Take an action when an GCP Secret Manager secret is not active based on the&#92;n`GCP &gt; Secret Manager &gt; Secret &gt; Active &gt; *` policies.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Secret Manager &gt; Secret &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > Secret Manager > Secret

GCP > Secret Manager > Secret > Active

GCP > Secret Manager > Secret > Active > Age

GCP > Secret Manager > Secret > Active > Last Modified

Take an action when a GCP Secret Manager secret is not approved based on `GCP &gt; Secret Manager &gt; Secret &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > Secret Manager > Secret > Approved

GCP > Secret Manager > Secret > Approved > Custom

GCP > Secret Manager > Secret > Approved > Usage

Record and synchronize details for the GCP Secret Manager secret into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > Secret Manager > Secret > CMDB

Discover GCP Secret Manager secret resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > Project

GCP > Secret Manager > Secret > Discovery

Take an action when an GCP Secret Manager secret labels is not updated based on the `GCP &gt; Secret Manager &gt; Secret &gt; Labels &gt; *` policies.&#92;n&#92;nIf the resource is not updated with the labels defined in `GCP &gt; Secret Manager &gt; Secret &gt; Labels &gt; Template`, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

GCP > Secret Manager > Secret > Labels

GCP > Secret Manager > Secret > Labels > Template

Check whether GCP Secret Manager API is enabled.&#92;n&#92;nAPI Enabled refers specifically to the API state of a service in a cloud project.&#92;nThis control determines whether the API state is set as per desired level.&#92;n&#92;nThe `GCP &gt; Secret Manager &gt; API Enabled` control compares&#92;nthe API state against the API Enabled policies,&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

GCP > Secret Manager

GCP > Secret Manager > API Enabled

Record and synchronize details for the GCP Secret Manager into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > Secret Manager > CMDB

Discover GCP Secret Manager resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > Secret Manager > Discovery

GCP > Secret Manager > Secret > Policy

GCP > Secret Manager > Secret > Policy > Trusted Access

GCP > Secret Manager > Secret > Policy > Trusted Access > Domains

GCP > Secret Manager > Secret > Policy > Trusted Access > Groups

GCP > Secret Manager > Secret > Policy > Trusted Access > Service Accounts

GCP > Secret Manager > Secret > Policy > Trusted Access > Users

Take an action when GCP Secret Manager Secret policy is not trusted based on the&#92;n`GCP &gt; Secret Manager &gt; Secret &gt; Policy &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the IAM policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc)., this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

projects/979620418102/secrets/testsecret121B

testsecret121B

secret

secretAka

secretManager

secretManagerAka

secretManagerName

secretName

secretReplication

secretRotation

secretServiceNow

secretTitle

secretTopics

secretUserManagedReplica

gcp-secretmanager

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermissions for GCP Secret Manager that is used as&#92;ninput to the control that manages the IAM stack.&#92;n

GCP > Turbot > Permissions > Compiled > Service Permissions

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-secretmanager

A calculated policy that Guardrails uses to create a compiled list of ALL permission&#92;nlevels for GCP Secret Manager that is used as input to&#92;nthe stack that manages the Guardrails IAM permissions objects.&#92;n

GCP > Turbot > Permissions > Compiled > Levels

GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-secretmanager

Determine the action to take when an GCP Secret Manager secret, based on the `GCP &gt; Secret Manager &gt; Secret &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Secret Manager &gt; Secret &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The age after which the GCP Secret Manager secret&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Secret Manager &gt; Secret &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The number of days since the GCP Secret Manager secret was last modified before it is considered&#92;ninactive.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Secret Manager &gt; Secret &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n

Determine the action to take when a GCP Secret Manager secret is not approved based on `GCP &gt; Secret Manager &gt; Secret &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP Secret Manager secret is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If a GCP Secret Manager secret is not approved, it will be subject to the action specified in the `GCP &gt; Secret Manager &gt; Secret &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

string

Determine whether the GCP Secret Manager secret is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP Secret Manager secret is not approved, it will be subject to the action specified in the `GCP &gt; Secret Manager &gt; Secret &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the GCP Secret Manager secret into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

Determine the action to take when an GCP Secret Manager secret labels are not updated based on the `GCP &gt; Secret Manager &gt; Secret &gt; Labels &gt; *` policies.&#92;n&#92;nThe control ensure GCP Secret Manager secret labels include labels defined in `GCP &gt; Secret Manager &gt; Secret &gt; Labels &gt; Template`.&#92;n&#92;nLabels not defined in Secret Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

The template is used to generate the keys and values for GCP Secret Manager secret.&#92;n&#92;nLabels not defined in Secret Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

