Policy types for @turbot/gcp-notebooks

• GCP > Notebooks > API Enabled
• GCP > Notebooks > Approved Regions [Default]
• GCP > Notebooks > CMDB
• GCP > Notebooks > Enabled
• GCP > Notebooks > Permissions
• GCP > Notebooks > Permissions > Levels
• GCP > Notebooks > Permissions > Levels > Modifiers
• GCP > Notebooks > Regions
• GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-notebooks
• GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-notebooks

GCP > Notebooks > API Enabled

Check whether GCP Notebooks API is enabled.

API Enabled refers specifically to the API state of a service in a cloud project.
This control determines whether the API state is set as per desired level.

The GCP > Notebooks > API Enabled control compares
the API state against the API Enabled policies,
raises an alarm, and takes the defined enforcement action.

[
  "Skip",
  "Check: Disabled",
  "Check: Enabled",
  "Check: Enabled if Notebooks > Enabled",
  "Enforce: Disabled",
  "Enforce: Enabled",
  "Enforce: Enabled if Notebooks > Enabled"
]

{
  "type": "string",
  "enum": [
    "Skip",
    "Check: Disabled",
    "Check: Enabled",
    "Check: Enabled if Notebooks > Enabled",
    "Enforce: Disabled",
    "Enforce: Enabled",
    "Enforce: Enabled if Notebooks > Enabled"
  ],
  "default": "Skip"
}

GCP > Notebooks > Approved Regions [Default]

A list of GCP regions in which GCP Notebooks resources are approved for use.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

This policy is the default value for all GCP Notebooks resources' Approved > Regions policies.

"{\n  regions: policyValue(uri:\"tmod:@turbot/gcp#/policy/types/approvedRegionsDefault\") {\n    value\n  }\n}\n"

"{% if $.regions.value | length == 0 %} [] {% endif %}{% for item in $.regions.value %}- '{{ item }}'\n{% endfor %}"

GCP > Notebooks > CMDB

Configure whether to record and synchronize details for the GCP Notebooks notebooks into the CMDB.

The CMDB control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.
All policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to "Enforce: Enabled".

If set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.

To cleanup resources and stop tracking changes, set this policy to "Enforce: Disabled".

CMDB controls also use the Regions policy associated with the resource. If region is not in GCP > Notebooks > Notebooks > Regions policy, the CMDB control will delete the resource from the CMDB.

(Note: Setting CMDB to "Skip" will also pause these changes.)

[
  "Skip",
  "Enforce: Enabled",
  "Enforce: Disabled"
]

{
  "type": "string",
  "enum": [
    "Skip",
    "Enforce: Enabled",
    "Enforce: Disabled"
  ],
  "example": [
    "Skip"
  ],
  "default": "Enforce: Enabled"
}

GCP > Notebooks > Enabled

Enabled Notebooks.

[
  "Enabled",
  "Enabled: Metadata Only",
  "Disabled"
]

{
  "type": "string",
  "enum": [
    "Enabled",
    "Enabled: Metadata Only",
    "Disabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Disabled"
}

GCP > Notebooks > Permissions

Configure whether permissions policies are in effect for GCP Notebooks.
This setting does not affect Project level permissions (GCP/Admin, GCP/Owner, etc).

Note: The behavior of this policy depends on the value of GCP > Permissions.

[
  "Enabled",
  "Disabled",
  "Enabled if GCP > Notebooks > Enabled"
]

{
  "type": "string",
  "enum": [
    "Enabled",
    "Disabled",
    "Enabled if GCP > Notebooks > Enabled"
  ],
  "example": [
    "Enabled"
  ],
  "default": "Enabled if GCP > Notebooks > Enabled"
}

GCP > Notebooks > Permissions > Levels

Define the permissions levels that can be used to grant access to Notebooks
an GCP project. Permissions levels defined will appear in the UI to assign access to Guardrails users.

Note: Some services do not use all permissions levels, and any permissions level that has
no permissions associated will not be created even if it is selected here.

[
  "{\n  item: project {\n    turbot{\n      id\n    }\n  }\n}\n",
  "{\n  availableLevels: policyValues(filter:\"policyTypeLevel:self resourceId:{{ $.item.turbot.id }} policyTypeId:'tmod:@turbot/gcp-iam#/policy/types/permissionsLevelsDefault'\") {\n    items {\n      value\n    }\n  }\n}\n"
]

"{% if $.availableLevels.items[0].value | length == 0 %} [] {% endif %}{% for item in $.availableLevels.items[0].value %}- {{ item }}\n{% endfor %}"

{
  "type": "array",
  "items": {
    "type": "string",
    "enum": [
      "Metadata",
      "ReadOnly",
      "Operator",
      "Admin",
      "Owner"
    ]
  }
}

GCP > Notebooks > Permissions > Levels > Modifiers

A map of GCP API to Guardrails Permission Level used to customize Guardrails' standard permissions.
You can add, remove or redefine the mapping of GCP API operations to Guardrails permissions levels here.

Note: Modifiers are cumulative - if you add a permission to the metadata level, it is also added
to readOnly, operator and admin. Modifier policies set here will “roll up” to the GCP level too - if
you add a permission to Admin, it will be granted to GCP/Storage/Admin and also GCP/Admin

<br />example:<br /> - &quot;storage.bucket.create&quot;: admin<br /> - &quot;sql.database.create&quot;: metadata<br />

GCP > Notebooks > Regions

A list of GCP regions in which GCP Notebooks resources are supported for use.

The expected format is an array of regions names. You may use the '*' and
'?' wildcard characters.

This policy is the default value for all GCP Notebooks resources' Regions policies.

{
  "allOf": [
    {
      "$ref": "gcp#/definitions/regionNameMatcherList"
    },
    {
      "default": [
        "asia-east1",
        "asia-northeast1",
        "asia-southeast1",
        "australia-southeast1",
        "europe-west1",
        "europe-west2",
        "europe-west3",
        "europe-west4",
        "northamerica-northeast1",
        "us-central1",
        "us-east1",
        "us-east4",
        "us-west1"
      ]
    }
  ]
}

GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-notebooks

A calculated policy that Guardrails uses to create a compiled list of ALL permission
levels for GCP Notebooks that is used as input to
the stack that manages the Guardrails IAM permissions objects.

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-notebooks

A calculated policy that Guardrails uses to create a compiled list of ALL
permissions for GCP Notebooks that is used as
input to the control that manages the IAM stack.