "Enabled: Metadata Only",
    "Disabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Disabled"
}

GCP > Build > Labels Template [Default]

A template used to generate the keys and values for GCP Build Service resources.

By default, all Build Service resource Labels > Template policies will use this value.

"{\n  defaultLabels: policyValue(uri:\"tmod:@turbot/gcp#/policy/types/defaultLabelsTemplate\") {\n    value\n  }\n}\n"

"{%- if $.defaultLabels.value | length == 0 %} [] {%- elif $.defaultLabels.value != undefined %}{{ $.defaultLabels.value | dump | safe }}{%- else %}{% for item in $.defaultLabels.value %}- {{ item }}{% endfor %}{% endif %}"

GCP > Build > Permissions

Configure whether permissions policies are in effect for GCP Build Service.
This setting does not affect Project level permissions (GCP/Admin, GCP/Owner, etc).

Note: The behavior of this policy depends on the value of GCP > Permissions.

[
  "Enabled",
  "Disabled",
  "Enabled if GCP > Build Service > Enabled"
]

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if GCP > Build Service > Enabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Enabled if GCP > Build Service > Enabled"
}

GCP > Build > Permissions > Levels

Define the permissions levels that can be used to grant access to Build Service
an GCP project. Permissions levels defined will appear in the UI to assign access to Guardrails users.

Note: Some services do not use all permissions levels, and any permissions level that has
no permissions associated will not be created even if it is selected here.

[
  "{\n  item: project {\n    turbot{\n      id\n    }\n  }\n}\n",
  "{\n  availableLevels: policyValues(filter:\"policyTypeLevel:self resourceId:{{ $.item.turbot.id }} policyType:'tmod:@turbot/gcp-iam#/policy/types/permissionsLevelsDefault'\") {\n    items {\n      value\n    }\n  }\n}\n"
]

"{% if $.availableLevels.items[0].value | length == 0 %} [] {% endif %}{% for item in $.availableLevels.items[0].value %}- {{ item }}\n{% endfor %}"

{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "Metadata",
      "ReadOnly",
      "Operator",
      "Admin",
      "Owner"
    ]
  }
}

GCP > Build > Permissions > Levels > Modifiers

A map of GCP API to Guardrails Permission Level used to customize Guardrails' standard permissions.
You can add, remove or redefine the mapping of GCP API operations to Guardrails permissions levels here.

Note: Modifiers are cumulative - if you add a permission to the metadata level, it is also added
to readOnly, operator and admin. Modifier policies set here will “roll up” to the GCP level too - if
you add a permission to Admin, it will be granted to GCP/Storage/Admin and also GCP/Admin

<br />example:<br /> - &quot;storage.bucket.create&quot;: admin<br /> - &quot;sql.database.create&quot;: metadata<br />

GCP > Build > Regions

A list of GCP regions in which GCP Build resources are supported for use.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

This policy is the default value for all GCP Build resources' Regions policies.

{
  "allOf": [
    {
      "$ref": "gcp#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "asia-east1",
        "asia-east2",
        "asia-northeast1",
        "asia-south1",
        "asia-southeast1",
        "australia-southeast1",
        "europe-north1",
        "europe-west1",
        "europe-west2",
        "europe-west3",
        "europe-west4",
        "northamerica-northeast1",
        "southamerica-east1",
        "us-central1",
        "us-east1",
        "us-east4",
        "us-west1",
        "us-west2"
      ]
    }
  ]
}

GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-build

A calculated policy that Guardrails uses to create a compiled list of ALL permission
levels for GCP Build Service that is used as input to
the stack that manages the Guardrails IAM permissions objects.

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-build

A calculated policy that Guardrails uses to create a compiled list of ALL
permissions for GCP Build Service that is used as
input to the control that manages the IAM stack.