Take an action when a GCP KMS crypto key is not approved based on `GCP &gt; KMS &gt; Crypto Key &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > KMS > Crypto Key

GCP > KMS > Crypto Key > Approved

GCP > KMS > Crypto Key > Approved > Custom

GCP > KMS > Crypto Key > Approved > Regions

GCP > KMS > Crypto Key > Approved > Usage

Record and synchronize details for the GCP KMS crypto key into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If&#92;nregion is not in `GCP &gt; KMS &gt; Crypto Key &gt; Regions` policy, the CMDB control will delete the&#92;nresource from the CMDB.&#92;n

GCP > KMS > Crypto Key > CMDB

Discover GCP KMS crypto key resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy&#92;nassociated with the resource. If the region is not in `GCP &gt; KMS &gt; Crypto Key &gt; Regions` policy, the CMDB&#92;ncontrol will delete the resource from the CMDB.&#92;n

GCP > KMS > Key Ring

GCP > KMS > Crypto Key > Discovery

Take an action when an GCP KMS crypto key labels is not updated based on the `GCP &gt; KMS &gt; Crypto Key &gt; Labels &gt; *` policies.&#92;n&#92;nIf the resource is not updated with the labels defined in `GCP &gt; KMS &gt; Crypto Key &gt; Labels &gt; Template`, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

GCP > KMS > Crypto Key > Labels

GCP > KMS > Crypto Key > Labels > Template

GCP > KMS > Crypto Key > Policy

GCP > KMS > Crypto Key > Policy > Trusted Access

GCP > KMS > Crypto Key > Policy > Trusted Access > All Authenticated

GCP > KMS > Crypto Key > Policy > Trusted Access > All Users

GCP > KMS > Crypto Key > Policy > Trusted Access > Domains

GCP > KMS > Crypto Key > Policy > Trusted Access > Groups

GCP > KMS > Crypto Key > Policy > Trusted Access > Service Accounts

GCP > KMS > Crypto Key > Policy > Trusted Access > Users

Take an action when GCP KMS Crypto Key policy is not trusted based on the&#92;n`GCP &gt; KMS &gt; Crypto Key &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the IAM policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc)., this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

Record and synchronize details for the GCP KMS key ring into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If&#92;nregion is not in `GCP &gt; KMS &gt; Key Ring &gt; Regions` policy, the CMDB control will delete the&#92;nresource from the CMDB.&#92;n

GCP > KMS > Key Ring > CMDB

Discover GCP KMS key ring resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy&#92;nassociated with the resource. If the region is not in `GCP &gt; KMS &gt; Key Ring &gt; Regions` policy, the CMDB&#92;ncontrol will delete the resource from the CMDB.&#92;n

GCP > Region

GCP > Multi-Region

GCP > Global Region

GCP > KMS > Key Ring > Discovery

GCP > KMS > Key Ring > Policy

GCP > KMS > Key Ring > Policy > Trusted Access

GCP > KMS > Key Ring > Policy > Trusted Access > All Authenticated

GCP > KMS > Key Ring > Policy > Trusted Access > All Users

GCP > KMS > Key Ring > Policy > Trusted Access > Domains

GCP > KMS > Key Ring > Policy > Trusted Access > Groups

GCP > KMS > Key Ring > Policy > Trusted Access > Service Accounts

GCP > KMS > Key Ring > Policy > Trusted Access > Users

Take an action when GCP KMS Key Ring policy is not trusted based on the&#92;n`GCP &gt; KMS &gt; Key Ring &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the IAM policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc)., this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

Check whether GCP KMS API is enabled.&#92;n&#92;nAPI Enabled refers specifically to the API state of a service in a cloud project.&#92;nThis control determines whether the API state is set as per desired level.&#92;n&#92;nThe `GCP &gt; KMS &gt; API Enabled` control compares&#92;nthe API state against the API Enabled policies,&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

GCP > KMS

GCP > KMS > API Enabled

Record and synchronize details for the GCP KMS into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > KMS > CMDB

Discover GCP KMS resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > Project

