Take an action when an GCP Spanner database is not active based on the&#92;n`GCP &gt; Spanner &gt; Database &gt; Active &gt; *` policies.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Spanner &gt; Database &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > Spanner > Database

GCP > Spanner > Database > Active

GCP > Spanner > Database > Active > Age

GCP > Spanner > Database > Active > Last Modified

Take an action when a GCP Spanner database is not approved based on `GCP &gt; Spanner &gt; Database &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > Spanner > Database > Approved

GCP > Spanner > Database > Approved > Custom

GCP > Spanner > Database > Approved > Encryption at Rest

GCP > Spanner > Database > Approved > Encryption at Rest > Customer Managed Key

GCP > Spanner > Database > Approved > Regions

GCP > Spanner > Database > Approved > Usage

Record and synchronize details for the GCP Spanner database into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If&#92;nregion is not in `GCP &gt; Spanner &gt; Database &gt; Regions` policy, the CMDB control will delete the&#92;nresource from the CMDB.&#92;n&#92;nThis control will automatically re-run every 24 hours because GCP does not currently support all real-time events for this resource type.&#92;n

GCP > Spanner > Database > CMDB

Discover GCP Spanner database resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy&#92;nassociated with the resource. If the region is not in `GCP &gt; Spanner &gt; Database &gt; Regions` policy, the CMDB&#92;ncontrol will delete the resource from the CMDB.&#92;n

GCP > Spanner > Instance

GCP > Spanner > Database > Discovery

The Usage control determines whether the number of GCP Spanner database resources exceeds the configured usage limit for this instance.&#92;n&#92;nYou can configure the behavior of this control with the  `GCP &gt; Spanner &gt; Database &gt; Usage` policy, and set the limit with the `GCP &gt; Spanner &gt; Database &gt; Usage &gt; Limit` policy.&#92;n

GCP > Spanner > Database > Usage

GCP > Spanner > Database > Usage > Limit

Take an action when an GCP Spanner instance is not active based on the&#92;n`GCP &gt; Spanner &gt; Instance &gt; Active &gt; *` policies.&#92;n&#92;nThe Active control determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Spanner &gt; Instance &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

GCP > Spanner > Instance > Active

GCP > Spanner > Instance > Active > Age

GCP > Spanner > Instance > Active > Last Modified

Take an action when a GCP Spanner instance is not approved based on `GCP &gt; Spanner &gt; Instance &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

GCP > Spanner > Instance > Approved

GCP > Spanner > Instance > Approved > Custom

GCP > Spanner > Instance > Approved > Regions

GCP > Spanner > Instance > Approved > Usage

Record and synchronize details for the GCP Spanner instance into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If&#92;nregion is not in `GCP &gt; Spanner &gt; Instance &gt; Regions` policy, the CMDB control will delete the&#92;nresource from the CMDB.&#92;n&#92;nThis control will automatically re-run every 24 hours because GCP does not currently support all real-time events for this resource type.&#92;n

GCP > Spanner > Instance > CMDB

Discover GCP Spanner instance resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nNote that Discovery and CMDB controls also use the Regions policy&#92;nassociated with the resource. If the region is not in `GCP &gt; Spanner &gt; Instance &gt; Regions` policy, the CMDB&#92;ncontrol will delete the resource from the CMDB.&#92;n

GCP > Region

GCP > Spanner > Instance > Discovery

Take an action when an GCP Spanner instance labels is not updated based on the `GCP &gt; Spanner &gt; Instance &gt; Labels &gt; *` policies.&#92;n&#92;nIf the resource is not updated with the labels defined in `GCP &gt; Spanner &gt; Instance &gt; Labels &gt; Template`, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

GCP > Spanner > Instance > Labels

GCP > Spanner > Instance > Labels > Template

GCP > Spanner > Instance > Policy

GCP > Spanner > Instance > Policy > Trusted Access

GCP > Spanner > Instance > Policy > Trusted Access > Domains

GCP > Spanner > Instance > Policy > Trusted Access > Groups

GCP > Spanner > Instance > Policy > Trusted Access > Projects

GCP > Spanner > Instance > Policy > Trusted Access > Service Accounts

GCP > Spanner > Instance > Policy > Trusted Access > Users

Take an action when GCP Spanner Instance policy is not trusted based on the&#92;n`GCP &gt; Spanner &gt; Instance &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the IAM policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc)., this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

