Take an action when an GCP Scheduler job is not active based on the&#92;n`GCP &gt; Scheduler &gt; Job &gt; Active &gt; *` policies.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Scheduler &gt; Job &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > Scheduler > Job

GCP > Scheduler > Job > Active

GCP > Scheduler > Job > Active > Age

GCP > Scheduler > Job > Active > Last Modified

Take an action when a GCP Scheduler job is not approved based on `GCP &gt; Scheduler &gt; Job &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > Scheduler > Job > Approved

GCP > Scheduler > Job > Approved > Custom

GCP > Scheduler > Job > Approved > Regions

GCP > Scheduler > Job > Approved > Usage

Record and synchronize details for the GCP Scheduler job into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If&#92;nregion is not in `GCP &gt; Scheduler &gt; Job &gt; Regions` policy, the CMDB control will delete the&#92;nresource from the CMDB.&#92;n&#92;nThis control will automatically re-run every 24 hours because GCP does not currently support real-time events for this resource type.&#92;n

GCP > Scheduler > Job > CMDB

Discover GCP Scheduler job resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy&#92;nassociated with the resource. If the region is not in `GCP &gt; Scheduler &gt; Job &gt; Regions` policy, the CMDB&#92;ncontrol will delete the resource from the CMDB.&#92;n&#92;nThis control will automatically re-run every 24 hours because GCP does not currently support real-time events for this resource type.&#92;n

GCP > Region

GCP > Scheduler > Job > Discovery

The Usage control determines whether the number of GCP Scheduler job resources exceeds the configured usage limit for this project.&#92;n&#92;nYou can configure the behavior of this control with the  `GCP &gt; Scheduler &gt; Job &gt; Usage` policy, and set the limit with the `GCP &gt; Scheduler &gt; Job &gt; Usage &gt; Limit` policy.&#92;n

GCP > Scheduler > Job > Usage

GCP > Scheduler > Job > Usage > Limit

GCP > Project

Check whether GCP Scheduler API is enabled.&#92;n&#92;nAPI Enabled refers specifically to the API state of a service in a cloud project.&#92;nThis control determines whether the API state is set as per desired level.&#92;n&#92;nThe `GCP &gt; Scheduler &gt; API Enabled` control compares&#92;nthe API state against the API Enabled policies,&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

GCP > Scheduler

GCP > Scheduler > API Enabled

Record and synchronize details for the GCP Scheduler into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > Scheduler > CMDB

Discover GCP Scheduler resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > Scheduler > Discovery

App Engine target. The job will be pushed to a job handler by means of an HTTP request via an http_method such as HTTP POST, HTTP GET, etc. The job is acknowledged by means of an HTTP response code in the range [200 - 299]. Error 503 is considered an App Engine system error instead of an application error. Requests returning error 503 will be retried regardless of retry configuration and not counted against retry counts. Any other response code, or a failure to receive a response before the deadline, constitutes a failed attempt.

Body. HTTP request body. A request body is allowed only if the HTTP method is POST or PUT. It will result in invalid argument error to set a body on a job with an incompatible HttpMethod.

HTTP request headers. This map contains the header field names and values. Headers can be set when the job is created. Cloud Scheduler sets some headers to default values: * `User-Agent`: By default, this header is `"AppEngine-Google; (+http://code.google.com/appengine)"`. This header can be modified, but Cloud Scheduler will append `"AppEngine-Google; (+http://code.google.com/appengine)"` to the modified `User-Agent`. * `X-CloudScheduler`: This header will be set to true. * `X-CloudScheduler-JobName`: This header will contain the job name. * `X-CloudScheduler-ScheduleTime`: For Cloud Scheduler jobs specified in the unix-cron format, this header will contain the job schedule as an offset of UTC parsed according to RFC3339. If the job has a body and the following headers are not set by the user, Cloud Scheduler sets default values: * `Content-Type`: This will be set to `"application/octet-stream"`. You can override this default by explicitly setting `Content-Type` to a particular media type when creating the job. For example, you can set `Content-Type` to `"application/json"`. The headers below are output only. They cannot be set or overridden: * `Content-Length`: This is computed by Cloud Scheduler. * `X-Google-*`: For Google internal use only. * `X-AppEngine-*`: For Google internal use only. In addition, some App Engine headers, which contain job-specific information, are also be sent to the job handler.

