Delete the GCP DNS policy from the cloud provider, as well as the CMDB.


GCP > DNS > Policy

dnsPolicy

GCP > DNS > Policy > Delete

Process events for GCP DNS service Policy resources.

The router receives events from the event handler and creates, updates, or deletes Policy resources in the CMDB.


project

GCP > DNS > Policy > Router

GCP > DNS > Policy > Update Logging

Configure whether the GCP DNS API is enabled.


GCP > DNS

GCP > DNS > Set API Enabled

Delete the GCP DNS managed zone from the cloud provider, as well as the CMDB.


GCP > DNS > Managed Zone

managedZone

GCP > DNS > Managed Zone > Delete

Process events for GCP DNS service Managed Zone resources.
The router receives events from the event handler and creates, updates, or deletes Managed Zone resources in the CMDB.


GCP > DNS > Managed Zone > Router

Update the labels for GCP DNS managed zone.


GCP > DNS > Managed Zone > Set Labels

Update DNS Managed Zone's DNSSEC Configuration.


GCP > DNS > Managed Zone > Update DNSSEC Configuration

Check whether GCP DNS API is enabled.&#92;n&#92;nAPI Enabled refers specifically to the API state of a service in a cloud project. This control determines whether the API state is set as per desired level.&#92;n&#92;nThe `GCP &gt; DNS &gt; API Enabled` control compares the API state against the API Enabled policies, raises an alarm, and takes the defined enforcement action.&#92;n

GCP > DNS > API Enabled

Record and synchronize details for the GCP DNS into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > DNS > CMDB

Discover GCP DNS resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > Project

GCP > DNS > Discovery

Take an action when an GCP DNS policy is not active based on the&#92;n`GCP &gt; DNS &gt; Policy &gt; Active &gt; *` policies.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; DNS &gt; Policy &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > DNS > Policy > Active

Take an action when a GCP DNS policy is not approved based on `GCP &gt; DNS &gt; Policy &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > DNS > Policy > Approved

Record and synchronize details for the GCP DNS policy into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > DNS > Policy > CMDB

Discover GCP DNS policy resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > DNS > Policy > Discovery

Determine whether to check or enforce Logging for the GCP DNS Policy.&#92;n

GCP > DNS > Policy > Logging

The Usage control determines whether the number of GCP DNS policy resources exceeds the configured usage limit for this project.&#92;nYou can configure the behavior of this control with the  `GCP &gt; DNS &gt; Policy &gt; Usage` policy, and set the limit with the `GCP &gt; DNS &gt; Policy &gt; Usage &gt; Limit` policy.&#92;n

GCP > DNS > Policy > Usage

Take an action when an GCP DNS managed zone is not active based on the&#92;n`GCP &gt; DNS &gt; Managed Zone &gt; Active &gt; *` policies.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; DNS &gt; Managed Zone &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > DNS > Managed Zone > Active

Take an action when a GCP DNS managed zone is not approved based on `GCP &gt; DNS &gt; Managed Zone &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > DNS > Managed Zone > Approved

Record and synchronize details for the GCP DNS managed zone into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > DNS > Managed Zone > CMDB

Discover GCP DNS managed zone resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > DNS > Managed Zone > Discovery

Determine whether to check or enforce DNSSEC Configuration settings for the GCP Managed Zone.&#92;n

GCP > DNS > Managed Zone > DNSSEC Configuration

Take an action when an GCP DNS managed zone labels is not updated based on the `GCP &gt; DNS &gt; Managed Zone &gt; Labels &gt; *` policies.&#92;n&#92;nIf the resource is not updated with the labels defined in `GCP &gt; DNS &gt; Managed Zone &gt; Labels &gt; Template`, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

GCP > DNS > Managed Zone > Labels

The Usage control determines whether the number of GCP DNS managed zone resources exceeds the configured usage limit for this project.&#92;nYou can configure the behavior of this control with the  `GCP &gt; DNS &gt; Managed Zone &gt; Usage` policy, and set the limit with the `GCP &gt; DNS &gt; Managed Zone &gt; Usage &gt; Limit` policy.&#92;n

GCP > DNS > Managed Zone > Usage

Parameters for DnsKey key generation. Used for generating initial keys for a new ManagedZone and as default when adding a new DnsKey.

String mnemonic specifying the DNSSEC algorithm of this key.

Specifies whether this is a key signing key (KSK) or a zone signing key (ZSK). Key signing keys have the Secure Entry Point flag set and, when active, are only used to sign resource record sets of type DNSKEY. Zone signing keys do not have the Secure Entry Point flag set and are used to sign all other types of resource record sets.

DnsKeySpec

A zone is a subtree of the DNS namespace under one administrative responsibility. A ManagedZone is a resource that represents a DNS zone hosted by the Cloud DNS service.

The time that this resource was created on the server. This is in RFC3339 text format. Output only.

A mutable string of at most 1024 characters associated with this resource for the user's convenience. Has no effect on the managed zone's function.

The DNS name of this managed zone, for instance "example.com.".

