Process events for GCP KMS service Crypto Key resources.

The router receives events from the event handler and creates, updates, or deletes Crypto Key resources in the CMDB.


GCP > KMS > Crypto Key

GCP > Project

GCP > KMS > Crypto Key > Router

Update the labels for GCP KMS crypto key.


GCP > KMS > Crypto Key > Set Labels

Set or Update GCP KMS Crypto Key policy as per plan passed from control.


GCP > KMS > Crypto Key > Set Trusted Access

Process events for GCP KMS service Key Ring resources.

The router receives events from the event handler and creates, updates, or deletes Key Ring resources in the CMDB.


GCP > KMS > Key Ring

GCP > KMS > Key Ring > Router

Set or Update GCP KMS Key Ring policy as per plan passed from control.


GCP > KMS > Key Ring > Set Trusted Access

Configure whether the GCP KMS API is enabled.


GCP > KMS

GCP > KMS > Set API Enabled

Take an action when a GCP KMS crypto key is not approved based on `GCP &gt; KMS &gt; Crypto Key &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > KMS > Crypto Key > Approved > Regions

GCP > KMS > Crypto Key > Approved > Custom

GCP > KMS > Crypto Key > Approved > Usage

GCP > KMS > Enabled

GCP > KMS > Crypto Key > Approved

Record and synchronize details for the GCP KMS crypto key into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If&#92;nregion is not in `GCP &gt; KMS &gt; Crypto Key &gt; Regions` policy, the CMDB control will delete the&#92;nresource from the CMDB.&#92;n

GCP > KMS > Crypto Key > Regions

GCP > KMS > API Enabled

GCP > KMS > Crypto Key > CMDB

Discover GCP KMS crypto key resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy&#92;nassociated with the resource. If the region is not in `GCP &gt; KMS &gt; Crypto Key &gt; Regions` policy, the CMDB&#92;ncontrol will delete the resource from the CMDB.&#92;n

GCP > KMS > Regions

GCP > KMS > Crypto Key > Discovery

Take an action when an GCP KMS crypto key labels is not updated based on the `GCP &gt; KMS &gt; Crypto Key &gt; Labels &gt; *` policies.&#92;n&#92;nIf the resource is not updated with the labels defined in `GCP &gt; KMS &gt; Crypto Key &gt; Labels &gt; Template`, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

GCP > KMS > Crypto Key > Labels > Template

GCP > KMS > Crypto Key > Labels

GCP > KMS > Crypto Key > Policy

Take an action when GCP KMS Crypto Key policy is not trusted based on the&#92;n`GCP &gt; KMS &gt; Crypto Key &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the IAM policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc)., this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

GCP > KMS > Crypto Key > Policy > Trusted Access > Domains

GCP > KMS > Crypto Key > Policy > Trusted Access > Groups

GCP > KMS > Crypto Key > Policy > Trusted Access > Service Accounts

GCP > KMS > Crypto Key > Policy > Trusted Access > Users

GCP > KMS > Crypto Key > Policy > Trusted Access > All Users

GCP > KMS > Crypto Key > Policy > Trusted Access > All Authenticated

GCP > KMS > Crypto Key > Policy > Trusted Access

Record and synchronize details for the GCP KMS key ring into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If&#92;nregion is not in `GCP &gt; KMS &gt; Key Ring &gt; Regions` policy, the CMDB control will delete the&#92;nresource from the CMDB.&#92;n

GCP > KMS > Key Ring > Regions

GCP > KMS > Key Ring > CMDB

Discover GCP KMS key ring resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy&#92;nassociated with the resource. If the region is not in `GCP &gt; KMS &gt; Key Ring &gt; Regions` policy, the CMDB&#92;ncontrol will delete the resource from the CMDB.&#92;n

GCP > Region

GCP > Multi-Region

GCP > Global Region

GCP > KMS > Key Ring > Discovery

GCP > KMS > Key Ring > Policy

Take an action when GCP KMS Key Ring policy is not trusted based on the&#92;n`GCP &gt; KMS &gt; Key Ring &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the IAM policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc)., this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

