Check whether GCP Composer API is enabled.&#92;n&#92;nAPI Enabled refers specifically to the API state of a service in a cloud project.&#92;nThis control determines whether the API state is set as per desired level.&#92;n&#92;nThe `GCP &gt; Composer &gt; API Enabled` control compares&#92;nthe API state against the API Enabled policies,&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

GCP > Composer

GCP > Composer > API Enabled

Record and synchronize details for the GCP Composer into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > Composer > CMDB

Discover GCP Composer resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > Project

GCP > Composer > Discovery

Take an action when an GCP Composer environment is not active based on the&#92;n`GCP &gt; Composer &gt; Environment &gt; Active &gt; *` policies.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Composer &gt; Environment &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > Composer > Environment

GCP > Composer > Environment > Active

GCP > Composer > Environment > Active > Age

GCP > Composer > Environment > Active > Last Modified

Take an action when a GCP Composer environment is not approved based on `GCP &gt; Composer &gt; Environment &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > Composer > Environment > Approved

GCP > Composer > Environment > Approved > Custom

GCP > Composer > Environment > Approved > Regions

GCP > Composer > Environment > Approved > Usage

Record and synchronize details for the GCP Composer environment into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If&#92;nregion is not in `GCP &gt; Composer &gt; Environment &gt; Regions` policy, the CMDB control will delete the&#92;nresource from the CMDB.&#92;n

GCP > Composer > Environment > CMDB

Discover GCP Composer environment resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy&#92;nassociated with the resource. If the region is not in `GCP &gt; Composer &gt; Environment &gt; Regions` policy, the CMDB&#92;ncontrol will delete the resource from the CMDB.&#92;n

GCP > Region

GCP > Composer > Environment > Discovery

Take an action when an GCP Composer environment labels is not updated based on the `GCP &gt; Composer &gt; Environment &gt; Labels &gt; *` policies.&#92;n&#92;nIf the resource is not updated with the labels defined in `GCP &gt; Composer &gt; Environment &gt; Labels &gt; Template`, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

GCP > Composer > Environment > Labels

GCP > Composer > Environment > Labels > Template

The Usage control determines whether the number of GCP Composer environment resources exceeds the configured usage limit for this region.&#92;n&#92;nYou can configure the behavior of this control with the  `GCP &gt; Composer &gt; Environment &gt; Usage` policy, and set the limit with the `GCP &gt; Composer &gt; Environment &gt; Usage &gt; Limit` policy.&#92;n

GCP > Composer > Environment > Usage

GCP > Composer > Environment > Usage > Limit

Allowed IP range with user-provided description.

Optional. User-provided description. It must contain at most 300 characters.

IP address or range, defined using CIDR notation, of requests that this rule applies to. Examples: `192.168.1.1` or `192.168.0.0/16` or `2001:db8::/32` or `2001:0db8:0000:0042:0000:8a2e:0370:7334`. IP range prefixes should be properly truncated. For example, `1.2.3.4/24` should be truncated to `1.2.3.0/24`. Similarly, for IPv6, `2001:db8::1/32` should be truncated to `2001:db8::/32`.

AllowedIpRange

CIDR block that must be specified in CIDR notation.

User-defined name that identifies the CIDR block.

CidrBlock

Configuration for Cloud Data Lineage integration.

Optional. Whether or not Cloud Data Lineage integration is enabled.

CloudDataLineageIntegration

Configuration for resources used by Airflow DAG processors.

Optional. The number of DAG processors. If not provided or set to 0, a single DAG processor instance will be created.

Optional. CPU request and limit for a single Airflow DAG processor replica.

Optional. Memory (GB) request and limit for a single Airflow DAG processor replica.

Optional. Storage (GB) request and limit for a single Airflow DAG processor replica.

DagProcessorResource

The configuration setting for Airflow database data retention mechanism.

Optional. The configuration settings for task logs retention

DataRetentionConfig

The configuration of Cloud SQL instance that is used by the Apache Airflow software.