The HTTP method to use for the request. PATCH and OPTIONS are not permitted.

The relative URI. The relative URL must begin with "/" and must be a valid HTTP relative URL. It can contain a path, query string arguments, and `#` fragments. If the relative URL is empty, then the root path "/" will be used. No spaces are allowed, and the maximum length allowed is 2083 characters.

AppEngineHttpTarget

App Engine Routing. For more information about services, versions, and instances see [An Overview of App Engine](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine), [Microservices Architecture on Google App Engine](https://cloud.google.com/appengine/docs/python/microservices-on-app-engine), [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed), and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).

Output only. The host that the job is sent to. For more information about how App Engine requests are routed, see [here](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed). The host is constructed as: * `host = [application_domain_name]` `| [service] + '.' + [application_domain_name]` `| [version] + '.' + [application_domain_name]` `| [version_dot_service]+ '.' + [application_domain_name]` `| [instance] + '.' + [application_domain_name]` `| [instance_dot_service] + '.' + [application_domain_name]` `| [instance_dot_version] + '.' + [application_domain_name]` `| [instance_dot_version_dot_service] + '.' + [application_domain_name]` * `application_domain_name` = The domain name of the app, for example .appspot.com, which is associated with the job's project ID. * `service =` service * `version =` version * `version_dot_service =` version `+ '.' +` service * `instance =` instance * `instance_dot_service =` instance `+ '.' +` service * `instance_dot_version =` instance `+ '.' +` version * `instance_dot_version_dot_service =` instance `+ '.' +` version `+ '.' +` service If service is empty, then the job will be sent to the service which is the default service when the job is attempted. If version is empty, then the job will be sent to the version which is the default version when the job is attempted. If instance is empty, then the job will be sent to an instance which is available when the job is attempted. If service, version, or instance is invalid, then the job will be sent to the default version of the default service when the job is attempted.

App instance. By default, the job is sent to an instance which is available when the job is attempted. Requests can only be sent to a specific instance if [manual scaling is used in App Engine Standard](https://cloud.google.com/appengine/docs/python/an-overview-of-app-engine?#scaling_types_and_instance_classes). App Engine Flex does not support instances. For more information, see [App Engine Standard request routing](https://cloud.google.com/appengine/docs/standard/python/how-requests-are-routed) and [App Engine Flex request routing](https://cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed).

App service. By default, the job is sent to the service which is the default service when the job is attempted.

App version. By default, the job is sent to the version which is the default version when the job is attempted.

AppEngineRouting

Http target. The job will be pushed to the job handler by means of an HTTP request via an http_method such as HTTP POST, HTTP GET, etc. The job is acknowledged by means of an HTTP response code in the range [200 - 299]. A failure to receive a response constitutes a failed execution. For a redirected request, the response returned by the redirected request is considered.

HTTP request body. A request body is allowed only if the HTTP method is POST, PUT, or PATCH. It is an error to set body on a job with an incompatible HttpMethod.

HTTP request headers. This map contains the header field names and values. The user can specify HTTP request headers to send with the job's HTTP request. Repeated headers are not supported, but a header value can contain commas. The following headers represent a subset of the headers that accompany the job's HTTP request. Some HTTP request headers are ignored or replaced. A partial list of headers that are ignored or replaced is below: * Host: This will be computed by Cloud Scheduler and derived from uri. * `Content-Length`: This will be computed by Cloud Scheduler. * `User-Agent`: This will be set to `"Google-Cloud-Scheduler"`. * `X-Google-*`: Google internal use only. * `X-AppEngine-*`: Google internal use only. * `X-CloudScheduler`: This header will be set to true. * `X-CloudScheduler-JobName`: This header will contain the job name. * `X-CloudScheduler-ScheduleTime`: For Cloud Scheduler jobs specified in the unix-cron format, this header will contain the job schedule as an offset of UTC parsed according to RFC3339. If the job has a body and the following headers are not set by the user, Cloud Scheduler sets default values: * `Content-Type`: This will be set to `"application/octet-stream"`. You can override this default by explicitly setting `Content-Type` to a particular media type when creating the job. For example, you can set `Content-Type` to `"application/json"`. The total size of headers must be less than 80KB.