The presence for this field indicates that outbound forwarding is enabled for this zone. The value of this field contains the set of destinations to forward to.

Unique identifier for the resource; defined by the server (output only)

User assigned name for this resource. Must be unique within the project. The name must be 1-63 characters long, must begin with a letter, end with a letter or digit, and only contain lowercase letters, digits or dashes.

Optionally specifies the NameServerSet for this ManagedZone. A NameServerSet is a set of DNS name servers that all host the same ManagedZones. Most users leave this field unset. If you need to use this field, contact your account team.

Delegate your managed_zone to these virtual name servers; defined by the server (output only)

The presence of this field indicates that DNS Peering is enabled for this zone. The value of this field contains the network to peer with.

For privately visible zones, the set of Virtual Private Cloud resources that the zone is visible from.

The presence of this field indicates that this is a managed reverse lookup zone and Cloud DNS resolves reverse lookup queries using automatically configured records for VPC resources. This only applies to networks listed under private_visibility_config.

This field links to the associated service directory namespace. Do not set this field for public zones or forwarding zones.

The zone's visibility: public zones are exposed to the Internet, while private zones are visible only to Virtual Private Cloud resources.

ManagedZone

Cloud Logging configurations for publicly visible zones.

If set, enable query logging for this ManagedZone. False by default, making logging opt-in.

ManagedZoneCloudLoggingConfig

Specifies parameters for generating initial DnsKeys for this ManagedZone. Can only be changed while the state is OFF.

Specifies the mechanism for authenticated denial-of-existence responses. Can only be changed while the state is OFF.

Specifies whether DNSSEC is enabled, and what mode it is in.

ManagedZoneDnsSecConfig

List of target name servers to forward to. Cloud DNS selects the best available name server if more than one target is given.

ManagedZoneForwardingConfig

Forwarding path for this NameServerTarget. If unset or set to DEFAULT, Cloud DNS makes forwarding decisions based on IP address ranges; that is, RFC1918 addresses go to the VPC network, non-RFC1918 addresses go to the internet. When set to PRIVATE, Cloud DNS always sends queries through the VPC network for this target.

IPv6 address of a target name server. Does not accept both fields (ipv4 & ipv6) being populated. Public preview as of November 2022.

ManagedZoneForwardingConfigNameServerTarget

ManagedZonePeeringConfig

The time at which the zone was deactivated, in RFC 3339 date-time format. An empty string indicates that the peering connection is active. The producer network can deactivate a zone. The zone is automatically deactivated if the producer network that the zone targeted is deleted. Output only.

The fully qualified URL of the VPC network to forward queries to. This should be formatted like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}

ManagedZonePeeringConfigTargetNetwork

The list of Google Kubernetes Engine clusters that can see this zone.

The list of VPC networks that can see this zone.

ManagedZonePrivateVisibilityConfig

The resource name of the cluster to bind this ManagedZone to. This should be specified in the format like: projects/*/locations/*/clusters/*. This is referenced from GKE projects.locations.clusters.get API: https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters/get

ManagedZonePrivateVisibilityConfigGKECluster

The fully qualified URL of the VPC network to bind to. Format this URL like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}

ManagedZonePrivateVisibilityConfigNetwork

ManagedZoneReverseLookupConfig

Contains information about Service Directory-backed zones.

Contains information about the namespace associated with the zone.

ManagedZoneServiceDirectoryConfig

The time that the namespace backing this zone was deleted; an empty string if it still exists. This is in RFC3339 text format. Output only.

The fully qualified URL of the namespace associated with the zone. Format must be https://servicedirectory.googleapis.com/v1/projects/{project}/locations/{location}/namespaces/{namespace}

ManagedZoneServiceDirectoryConfigNamespace

algorithm

alternativeNameServerConfig

defaultKeySpecs

defaultKeySpecsItems

dnsAka

dnsName

test01

dnssecConfig

dnssecConfigNonExistence

keyType

managedZoneAka

managedZoneServiceNow

policyAka

invalid - upper case letters are not allowed

policyName

targetNameServers

zoneName

zoneState

zoneVisibility

gcp-dns

Configure whether to record and synchronize details for the GCP DNS dns into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; DNS &gt; DNS &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

GCP > DNS > Enabled

A GCP logs [advanced filter](https://cloud.google.com/logging/docs/view/advanced-filters)&#92;nused to specify a subset of log entries that will be forwarded by the logging sink on behalf of the gcp-dns mod.&#92;nThis is a read-only policy that is used internally by Guardrails.&#92;n

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-dns

A template used to generate the keys and values for GCP DNS resources.&#92;n&#92;nBy default, all DNS resource Labels &gt; Template policies will use this value.&#92;n

GCP > DNS > Labels Template [Default]

Configure whether permissions policies are in effect for GCP DNS.&#92;nThis setting does not affect Project level permissions (GCP/Admin, GCP/Owner, etc).&#92;n&#92;n**Note:** The behavior of this policy depends on the value of GCP &gt; Permissions.&#92;n