Optional. Cloud SQL machine type used by Airflow database. It has to be one of: db-n1-standard-2, db-n1-standard-4, db-n1-standard-8 or db-n1-standard-16. If not specified, db-n1-standard-2 will be used. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

Optional. The Compute Engine zone where the Airflow database is created. If zone is provided, it must be in the region selected for the environment. If zone is not provided, a zone is automatically selected. The zone can only be set during environment creation. Supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.*.

DatabaseConfig

The encryption options for the Cloud Composer environment and its dependencies.Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

Optional. Customer-managed Encryption Key available through Google's Key Management Service. Cannot be updated. If not specified, Google-managed key will be used.

EncryptionConfig

An environment for running orchestration tasks.

Output only. The time at which this environment was created.

Optional. User-defined labels for this environment. The labels map can contain no more than 64 entries. Entries of the labels map are UTF8 strings that comply with the following restrictions: * Keys must conform to regexp: \p{Ll}\p{Lo}{0,62} * Values must conform to regexp: [\p{Ll}\p{Lo}\p{N}_-]{0,63} * Both keys and values are additionally constrained to be <= 128 bytes in size.

The resource name of the environment, in the form: "projects/{projectId}/locations/{locationId}/environments/{environmentId}" EnvironmentId must start with a lowercase letter followed by up to 63 lowercase letters, numbers, or hyphens, and cannot end with a hyphen.

Optional. Storage configuration for this environment.

Output only. The time at which this environment was last modified.

Output only. The UUID (Universally Unique IDentifier) associated with this environment. This value is generated when the environment is created.

Environment

Configuration information for an environment.

Output only. The 'bring your own identity' variant of the URI of the Apache Airflow Web UI hosted within this environment, to be accessed with external identities using workforce identity federation (see [Access environments with workforce identity federation](/composer/docs/composer-2/access-environments-with-workforce-identity-federation)).

Output only. The URI of the Apache Airflow Web UI hosted within this environment (see [Airflow web interface](/composer/docs/how-to/accessing/airflow-web-interface)).

Output only. The Cloud Storage prefix of the DAGs for this environment. Although Cloud Storage objects reside in a flat namespace, a hierarchical file tree can be simulated using "/"-delimited object name prefixes. DAG objects for this environment reside in a simulated directory with the given prefix.

Optional. The configuration setting for Airflow database data retention mechanism.

Optional. The configuration settings for Cloud SQL instance used internally by Apache Airflow software.

Optional. The encryption options for the Cloud Composer environment and its dependencies. Cannot be updated.

Optional. The size of the Cloud Composer environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.

Output only. The Kubernetes Engine cluster used to run this environment.

Optional. The maintenance window is the period when Cloud Composer components may undergo maintenance. It is defined so that maintenance is not executed during peak hours or critical time periods. The system will not be under maintenance for every occurrence of this window, but when maintenance is planned, it will be scheduled during the window. The maintenance window period must encompass at least 12 hours per week. This may be split into multiple chunks, each with a size of at least 4 hours. If this value is omitted, the default value for maintenance window will be applied. The default value is Saturday and Sunday 00-06 GMT.

Optional. The configuration options for GKE cluster master authorized networks. By default master authorized networks feature is: - in case of private environment: enabled with no external networks allowlisted. - in case of public environment: disabled.

The configuration used for the Kubernetes Engine cluster.

The number of nodes in the Kubernetes Engine cluster that will be used to run this environment. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

The configuration used for the Private IP Cloud Composer environment.

Optional. The Recovery settings configuration of an environment. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.

Optional. Resilience mode of the Cloud Composer Environment. This field is supported for Cloud Composer environments in versions composer-2.2.0-airflow-*.*.* and newer.

The configuration settings for software inside the environment.

Optional. The configuration settings for the Airflow web server App Engine instance.

Optional. The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions will be applied.