Which HTTP method to use for the request.

If specified, an [OAuth token](https://developers.google.com/identity/protocols/OAuth2) will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.

If specified, an [OIDC](https://developers.google.com/identity/protocols/OpenIDConnect) token will be generated and attached as an `Authorization` header in the HTTP request. This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.

Required. The full URI path that the request will be sent to. This string must begin with either "http://" or "https://". Some examples of valid values for uri are: `http://acme.com` and `https://acme.com/sales:8080`. Cloud Scheduler will encode some characters for safety and compatibility. The maximum allowed URL length is 2083 characters after encoding.

HttpTarget

Configuration for a job. The maximum allowed size for a job is 1MB.

The deadline for job attempts. If the request handler does not respond by this deadline then the request is cancelled and the attempt is marked as a `DEADLINE_EXCEEDED` failure. The failed attempt can be viewed in execution logs. Cloud Scheduler will retry the job according to the RetryConfig. The default and the allowed values depend on the type of target: * For HTTP targets, the default is 3 minutes. The deadline must be in the interval [15 seconds, 30 minutes]. * For App Engine HTTP targets, 0 indicates that the request has the default deadline. The default deadline depends on the scaling type of the service: 10 minutes for standard apps with automatic scaling, 24 hours for standard apps with manual and basic scaling, and 60 minutes for flex apps. If the request deadline is set, it must be in the interval [15 seconds, 24 hours 15 seconds]. * For Pub/Sub targets, this field is ignored.

Optionally caller-specified in CreateJob or UpdateJob. A human-readable description for the job. This string must not contain more than 500 characters.

Output only. The time the last job attempt started.

Optionally caller-specified in CreateJob, after which it becomes output only. The job name. For example: `projects/PROJECT_ID/locations/LOCATION_ID/jobs/JOB_ID`. * `PROJECT_ID` can contain letters ([A-Za-z]), numbers ([0-9]), hyphens (-), colons (:), or periods (.). For more information, see [Identifying projects](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects) * `LOCATION_ID` is the canonical ID for the job's location. The list of available locations can be obtained by calling ListLocations. For more information, see https://cloud.google.com/about/locations/. * `JOB_ID` can contain only letters ([A-Za-z]), numbers ([0-9]), hyphens (-), or underscores (_). The maximum length is 500 characters.

Settings that determine the retry behavior.

Required, except when used with UpdateJob. Describes the schedule on which the job will be executed. The schedule can be either of the following types: * [Crontab](https://en.wikipedia.org/wiki/Cron#Overview) * English-like [schedule](https://cloud.google.com/scheduler/docs/configuring/cron-job-schedules) As a general rule, execution `n + 1` of a job will not begin until execution `n` has finished. Cloud Scheduler will never allow two simultaneously outstanding executions. For example, this implies that if the `n+1`th execution is scheduled to run at 16:00 but the `n`th execution takes until 16:15, the `n+1`th execution will not start until `16:15`. A scheduled start time will be delayed if the previous execution has not ended when its scheduled time occurs. If retry_count > 0 and a job attempt fails, the job will be tried a total of retry_count times, with exponential backoff, until the next scheduled start time. If retry_count is 0, a job attempt will not be retried if it fails. Instead the Cloud Scheduler system will wait for the next scheduled execution time. Setting retry_count to 0 does not prevent failed jobs from running according to schedule after the failure.

Output only. The next time the job is scheduled. Note that this may be a retry of a previously failed attempt or the next execution time according to the schedule.