Configure whether to record and synchronize details for the GCP Secret Manager secret manager into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

GCP logs [advanced filter](https://cloud.google.com/logging/docs/view/advanced-filters)&#92;nused to specify a subset of log entries that is forwarded to the Guardrails Event Handlers&#92;nby the logging sink on behalf of GCP Secret Manager.&#92;n

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-secretmanager

GCP > Secret Manager > Enabled

A template used to generate the keys and values for GCP Secret Manager resources.&#92;n&#92;nBy default, all Secret Manager resource Labels &gt; Template policies will use this value.&#92;n

GCP > Secret Manager > Labels Template [Default]

GCP > Secret Manager > Permissions > Levels

Configure whether permissions policies are in effect for GCP Secret Manager.&#92;nThis setting does not affect Project level permissions (GCP/Admin, GCP/Owner, etc).&#92;n&#92;n**Note:** The behavior of this policy depends on the value of GCP &gt; Permissions.&#92;n

GCP > Secret Manager > Permissions

GCP > Secret Manager > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to Secret Manager&#92;nan GCP project. Permissions levels defined will appear in the UI to assign access to Guardrails users.&#92;n&#92;n**Note:** Some services do not use all permissions levels, and any permissions level that has&#92;nno permissions associated will not be created even if it is selected here.&#92;n

A map of GCP API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of GCP API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the metadata level, it is also added&#92;n to readOnly, operator and admin. Modifier policies set here will “roll up” to the GCP level too - if&#92;n you add a permission to Admin, it will be granted to GCP/Storage/Admin and also GCP/Admin&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;storage.bucket.create&quot;: admin&#92;n  - &quot;sql.database.create&quot;: metadata&#92;n```&#92;n

List of GCP Domains that are trusted for access in the GCP Secret Manager policy.&#92;n&#92;nThis policy is used by the GCP &gt; Secret Manager &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

GCP > Secret Manager > Trusted Domains [Default]

List of GCP Groups that are trusted for access in the GCP Secret Manager policy.&#92;n&#92;nThis policy is used by the GCP &gt; Secret Manager &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

GCP > Secret Manager > Trusted Groups [Default]

List of GCP Service Accounts that are trusted for access in the GCP Secret Manager policy.&#92;n&#92;nThis policy is used by the GCP &gt; Secret Manager &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

GCP > Secret Manager > Trusted Service Accounts [Default]

List of GCP Users that are trusted for access in the GCP Secret Manager policy.&#92;n&#92;nThis policy is used by the GCP &gt; Secret Manager &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

GCP > Secret Manager > Trusted Users [Default]

Check or Enforce access checking on the GCP Secret Manager Secret policy.&#92;n&#92;nGoogle Cloud IAM allows you to control who has access to the&#92;nsecret manager secret via an IAM Policy. The Trusted Access policy&#92;nallows you to configure whether Guardrails will evaluate or&#92;nenforce restrictions on which members are allowed to be granted&#92;naccess.&#92;n&#92;nIf enabled, the members in the IAM policy will be evaluated&#92;nagainst the list of allowed members in each of the Trusted&#92;nAccess sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc).&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

List of GCP Domains that are trusted for access in the GCP Secret Manager Secret policy.&#92;n&#92;nThis policy is used by the GCP &gt; Secret Manager &gt; Secret &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

List of GCP Groups that are trusted for access in the GCP Secret Manager Secret policy.&#92;n&#92;nThis policy is used by the GCP &gt; Secret Manager &gt; Secret &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

List of GCP Service Accounts that are trusted for access in the GCP Secret Manager Secret policy.&#92;n&#92;nThis policy is used by the GCP &gt; Secret Manager &gt; Secret &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

List of GCP Users that are trusted for access in the GCP Secret Manager Secret policy.&#92;n&#92;nThis policy is used by the GCP &gt; Secret Manager &gt; Secret &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

GCP > Secret Manager > Secret > ServiceNow

The Secret resource type is a secured unit of sensitive data that can be used to store and manage application credentials, tokens, API keys, and other sensitive data.&#92;n

GCP > Secret Manager > Secret > ServiceNow > Configuration Item

GCP > Secret Manager > Secret > ServiceNow > Configuration Item > Record

The Google Cloud Platform (GCP) Secret Manager service provides secure and convenient storage for API keys, passwords, certificates, and other sensitive data. It allows users to manage and access secrets, known as secret payloads, that can be used to authenticate applications and services in a secure manner.&#92;n

Mod: gcp-secretmanager

Recommended Version

Resource Types

Controls

IAM Roles

Policies