Optional. The workloads configuration settings for the GKE cluster associated with the Cloud Composer environment. The GKE cluster runs Airflow scheduler, web server and workers workloads. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.

EnvironmentConfig

Configuration for controlling how IPs are allocated in the GKE cluster running the Apache Airflow software.

Optional. The IP address range used to allocate IP addresses to pods in the GKE cluster. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.

Optional. The name of the GKE cluster's secondary range used to allocate IP addresses to pods. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.

Optional. The IP address range of the services IP addresses in this GKE cluster. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true. Set to blank to have GKE choose a range with the default size. Set to /netmask (e.g. `/14`) to have GKE choose a range with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.

Optional. The name of the services' secondary range used to allocate IP addresses to the GKE cluster. For Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*, this field is applicable only when `use_ip_aliases` is true.

Optional. Whether or not to enable Alias IPs in the GKE cluster. If `true`, a VPC-native cluster is created. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use VPC-native GKE clusters.

IPAllocationPolicy

The configuration settings for Cloud Composer maintenance window. The following example: ``` { "startTime":"2019-08-01T01:00:00Z" "endTime":"2019-08-01T07:00:00Z" "recurrence":"FREQ=WEEKLY;BYDAY=TU,WE" } ``` would define a maintenance window between 01 and 07 hours UTC during each Tuesday and Wednesday.

Required. Maintenance window end time. It is used only to calculate the duration of the maintenance window. The value for end-time must be in the future, relative to `start_time`.

Required. Maintenance window recurrence. Format is a subset of [RFC-5545](https://tools.ietf.org/html/rfc5545) `RRULE`. The only allowed values for `FREQ` field are `FREQ=DAILY` and `FREQ=WEEKLY;BYDAY=...` Example values: `FREQ=WEEKLY;BYDAY=TU,WE`, `FREQ=DAILY`.

Required. Start time of the first recurrence of the maintenance window.

MaintenanceWindow

Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs.

Up to 50 external networks that could access Kubernetes master through HTTPS.

Whether or not master authorized networks feature is enabled.

MasterAuthorizedNetworksConfig

Configuration options for networking connections in the Composer 2 environment.

Optional. Indicates the user requested specifc connection type between Tenant and Customer projects. You cannot set networking connection type in public IP environment.

NetworkingConfig

The configuration information for the Kubernetes Engine nodes running the Apache Airflow software.

Optional. The IP range in CIDR notation to use internally by Cloud Composer. IP addresses are not reserved - and the same range can be used by multiple Cloud Composer environments. In case of overlap, IPs from this range will not be accessible in the user's VPC network. Cannot be updated. If not specified, the default value of '100.64.128.0/20' is used. This field is supported for Cloud Composer environments in versions composer-3.*.*-airflow-*.*.* and newer.

Optional. Network Attachment that Cloud Composer environment is connected to, which provides connectivity with a user's VPC network. Takes precedence over network and subnetwork settings. If not provided, but network and subnetwork are defined during environment, it will be provisioned. If not provided and network and subnetwork are also empty, then connectivity to user's VPC network is disabled. Network attachment must be provided in format projects/{project}/regions/{region}/networkAttachments/{networkAttachment}. This field is supported for Cloud Composer environments in versions composer-3.*.*-airflow-*.*.* and newer.

Optional. The disk size in GB used for node VMs. Minimum size is 30GB. If unspecified, defaults to 100GB. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

Optional. Deploys 'ip-masq-agent' daemon set in the GKE cluster and defines nonMasqueradeCIDRs equals to pod IP range so IP masquerading is used for all destination addresses, except between pods traffic. See: https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent

Optional. The configuration for controlling how IPs are allocated in the GKE cluster.