Output only. The response from the target for the last attempted execution.

Specifies the time zone to be used in interpreting schedule. The value of this field must be a time zone name from the [tz database](http://en.wikipedia.org/wiki/Tz_database). Note that some time zones include a provision for daylight savings time. The rules for daylight saving time are determined by the chosen tz. For UTC use the string "utc". If a time zone is not specified, the default will be in UTC (also known as GMT).

Output only. The creation time of the job.

Contains information needed for generating an [OAuth token](https://developers.google.com/identity/protocols/OAuth2). This type of authorization should generally only be used when calling Google APIs hosted on *.googleapis.com.

OAuth scope to be used for generating OAuth access token. If not specified, "https://www.googleapis.com/auth/cloud-platform" will be used.

[Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OAuth token. The service account must be within the same project as the job. The caller must have iam.serviceAccounts.actAs permission for the service account.

OAuthToken

Contains information needed for generating an [OpenID Connect token](https://developers.google.com/identity/protocols/OpenIDConnect). This type of authorization can be used for many scenarios, including calling Cloud Run, or endpoints where you intend to validate the token yourself.

Audience to be used when generating OIDC token. If not specified, the URI specified in target will be used.

[Service account email](https://cloud.google.com/iam/docs/service-accounts) to be used for generating OIDC token. The service account must be within the same project as the job. The caller must have iam.serviceAccounts.actAs permission for the service account.

OidcToken

Pub/Sub target. The job will be delivered by publishing a message to the given Pub/Sub topic.

Attributes for PubsubMessage. Pubsub message must contain either non-empty data, or at least one attribute.

The message payload for PubsubMessage. Pubsub message must contain either non-empty data, or at least one attribute.

Required. The name of the Cloud Pub/Sub topic to which messages will be published when a job is delivered. The topic name must be in the same format as required by Pub/Sub's [PublishRequest.name](https://cloud.google.com/pubsub/docs/reference/rpc/google.pubsub.v1#publishrequest), for example `projects/PROJECT_ID/topics/TOPIC_ID`. The topic must be in the same project as the Cloud Scheduler job.

PubsubTarget

Settings that determine the retry behavior. By default, if a job does not complete successfully (meaning that an acknowledgement is not received from the handler, then it will be retried with exponential backoff according to the settings in RetryConfig.

The maximum amount of time to wait before retrying a job after it fails. The default value of this field is 1 hour.

The time between retries will double `max_doublings` times. A job's retry interval starts at min_backoff_duration, then doubles `max_doublings` times, then increases linearly, and finally retries at intervals of max_backoff_duration up to retry_count times. For example, if min_backoff_duration is 10s, max_backoff_duration is 300s, and `max_doublings` is 3, then the job will first be retried in 10s. The retry interval will double three times, and then increase linearly by 2^3 * 10s. Finally, the job will retry at intervals of max_backoff_duration until the job has been attempted retry_count times. Thus, the requests will retry at 10s, 20s, 40s, 80s, 160s, 240s, 300s, 300s, .... The default value of this field is 5.

The time limit for retrying a failed job, measured from time when an execution was first attempted. If specified with retry_count, the job will be retried until both limits are reached. The default value for max_retry_duration is zero, which means retry duration is unlimited.

The minimum amount of time to wait before retrying a job after it fails. The default value of this field is 5 seconds.

The number of attempts that the system will make to run a job using the exponential backoff procedure described by max_doublings. The default value of retry_count is zero. If retry_count is 0, a job attempt will not be retried if it fails. Instead the Cloud Scheduler system will wait for the next scheduled execution time. Setting retry_count to 0 does not prevent failed jobs from running according to schedule after the failure. If retry_count is set to a non-zero number then Cloud Scheduler will retry failed attempts, using exponential backoff, retry_count times, or until the next scheduled execution time, whichever comes first. Values greater than 5 and negative values are not allowed.

RetryConfig

The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).

The status code, which should be an enum value of google.rpc.Code.