GCP > DNS > Permissions

Define the permissions levels that can be used to grant access to DNS&#92;nan GCP project. Permissions levels defined will appear in the UI to assign access to Guardrails users.&#92;n&#92;n**Note:** Some services do not use all permissions levels, and any permissions level that has&#92;nno permissions associated will not be created even if it is selected here.&#92;n

GCP > DNS > Permissions > Levels

A map of GCP API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of GCP API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the metadata level, it is also added&#92;n to readOnly, operator and admin. Modifier policies set here will “roll up” to the GCP level too - if&#92;n you add a permission to Admin, it will be granted to GCP/Storage/Admin and also GCP/Admin&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;storage.bucket.create&quot;: admin&#92;n  - &quot;sql.database.create&quot;: metadata&#92;n```&#92;n

GCP > DNS > Permissions > Levels > Modifiers

Determine the action to take when an GCP DNS policy, based on the `GCP &gt; DNS &gt; Policy &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; DNS &gt; Policy &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The age after which the GCP DNS policy&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; DNS &gt; Policy &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > DNS > Policy > Active > Age

The number of days since the GCP DNS policy was last modified before it is considered&#92;ninactive.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; DNS &gt; Policy &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n

GCP > DNS > Policy > Active > Last Modified

Determine the action to take when a GCP DNS policy is not approved based on `GCP &gt; DNS &gt; Policy &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP DNS policy is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If a GCP DNS policy is not approved, it will be subject to the action specified in the `GCP &gt; DNS &gt; Policy &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

string

GCP > DNS > Policy > Approved > Custom

Determine whether the GCP DNS policy is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP DNS policy is not approved, it will be subject to the action specified in the `GCP &gt; DNS &gt; Policy &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > DNS > Policy > Approved > Usage

Configure whether to record and synchronize details for the GCP DNS policy into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

gcp_dns_dns_policy_logging

GCP CIS v2.0.0 - Section 2 - Logging and Monitoring

Configure the number of GCP DNS policys that can be used for this project and the current consumption against the limit.&#92;nYou can configure the behavior of the control with this  `GCP &gt; DNS &gt; Policy &gt; Usage` policy.&#92;n

Maximum number of items that can be created for this project&#92;n

GCP > DNS > Policy > Usage > Limit

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermissions for GCP DNS that is used as&#92;ninput to the control that manages the IAM stack.&#92;n

GCP > Turbot > Permissions > Compiled > Service Permissions

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-dns

A calculated policy that Guardrails uses to create a compiled list of ALL permission&#92;nlevels for GCP DNS that is used as input to&#92;nthe stack that manages the Guardrails IAM permissions objects.&#92;n

GCP > Turbot > Permissions > Compiled > Levels

GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-dns

Determine the action to take when an GCP DNS managed zone, based on the `GCP &gt; DNS &gt; Managed Zone &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; DNS &gt; Managed Zone &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The age after which the GCP DNS managed zone&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; DNS &gt; Managed Zone &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > DNS > Managed Zone > Active > Age

The number of days since the GCP DNS managed zone was last modified before it is considered&#92;ninactive.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; DNS &gt; Managed Zone &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n

GCP > DNS > Managed Zone > Active > Last Modified

Determine the action to take when a GCP DNS managed zone is not approved based on `GCP &gt; DNS &gt; Managed Zone &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

gcp_dns_managed_zone_approved

GCP CIS v2.0.0 - Section 3 - Networking

Determine whether the GCP DNS managed zone is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If a GCP DNS managed zone is not approved, it will be subject to the action specified in the `GCP &gt; DNS &gt; Managed Zone &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

gcp_dns_managed_zone_approved_custom

GCP > DNS > Managed Zone > Approved > Custom

Determine whether the GCP DNS managed zone is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP DNS managed zone is not approved, it will be subject to the action specified in the `GCP &gt; DNS &gt; Managed Zone &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > DNS > Managed Zone > Approved > Usage

Configure whether to record and synchronize details for the GCP DNS managed zone into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

gcp_dns_managed_zone_dnssec_configuration

Determine the action to take when an GCP DNS managed zone labels are not updated based on the `GCP &gt; DNS &gt; Managed Zone &gt; Labels &gt; *` policies.&#92;n&#92;nThe control ensure GCP DNS managed zone labels include labels defined in `GCP &gt; DNS &gt; Managed Zone &gt; Labels &gt; Template`.&#92;n&#92;nLabels not defined in Managed Zone Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

The template is used to generate the keys and values for GCP DNS managed zone.&#92;n&#92;nLabels not defined in Managed Zone Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

GCP > DNS > Managed Zone > Labels > Template

Configure the number of GCP DNS managed zones that can be used for this project and the current consumption against the limit.&#92;nYou can configure the behavior of the control with this  `GCP &gt; DNS &gt; Managed Zone &gt; Usage` policy.&#92;n

Mod: gcp-dns

Recommended Version

Resource Types

Controls

IAM Roles

Policies

Policy Packs