Optional. The Compute Engine [zone](/compute/docs/regions-zones) in which to deploy the VMs used to run the Apache Airflow software, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/zones/{zoneId}". This `location` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.machineType` are specified, `nodeConfig.machineType` must belong to this `location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If only one field (`location` or `nodeConfig.machineType`) is specified, the location information from the specified field will be propagated to the unspecified field. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

Optional. The Compute Engine [machine type](/compute/docs/machine-types) used for cluster instances, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/zones/{zoneId}/machineTypes/{machineTypeId}". The `machineType` must belong to the enclosing environment's project and location. If both this field and `nodeConfig.location` are specified, this `machineType` must belong to the `nodeConfig.location`; if both are unspecified, the service will pick a zone in the Compute Engine region corresponding to the Cloud Composer location, and propagate that choice to both fields. If exactly one of this field and `nodeConfig.location` is specified, the location information from the specified field will be propagated to the unspecified field. The `machineTypeId` must not be a [shared-core machine type](/compute/docs/machine-types#sharedcore). If this field is unspecified, the `machineTypeId` defaults to "n1-standard-1". This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

Optional. The Compute Engine network to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/global/networks/{networkId}". If unspecified, the "default" network ID in the environment's project is used. If a [Custom Subnet Network](/vpc/docs/vpc#vpc_networks_and_subnets) is provided, `nodeConfig.subnetwork` must also be provided. For [Shared VPC](/vpc/docs/shared-vpc) subnetwork requirements, see `nodeConfig.subnetwork`.

Optional. The set of Google API scopes to be made available on all node VMs. If `oauth_scopes` is empty, defaults to ["https://www.googleapis.com/auth/cloud-platform"]. Cannot be updated. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

Optional. The Google Cloud Platform Service Account to be used by the node VMs. If a service account is not specified, the "default" Compute Engine service account is used. Cannot be updated.

Optional. The Compute Engine subnetwork to be used for machine communications, specified as a [relative resource name](/apis/design/resource_names#relative_resource_name). For example: "projects/{projectId}/regions/{regionId}/subnetworks/{subnetworkId}" If a subnetwork is provided, `nodeConfig.network` must also be provided, and the subnetwork must belong to the enclosing environment's project and location.

NodeConfig

Configuration options for the private GKE cluster in a Cloud Composer environment.

Optional. If `true`, access to the public endpoint of the GKE cluster is denied.

Optional. The CIDR block from which IPv4 range for GKE master will be reserved. If left blank, the default value of '172.16.0.0/23' is used.

Output only. The IP range in CIDR notation to use for the hosted master network. This range is used for assigning internal IP addresses to the GKE cluster master or set of masters and to the internal load balancer virtual IP. This range must not overlap with any other ranges in use within the cluster's network.

PrivateClusterConfig

The configuration information for configuring a Private IP Cloud Composer environment.

Optional. When specified, the environment will use Private Service Connect instead of VPC peerings to connect to Cloud SQL in the Tenant Project, and the PSC endpoint in the Customer Project will use an IP address from this subnetwork.

Optional. The CIDR block from which IP range for Cloud Composer Network in tenant project will be reserved. Needs to be disjoint from private_cluster_config.master_ipv4_cidr_block and cloud_sql_ipv4_cidr_block. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.

Output only. The IP range reserved for the tenant project's Cloud Composer network. This field is supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.

Optional. The CIDR block from which IP range in tenant project will be reserved for Cloud SQL. Needs to be disjoint from `web_server_ipv4_cidr_block`.

Optional. If `true`, builds performed during operations that install Python packages have only private connectivity to Google services (including Artifact Registry) and VPC network (if either `NodeConfig.network` and `NodeConfig.subnetwork` fields or `NodeConfig.composer_network_attachment` field are specified). If `false`, the builds also have access to the internet. This field is supported for Cloud Composer environments in versions composer-3.*.*-airflow-*.*.* and newer.

Optional. If `true`, a Private IP Cloud Composer environment is created. If this field is set to true, `IPAllocationPolicy.use_ip_aliases` must be set to true for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

Optional. When enabled, IPs from public (non-RFC1918) ranges can be used for `IPAllocationPolicy.cluster_ipv4_cidr_block` and `IPAllocationPolicy.service_ipv4_cidr_block`.

