Check whether GCP Build Service API is enabled.&#92;n&#92;nAPI Enabled refers specifically to the API state of a service in a cloud project.&#92;nThis control determines whether the API state is set as per desired level.&#92;n&#92;nThe `GCP &gt; Build Service &gt; API Enabled` control compares&#92;nthe API state against the API Enabled policies,&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

GCP > Build

GCP > Build > API Enabled

Record and synchronize details for the GCP Build into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > Build > CMDB

Discover GCP Build resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > Project

GCP > Build > Discovery

projects/932405488407/services/cloudbuild.googleapis.com

Build Service

buildService

buildServiceAka

buildServiceName

buildSupportedRegions

regionName

gcp-build

A list of GCP regions in which GCP Build resources are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP Build resources&#39; Approved &gt; Regions policies.&#92;n

GCP > Build > Approved Regions [Default]

Configure whether to record and synchronize details for the GCP Build build into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; Build &gt; Build &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

GCP > Build > Enabled

A template used to generate the keys and values for GCP Build Service resources.&#92;n&#92;nBy default, all Build Service resource Labels &gt; Template policies will use this value.&#92;n

GCP > Build > Labels Template [Default]

GCP > Build > Permissions > Levels

Configure whether permissions policies are in effect for GCP Build Service.&#92;nThis setting does not affect Project level permissions (GCP/Admin, GCP/Owner, etc).&#92;n&#92;n**Note:** The behavior of this policy depends on the value of GCP &gt; Permissions.&#92;n

GCP > Build > Permissions

GCP > Build > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to Build Service&#92;nan GCP project. Permissions levels defined will appear in the UI to assign access to Guardrails users.&#92;n&#92;n**Note:** Some services do not use all permissions levels, and any permissions level that has&#92;nno permissions associated will not be created even if it is selected here.&#92;n

A map of GCP API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of GCP API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the metadata level, it is also added&#92;n to readOnly, operator and admin. Modifier policies set here will “roll up” to the GCP level too - if&#92;n you add a permission to Admin, it will be granted to GCP/Storage/Admin and also GCP/Admin&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;storage.bucket.create&quot;: admin&#92;n  - &quot;sql.database.create&quot;: metadata&#92;n```&#92;n

A list of GCP regions in which GCP Build resources are supported for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP Build resources&#39; Regions policies.&#92;n

GCP > Build > Regions

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermissions for GCP Build Service that is used as&#92;ninput to the control that manages the IAM stack.&#92;n

GCP > Turbot > Permissions > Compiled > Service Permissions

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-build

A calculated policy that Guardrails uses to create a compiled list of ALL permission&#92;nlevels for GCP Build Service that is used as input to&#92;nthe stack that manages the Guardrails IAM permissions objects.&#92;n

Mod: gcp-build

Recommended Version

Resource Types

Controls

IAM Roles

Policies