The Usage control determines whether the number of GCP Spanner instance resources exceeds the configured usage limit for this region.&#92;n&#92;nYou can configure the behavior of this control with the  `GCP &gt; Spanner &gt; Instance &gt; Usage` policy, and set the limit with the `GCP &gt; Spanner &gt; Instance &gt; Usage &gt; Limit` policy.&#92;n

GCP > Spanner > Instance > Usage

GCP > Spanner > Instance > Usage > Limit

Check whether GCP Spanner API is enabled.&#92;n&#92;nAPI Enabled refers specifically to the API state of a service in a cloud project.&#92;nThis control determines whether the API state is set as per desired level.&#92;n&#92;nThe `GCP &gt; Spanner &gt; API Enabled` control compares&#92;nthe API state against the API Enabled policies,&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

GCP > Spanner

GCP > Spanner > API Enabled

Record and synchronize details for the GCP Spanner into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Guardrails CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

GCP > Spanner > CMDB

Discover GCP Spanner resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery)&#92;ncontrol is tasked with identifying instances for a particular resource.&#92;nThe Discovery control will periodically search for new target resources and&#92;nsave them to the Guardrails CMDB. Once discovered, resources are then&#92;nresponsible for tracking changes to themselves through the&#92;n[CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

GCP > Project

GCP > Spanner > Discovery

backupInfo

projects/parker-aaa/instances/test121/databases/testspannerdatabase

testspannerdatabase

invalid case - title cannot start with number

1testspannerdatabase

database

databaseAka

databaseDialect

databaseEncryptionConfig

databaseEncryptionInfo

databaseName

databaseRestoreInfo

databaseServiceNow

databaseState

databaseTitle

dbEncryptionType

encryptionInfoItems

projects/cse-legolas/instances/test01

testfunction01

instance

instanceAka

invalid case - using underscore character

invalid case - using special characters other than hypens

instanceId

instanceName

instanceServiceNow

instanceStatus

regionName

spanner

spannerAka

spannerName

spannerSupportedRegions

srcType

gcp-spanner

Determine the action to take when an GCP Spanner database, based on the `GCP &gt; Spanner &gt; Database &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Spanner &gt; Database &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The age after which the GCP Spanner database&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Spanner &gt; Database &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The number of days since the GCP Spanner database was last modified before it is considered&#92;ninactive.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Spanner &gt; Database &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n

Determine the action to take when a GCP Spanner database is not approved based on `GCP &gt; Spanner &gt; Database &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP Spanner database is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If a GCP Spanner database is not approved, it will be subject to the action specified in the `GCP &gt; Spanner &gt; Database &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

string

Define the minimum level of encryption required for GCP &gt; Spanner &gt; Database.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP Spanner database does not meet the minimum encryption level specified, it will be subject to the action specified in the `GCP &gt; Spanner &gt; Database &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

The ID of a GCP KMS symmetric key that must be used as the encryption key for a GCP &gt; Spanner &gt; Database.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP Spanner database is not encrypted with the specified key, it will be subject to the action specified in the `GCP &gt; Spanner &gt; Database &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

A list of GCP regions in which GCP Spanner databases are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP Spanner database is created in a region that is not in the approved list, it will be subject to the action specified in the `GCP &gt; Spanner &gt; Database &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP Spanner database is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP Spanner database is not approved, it will be subject to the action specified in the `GCP &gt; Spanner &gt; Database &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the GCP Spanner database into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; Spanner &gt; Database &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

A list of GCP regions in which GCP Spanner databases are supported for use.&#92;n&#92;nAny databases in a region not listed here will not be recorded in CMDB.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n

GCP > Spanner > Database > Regions

Configure the number of GCP Spanner databases that can be used for this instance and the current consumption against the limit.&#92;n&#92;nYou can configure the behavior of the control with this  `GCP &gt; Spanner &gt; Database &gt; Usage` policy.&#92;n

Maximum number of items that can be created for this instance

A calculated policy that Guardrails uses to create a compiled list of ALL&#92;npermissions for GCP Spanner that is used as&#92;ninput to the control that manages the IAM stack.&#92;n

GCP > Turbot > Permissions > Compiled > Service Permissions

GCP > Turbot > Permissions > Compiled > Service Permissions > @turbot/gcp-spanner