GCP > KMS > Key Ring > Policy > Trusted Access > Domains

GCP > KMS > Key Ring > Policy > Trusted Access > Groups

GCP > KMS > Key Ring > Policy > Trusted Access > Service Accounts

GCP > KMS > Key Ring > Policy > Trusted Access > Users

GCP > KMS > Key Ring > Policy > Trusted Access > All Users

GCP > KMS > Key Ring > Policy > Trusted Access > All Authenticated

GCP > KMS > Key Ring > Policy > Trusted Access

Check whether GCP KMS API is enabled.&#92;n&#92;nAPI Enabled refers specifically to the API state of a service in a cloud project. This control determines whether the API state is set as per desired level.&#92;n&#92;nThe `GCP &gt; KMS &gt; API Enabled` control compares the API state against the API Enabled policies, raises an alarm, and takes the defined enforcement action.&#92;n

Record and synchronize details for the GCP KMS into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > KMS > CMDB

Discover GCP KMS resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > KMS > Discovery

projects/cse-legolas-2/locations/asia-south1/keyRings/test-key/cryptoKeys/test

cryptoKey

cryptoKeyAka

cryptoKeyName

cryptoKeyServiceNow

projects/cse-legolas-2/locations/asia-south1/keyRings/test-key

keyRing

keyRingAka

keyRingName

keyRingServiceNow

projects/932405488407/services/cloudkms.googleapis.com

Cloud Functions API

kmsAka

kmsName

kmsSupportedRegions

regionName

gcp-kms

Determine the action to take when a GCP KMS crypto key is not approved based on `GCP &gt; KMS &gt; Crypto Key &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

gcp_kms_crypto_key_approved

Check If GCP KMS Crypto Keys Are Rotated Regularly

GCP CIS v2.0.0 - Section 1 - Identity and Access Management

Determine whether the GCP KMS crypto key is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If a GCP KMS crypto key is not approved, it will be subject to the action specified in the `GCP &gt; KMS &gt; Crypto Key &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

gcp_kms_crypto_key_approved_custom

string

A list of GCP regions in which GCP KMS crypto keys are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP KMS crypto key is created in a region that is not in the approved list, it will be subject to the action specified in the `GCP &gt; KMS &gt; Crypto Key &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP KMS crypto key is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP KMS crypto key is not approved, it will be subject to the action specified in the `GCP &gt; KMS &gt; Crypto Key &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the GCP KMS crypto key into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; KMS &gt; Crypto Key &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

Determine the action to take when an GCP KMS crypto key labels are not updated based on the `GCP &gt; KMS &gt; Crypto Key &gt; Labels &gt; *` policies.&#92;n&#92;nThe control ensure GCP KMS crypto key labels include labels defined in `GCP &gt; KMS &gt; Crypto Key &gt; Labels &gt; Template`.&#92;n&#92;nLabels not defined in Crypto Key Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

The template is used to generate the keys and values for GCP KMS crypto key.&#92;n&#92;nLabels not defined in Crypto Key Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

Check or Enforce access checking on the GCP KMS Crypto Key policy.&#92;n&#92;nGoogle Cloud IAM allows you to control who has access to the&#92;nkms crypto key via an IAM Policy. The Trusted Access policy&#92;nallows you to configure whether Guardrails will evaluate or&#92;nenforce restrictions on which members are allowed to be granted&#92;naccess.&#92;n&#92;nIf enabled, the members in the IAM policy will be evaluated&#92;nagainst the list of allowed members in each of the Trusted&#92;nAccess sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc).&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

gcp_kms_crypto_key_policy_trusted_access

Enforce GCP KMS Crypto Keys Are Not Publicly Accessible

Determine whether public access may be granted on GCP KMS Crypto Key policy.&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether grants to `allAuthenticatedUsers` is allowed.&#92;n

gcp_kms_crypto_key_policy_trusted_access_all_authenticated

Determine whether anonymous access may be granted on GCP KMS Crypto Key policy.&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether grants to `allUsers` is allowed.&#92;n

gcp_kms_crypto_key_policy_trusted_access_all_users

List of GCP Domains that are trusted for access in the GCP KMS Crypto Key policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

List of GCP Groups that are trusted for access in the GCP KMS Crypto Key policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

List of GCP Service Accounts that are trusted for access in the GCP KMS Crypto Key policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

List of GCP Users that are trusted for access in the GCP KMS Crypto Key policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Crypto Key &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

A list of GCP regions in which GCP KMS crypto keys are supported for use.&#92;n&#92;nAny crypto keys in a region not listed here will not be recorded in CMDB.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermissions for GCP KMS that is used as&#92;ninput to the control that manages the IAM stack.&#92;n