Optional. Configuration for the network connections configuration in the environment.

Optional. Configuration for the private GKE cluster for a Private IP Cloud Composer environment.

Optional. The CIDR block from which IP range for web server will be reserved. Needs to be disjoint from `private_cluster_config.master_ipv4_cidr_block` and `cloud_sql_ipv4_cidr_block`. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

Output only. The IP range reserved for the tenant project's App Engine VMs. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*.

PrivateEnvironmentConfig

Optional. The configuration for scheduled snapshot creation mechanism.

RecoveryConfig

The configuration for scheduled snapshot creation mechanism.

Optional. Whether scheduled snapshots creation is enabled.

Optional. The cron expression representing the time when snapshots creation mechanism runs. This field is subject to additional validation around frequency of execution.

Optional. The Cloud Storage location for storing automatically created snapshots.

Optional. Time zone that sets the context to interpret snapshot_creation_schedule.

ScheduledSnapshotsConfig

Configuration for resources used by Airflow schedulers.

Optional. CPU request and limit for a single Airflow scheduler replica.

Optional. Memory (GB) request and limit for a single Airflow scheduler replica.

Optional. Storage (GB) request and limit for a single Airflow scheduler replica.

SchedulerResource

Specifies the selection and configuration of software inside the environment.

Optional. Apache Airflow configuration properties to override. Property keys contain the section and property names, separated by a hyphen, for example "core-dags_are_paused_at_creation". Section names must not contain hyphens ("-"), opening square brackets ("["), or closing square brackets ("]"). The property name must not be empty and must not contain an equals sign ("=") or semicolon (";"). Section and property names must not contain a period ("."). Apache Airflow configuration property names must be written in [snake_case](https://en.wikipedia.org/wiki/Snake_case). Property values can contain any character, and can be written in any lower/upper case format. Certain Apache Airflow configuration property values are [blocked](/composer/docs/concepts/airflow-configurations), and cannot be overridden.

Optional. The configuration for Cloud Data Lineage integration.

Optional. Additional environment variables to provide to the Apache Airflow scheduler, worker, and webserver processes. Environment variable names must match the regular expression `a-zA-Z_*`. They cannot specify Apache Airflow software configuration overrides (they cannot match the regular expression `AIRFLOW__[A-Z0-9_]+__[A-Z0-9_]+`), and they cannot match any of the following reserved names: * `AIRFLOW_HOME` * `C_FORCE_ROOT` * `CONTAINER_NAME` * `DAGS_FOLDER` * `GCP_PROJECT` * `GCS_BUCKET` * `GKE_CLUSTER_NAME` * `SQL_DATABASE` * `SQL_INSTANCE` * `SQL_PASSWORD` * `SQL_PROJECT` * `SQL_REGION` * `SQL_USER`

The version of the software running in the environment. This encapsulates both the version of Cloud Composer functionality and the version of Apache Airflow. It must match the regular expression `composer-([0-9]+(\.[0-9]+\.[0-9]+(-preview\.[0-9]+)?)?|latest)-airflow-([0-9]+(\.[0-9]+(\.[0-9]+)?)?)`. When used as input, the server also checks if the provided version is supported and denies the request for an unsupported version. The Cloud Composer portion of the image version is a full [semantic version](https://semver.org), or an alias in the form of major version number or `latest`. When an alias is provided, the server replaces it with the current Cloud Composer version that satisfies the alias. The Apache Airflow portion of the image version is a full semantic version that points to one of the supported Apache Airflow versions, or an alias in the form of only major or major.minor versions specified. When an alias is provided, the server replaces it with the latest Apache Airflow version that satisfies the alias and is supported in the given Cloud Composer version. In all cases, the resolved image version is stored in the same field. See also [version list](/composer/docs/concepts/versioning/composer-versions) and [versioning overview](/composer/docs/concepts/versioning/composer-versioning-overview).