GCP > KMS > Discovery

projects/cse-legolas-2/locations/asia-south1/keyRings/test-key/cryptoKeys/test

cryptoKey

cryptoKeyAka

cryptoKeyName

cryptoKeyServiceNow

projects/cse-legolas-2/locations/asia-south1/keyRings/test-key

keyRing

keyRingAka

keyRingName

keyRingServiceNow

projects/932405488407/services/cloudkms.googleapis.com

Cloud Functions API

kmsAka

kmsName

kmsSupportedRegions

regionName

gcp-kms

Determine the action to take when a GCP KMS crypto key is not approved based on `GCP &gt; KMS &gt; Crypto Key &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

gcp_kms_crypto_key_approved

GCP CIS v2.0.0 - Section 1 - Identity and Access Management

Check If GCP KMS Crypto Keys Are Rotated Regularly

Determine whether the GCP KMS crypto key is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If a GCP KMS crypto key is not approved, it will be subject to the action specified in the `GCP &gt; KMS &gt; Crypto Key &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

gcp_kms_crypto_key_approved_custom

string

A list of GCP regions in which GCP KMS crypto keys are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP KMS crypto key is created in a region that is not in the approved list, it will be subject to the action specified in the `GCP &gt; KMS &gt; Crypto Key &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP KMS crypto key is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP KMS crypto key is not approved, it will be subject to the action specified in the `GCP &gt; KMS &gt; Crypto Key &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the GCP KMS crypto key into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; KMS &gt; Crypto Key &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

Determine the action to take when an GCP KMS crypto key labels are not updated based on the `GCP &gt; KMS &gt; Crypto Key &gt; Labels &gt; *` policies.&#92;n&#92;nThe control ensure GCP KMS crypto key labels include labels defined in `GCP &gt; KMS &gt; Crypto Key &gt; Labels &gt; Template`.&#92;n&#92;nLabels not defined in Crypto Key Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

The template is used to generate the keys and values for GCP KMS crypto key.&#92;n&#92;nLabels not defined in Crypto Key Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

Check or Enforce access checking on the GCP KMS Crypto Key policy.&#92;n&#92;nGoogle Cloud IAM allows you to control who has access to the&#92;nkms crypto key via an IAM Policy. The Trusted Access policy&#92;nallows you to configure whether Guardrails will evaluate or&#92;nenforce restrictions on which members are allowed to be granted&#92;naccess.&#92;n&#92;nIf enabled, the members in the IAM policy will be evaluated&#92;nagainst the list of allowed members in each of the Trusted&#92;nAccess sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc).&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

gcp_kms_crypto_key_policy_trusted_access

Enforce GCP KMS Crypto Keys Are Not Publicly Accessible

Determine whether public access may be granted on GCP KMS Crypto Key policy.&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether grants to `allAuthenticatedUsers` is allowed.&#92;n

gcp_kms_crypto_key_policy_trusted_access_all_authenticated

Determine whether anonymous access may be granted on GCP KMS Crypto Key policy.&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether grants to `allUsers` is allowed.&#92;n

gcp_kms_crypto_key_policy_trusted_access_all_users

List of GCP Domains that are trusted for access in the GCP KMS Crypto Key policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

List of GCP Groups that are trusted for access in the GCP KMS Crypto Key policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

List of GCP Service Accounts that are trusted for access in the GCP KMS Crypto Key policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

List of GCP Users that are trusted for access in the GCP KMS Crypto Key policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

A list of GCP regions in which GCP KMS crypto keys are supported for use.&#92;n&#92;nAny crypto keys in a region not listed here will not be recorded in CMDB.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n

GCP > KMS > Crypto Key > Regions

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermissions for GCP KMS that is used as&#92;ninput to the control that manages the IAM stack.&#92;n

GCP > Turbot > Permissions > Compiled > Service Permissions

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-kms

A calculated policy that Guardrails uses to create a compiled list of ALL permission&#92;nlevels for GCP KMS that is used as input to&#92;nthe stack that manages the Guardrails IAM permissions objects.&#92;n