GCP > Turbot > Permissions > Compiled > Service Permissions

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-kms

A calculated policy that Guardrails uses to create a compiled list of ALL permission&#92;nlevels for GCP KMS that is used as input to&#92;nthe stack that manages the Guardrails IAM permissions objects.&#92;n

GCP > Turbot > Permissions > Compiled > Levels

GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-kms

Configure whether to record and synchronize details for the GCP KMS key ring into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; KMS &gt; Key Ring &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

Check or Enforce access checking on the GCP KMS Key Ring policy.&#92;n&#92;nGoogle Cloud IAM allows you to control who has access to the&#92;nkms key ring via an IAM Policy. The Trusted Access policy&#92;nallows you to configure whether Guardrails will evaluate or&#92;nenforce restrictions on which members are allowed to be granted&#92;naccess.&#92;n&#92;nIf enabled, the members in the IAM policy will be evaluated&#92;nagainst the list of allowed members in each of the Trusted&#92;nAccess sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc).&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

Determine whether public access may be granted on GCP KMS Key Ring policy.&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether grants to `allAuthenticatedUsers` is allowed.&#92;n

Determine whether anonymous access may be granted on GCP KMS Key Ring policy.&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether grants to `allUsers` is allowed.&#92;n

List of GCP Domains that are trusted for access in the GCP KMS Key Ring policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

List of GCP Groups that are trusted for access in the GCP KMS Key Ring policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

List of GCP Service Accounts that are trusted for access in the GCP KMS Key Ring policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

List of GCP Users that are trusted for access in the GCP KMS Key Ring policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Key Ring &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

A list of GCP regions in which GCP KMS key rings are supported for use.&#92;n&#92;nAny key rings in a region not listed here will not be recorded in CMDB.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n

A list of GCP regions in which GCP KMS resources are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP KMS resources&#39; Approved &gt; Regions policies.&#92;n

GCP > KMS > Approved Regions [Default]

Record and synchronize details for GCP KMS Kms(s) into the CMDB.&#92;n

A GCP logs [advanced filter](https://cloud.google.com/logging/docs/view/advanced-filters)&#92;nused to specify a subset of log entries that will be forwarded by the logging sink on behalf of the gcp-kms mod.&#92;nThis is a read-only policy that is used internally by Guardrails.&#92;n

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-kms

A template used to generate the keys and values for GCP KMS resources.&#92;n&#92;nBy default, all KMS resource Labels &gt; Template policies will use this value.&#92;n

GCP > KMS > Labels Template [Default]

GCP > KMS > Permissions > Levels

Configure whether permissions policies are in effect for GCP KMS.&#92;nThis setting does not affect Project level permissions (GCP/Admin, GCP/Owner, etc).&#92;n&#92;n**Note:** The behavior of this policy depends on the value of GCP &gt; Permissions.&#92;n

GCP > KMS > Permissions

GCP > KMS > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to KMS&#92;nan GCP project. Permissions levels defined will appear in the UI to assign access to Guardrails users.&#92;n&#92;n**Note:** Some services do not use all permissions levels, and any permissions level that has&#92;nno permissions associated will not be created even if it is selected here.&#92;n

A map of GCP API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of GCP API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the metadata level, it is also added&#92;n to readOnly, operator and admin. Modifier policies set here will “roll up” to the GCP level too - if&#92;n you add a permission to Admin, it will be granted to GCP/Storage/Admin and also GCP/Admin&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;storage.bucket.create&quot;: admin&#92;n  - &quot;sql.database.create&quot;: metadata&#92;n```&#92;n

A list of GCP regions in which GCP KMS resources are supported for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP KMS resources&#39; Regions policies.&#92;n

List of GCP Domains that are trusted for access in the GCP KMS policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

GCP > KMS > Trusted Domains [Default]

List of GCP Groups that are trusted for access in the GCP KMS policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

GCP > KMS > Trusted Groups [Default]

List of GCP Service Accounts that are trusted for access in the GCP KMS policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

GCP > KMS > Trusted Service Accounts [Default]

List of GCP Users that are trusted for access in the GCP KMS policy.&#92;n&#92;nThis policy is used by the GCP &gt; KMS &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

Mod: gcp-kms

Recommended Version

Resource Types

Controls

IAM Roles

Policies

Policy Packs