Optional. Custom Python Package Index (PyPI) packages to be installed in the environment. Keys refer to the lowercase package name such as "numpy" and values are the lowercase extras and version specifier such as "==1.12.0", "[devel,gcp_api]", or "[devel]>=1.8.2, <1.9.2". To specify a package without pinning it to a version specifier, use the empty string as the value.

Optional. The major version of Python used to run the Apache Airflow scheduler, worker, and webserver processes. Can be set to '2' or '3'. If not specified, the default is '3'. Cannot be updated. This field is only supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*. Environments in newer versions always use Python major version 3.

Optional. The number of schedulers for Airflow. This field is supported for Cloud Composer environments in versions composer-1.*.*-airflow-2.*.*.

Optional. Whether or not the web server uses custom plugins. If unspecified, the field defaults to `PLUGINS_ENABLED`. This field is supported for Cloud Composer environments in versions composer-3.*.*-airflow-*.*.* and newer.

SoftwareConfig

The configuration for data storage in the environment.

Optional. The name of the Cloud Storage bucket used by the environment. No `gs://` prefix.

StorageConfig

Optional. The mode of storage for Airflow workers task logs. For details, see go/composer-store-task-logs-in-cloud-logging-only-design-doc

TaskLogsRetentionConfig

Configuration for resources used by Airflow triggerers.

Optional. CPU request and limit for a single Airflow triggerer replica.

Optional. Memory (GB) request and limit for a single Airflow triggerer replica.

TriggererResource

The configuration settings for the Airflow web server App Engine instance. Supported for Cloud Composer environments in versions composer-1.*.*-airflow-*.*.*

Optional. Machine type on which Airflow web server is running. It has to be one of: composer-n1-webserver-2, composer-n1-webserver-4 or composer-n1-webserver-8. If not specified, composer-n1-webserver-2 will be used. Value custom is returned only in response, if Airflow web server parameters were manually changed to a non-standard values.

WebServerConfig

Network-level access control policy for the Airflow web server.

A collection of allowed IP ranges with descriptions.

WebServerNetworkAccessControl

Configuration for resources used by Airflow web server.

Optional. CPU request and limit for Airflow web server.

Optional. Memory (GB) request and limit for Airflow web server.

Optional. Storage (GB) request and limit for Airflow web server.

WebServerResource

Configuration for resources used by Airflow workers.

Optional. CPU request and limit for a single Airflow worker replica.

Optional. Maximum number of workers for autoscaling.

Optional. Memory (GB) request and limit for a single Airflow worker replica.

Optional. Minimum number of workers for autoscaling.

Optional. Storage (GB) request and limit for a single Airflow worker replica.

WorkerResource

The Kubernetes workloads configuration for GKE cluster associated with the Cloud Composer environment. Supported for Cloud Composer environments in versions composer-2.*.*-airflow-*.*.* and newer.

Optional. Resources used by Airflow DAG processors. This field is supported for Cloud Composer environments in versions composer-3.*.*-airflow-*.*.* and newer.

Optional. Resources used by Airflow schedulers.

Optional. Resources used by Airflow triggerers.

Optional. Resources used by Airflow web server.

Optional. Resources used by Airflow workers.

WorkloadsConfig

projects/932405488407/services/composer.googleapis.com

Google Cloud Composer API

composer

composerAka

composerName

gcp-composer

A list of GCP regions in which GCP Composer resources are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP Composer resources&#39; Approved &gt; Regions policies.&#92;n

GCP > Composer > Approved Regions [Default]

Configure whether to record and synchronize details for the GCP Composer composer into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; Composer &gt; Composer &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

GCP logs [advanced filter](https://cloud.google.com/logging/docs/view/advanced-filters)&#92;nused to specify a subset of log entries that is forwarded to the Guardrails Event Handlers&#92;nby the logging sink on behalf of GCP Composer.&#92;n

Mod: gcp-composer

Recommended Version

Resource Types

Controls

IAM Roles

Policies