A list of messages that carry the error details. There is a common set of message types for APIs to use.

Properties of the object. Contains field @type with type URL.

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.

Status

projects/test01/locations/us-west2/jobs/job1

job1

jobAka

jobName

jobState

Invalid - special character -,_ are allowed

jobTitle

regionName

invalid title - service provider name prefixed

scheduler

schedulerAka

schedulerName

schedulerSupportedRegions

gcp-scheduler

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermissions for GCP Scheduler that is used as&#92;ninput to the control that manages the IAM stack.&#92;n

GCP > Turbot > Permissions > Compiled > Service Permissions

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-scheduler

A calculated policy that Guardrails uses to create a compiled list of ALL permission&#92;nlevels for GCP Scheduler that is used as input to&#92;nthe stack that manages the Guardrails IAM permissions objects.&#92;n

GCP > Turbot > Permissions > Compiled > Levels

GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-scheduler

Determine the action to take when an GCP Scheduler job, based on the `GCP &gt; Scheduler &gt; Job &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Scheduler &gt; Job &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The age after which the GCP Scheduler job&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Scheduler &gt; Job &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The number of days since the GCP Scheduler job was last modified before it is considered&#92;ninactive.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Scheduler &gt; Job &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n

Determine the action to take when a GCP Scheduler job is not approved based on `GCP &gt; Scheduler &gt; Job &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP Scheduler job is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If a GCP Scheduler job is not approved, it will be subject to the action specified in the `GCP &gt; Scheduler &gt; Job &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

string

A list of GCP regions in which GCP Scheduler jobs are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP Scheduler job is created in a region that is not in the approved list, it will be subject to the action specified in the `GCP &gt; Scheduler &gt; Job &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP Scheduler job is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP Scheduler job is not approved, it will be subject to the action specified in the `GCP &gt; Scheduler &gt; Job &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the GCP Scheduler job into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; Scheduler &gt; Job &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

A list of GCP regions in which GCP Scheduler jobs are supported for use.&#92;n&#92;nAny jobs in a region not listed here will not be recorded in CMDB.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n

GCP > Scheduler > Job > Regions

Configure the number of GCP Scheduler jobs that can be used for this project and the current consumption against the limit.&#92;n&#92;nYou can configure the behavior of the control with this  `GCP &gt; Scheduler &gt; Job &gt; Usage` policy.&#92;n

Maximum number of items that can be created for this project

A list of GCP regions in which GCP Scheduler resources are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP Scheduler resources&#39; Approved &gt; Regions policies.&#92;n

GCP > Scheduler > Approved Regions [Default]

Configure whether to record and synchronize details for the GCP Scheduler scheduler into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; Scheduler &gt; Scheduler &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

GCP > Scheduler > Enabled

GCP > Scheduler > Permissions > Levels

Configure whether permissions policies are in effect for GCP Scheduler.&#92;nThis setting does not affect Project level permissions (GCP/Admin, GCP/Owner, etc).&#92;n&#92;n**Note:** The behavior of this policy depends on the value of GCP &gt; Permissions.&#92;n

GCP > Scheduler > Permissions

GCP > Scheduler > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to Scheduler&#92;nan GCP project. Permissions levels defined will appear in the UI to assign access to Guardrails users.&#92;n&#92;n**Note:** Some services do not use all permissions levels, and any permissions level that has&#92;nno permissions associated will not be created even if it is selected here.&#92;n

A map of GCP API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of GCP API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the metadata level, it is also added&#92;n to readOnly, operator and admin. Modifier policies set here will “roll up” to the GCP level too - if&#92;n you add a permission to Admin, it will be granted to GCP/Storage/Admin and also GCP/Admin&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;storage.bucket.create&quot;: admin&#92;n  - &quot;sql.database.create&quot;: metadata&#92;n```&#92;n

A list of GCP regions in which GCP Scheduler resources are supported for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP Scheduler resources&#39; Regions policies.&#92;n

Mod: gcp-scheduler

Recommended Version

Resource Types

Controls

IAM Roles

Policies