GCP > Turbot > Permissions > Compiled > Levels

GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-kms

Configure whether to record and synchronize details for the GCP KMS key ring into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; KMS &gt; Key Ring &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

Check or Enforce access checking on the GCP KMS Key Ring policy.&#92;n&#92;nGoogle Cloud IAM allows you to control who has access to the&#92;nkms key ring via an IAM Policy. The Trusted Access policy&#92;nallows you to configure whether Guardrails will evaluate or&#92;nenforce restrictions on which members are allowed to be granted&#92;naccess.&#92;n&#92;nIf enabled, the members in the IAM policy will be evaluated&#92;nagainst the list of allowed members in each of the Trusted&#92;nAccess sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc).&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

Determine whether public access may be granted on GCP KMS Key Ring policy.&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether grants to `allAuthenticatedUsers` is allowed.&#92;n

Determine whether anonymous access may be granted on GCP KMS Key Ring policy.&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether grants to `allUsers` is allowed.&#92;n

List of GCP Domains that are trusted for access in the GCP KMS Key Ring policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

List of GCP Groups that are trusted for access in the GCP KMS Key Ring policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

List of GCP Service Accounts that are trusted for access in the GCP KMS Key Ring policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

List of GCP Users that are trusted for access in the GCP KMS Key Ring policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

A list of GCP regions in which GCP KMS key rings are supported for use.&#92;n&#92;nAny key rings in a region not listed here will not be recorded in CMDB.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n

GCP > KMS > Key Ring > Regions

A list of GCP regions in which GCP KMS resources are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP KMS resources&#39; Approved &gt; Regions policies.&#92;n

GCP > KMS > Approved Regions [Default]

Record and synchronize details for GCP KMS Kms(s) into the CMDB.

GCP > KMS > Enabled

A GCP logs [advanced filter](https://cloud.google.com/logging/docs/view/advanced-filters)&#92;nused to specify a subset of log entries that will be forwarded by the&#92;nlogging sink on behalf of the gcp-kms mod&#92;n&#92;nThis is a read-only policy that is used internally by Turbot&#92;n

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-kms

A template used to generate the keys and values for GCP KMS resources.&#92;n&#92;nBy default, all KMS resource Labels &gt; Template policies will use this value.&#92;n

GCP > KMS > Labels Template [Default]

GCP > KMS > Permissions > Levels

Configure whether permissions policies are in effect for GCP KMS.&#92;nThis setting does not affect Project level permissions (GCP/Admin, GCP/Owner, etc).&#92;n&#92;n**Note:** The behavior of this policy depends on the value of GCP &gt; Permissions.&#92;n

GCP > KMS > Permissions

GCP > KMS > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to KMS&#92;nan GCP project. Permissions levels defined will appear in the UI to assign access to Guardrails users.&#92;n&#92;n**Note:** Some services do not use all permissions levels, and any permissions level that has&#92;nno permissions associated will not be created even if it is selected here.&#92;n

A map of GCP API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of GCP API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the metadata level, it is also added&#92;n to readOnly, operator and admin. Modifier policies set here will “roll up” to the GCP level too - if&#92;n you add a permission to Admin, it will be granted to GCP/Storage/Admin and also GCP/Admin&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;storage.bucket.create&quot;: admin&#92;n  - &quot;sql.database.create&quot;: metadata&#92;n```&#92;n

A list of GCP regions in which GCP KMS resources are supported for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP KMS resources&#39; Regions policies.&#92;n

GCP > KMS > Regions

List of GCP Domains that are trusted for access in the GCP KMS policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

GCP > KMS > Trusted Domains [Default]

List of GCP Groups that are trusted for access in the GCP KMS policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

GCP > KMS > Trusted Groups [Default]

List of GCP Service Accounts that are trusted for access in the GCP KMS policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

GCP > KMS > Trusted Service Accounts [Default]

List of GCP Users that are trusted for access in the GCP KMS policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

Mod: gcp-kms

Recommended Version

Resource Types

Controls

IAM Roles

Policies

Policy Packs