A calculated policy that Guardrails uses to create a compiled list of ALL permission&#92;nlevels for GCP Spanner that is used as input to&#92;nthe stack that manages the Guardrails IAM permissions objects.&#92;n

GCP > Turbot > Permissions > Compiled > Levels

GCP > Turbot > Permissions > Compiled > Levels > @turbot/gcp-spanner

Determine the action to take when an GCP Spanner instance, based on the `GCP &gt; Spanner &gt; Instance &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Spanner &gt; Instance &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The age after which the GCP Spanner instance&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Spanner &gt; Instance &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

The number of days since the GCP Spanner instance was last modified before it is considered&#92;ninactive.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; Spanner &gt; Instance &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n

Determine the action to take when a GCP Spanner instance is not approved based on `GCP &gt; Spanner &gt; Instance &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP Spanner instance is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If a GCP Spanner instance is not approved, it will be subject to the action specified in the `GCP &gt; Spanner &gt; Instance &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

A list of GCP regions in which GCP Spanner instances are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP Spanner instance is created in a region that is not in the approved list, it will be subject to the action specified in the `GCP &gt; Spanner &gt; Instance &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the GCP Spanner instance is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If a GCP Spanner instance is not approved, it will be subject to the action specified in the `GCP &gt; Spanner &gt; Instance &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the GCP Spanner instance into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n&#92;nCMDB controls also use the Regions policy associated with the resource. If region is not in `GCP &gt; Spanner &gt; Instance &gt; Regions` policy, the CMDB control will delete the resource from the CMDB.&#92;n&#92;n(**Note**: Setting CMDB to **&quot;Skip&quot;** will also pause these changes.)&#92;n

Determine the action to take when an GCP Spanner instance labels are not updated based on the `GCP &gt; Spanner &gt; Instance &gt; Labels &gt; *` policies.&#92;n&#92;nThe control ensure GCP Spanner instance labels include labels defined in `GCP &gt; Spanner &gt; Instance &gt; Labels &gt; Template`.&#92;n&#92;nLabels not defined in Instance Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

The template is used to generate the keys and values for GCP Spanner instance.&#92;n&#92;nLabels not defined in Instance Labels Template will not be modified or deleted. Setting a label value to `undefined` will result in the label being deleted.&#92;n&#92;nSee [Labels](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

Check or Enforce access checking on the GCP Spanner Instance policy.&#92;n&#92;nGoogle Cloud IAM allows you to control who has access to the&#92;nspanner instance via an IAM Policy. The Trusted Access policy&#92;nallows you to configure whether Guardrails will evaluate or&#92;nenforce restrictions on which members are allowed to be granted&#92;naccess.&#92;n&#92;nIf enabled, the members in the IAM policy will be evaluated&#92;nagainst the list of allowed members in each of the Trusted&#92;nAccess sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc).&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

List of GCP Domains that are trusted for access in the GCP Spanner Instance policy.&#92;n&#92;nThis policy is used by the GCP &gt; Spanner &gt; Instance &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

List of GCP Groups that are trusted for access in the GCP Spanner Instance policy.&#92;n&#92;nThis policy is used by the GCP &gt; Spanner &gt; Instance &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

List of GCP Projects that are trusted for access in the GCP Spanner Instance policy.&#92;nThis policy is used by the GCP &gt; Spanner &gt; Instance &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether members of type &quot;project&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n```&#92;nexample:&#92;n  - dev-aaa&#92;n  - dev-aab&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all projects.&#92;n

List of GCP Service Accounts that are trusted for access in the GCP Spanner Instance policy.&#92;n&#92;nThis policy is used by the GCP &gt; Spanner &gt; Instance &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

List of GCP Users that are trusted for access in the GCP Spanner Instance policy.&#92;n&#92;nThis policy is used by the GCP &gt; Spanner &gt; Instance &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

A list of GCP regions in which GCP Spanner instances are supported for use.&#92;n&#92;nAny instances in a region not listed here will not be recorded in CMDB.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n

GCP > Spanner > Instance > Regions

Configure the number of GCP Spanner instances that can be used for this region and the current consumption against the limit.&#92;n&#92;nYou can configure the behavior of the control with this  `GCP &gt; Spanner &gt; Instance &gt; Usage` policy.&#92;n

Maximum number of items that can be created for this region

A list of GCP regions in which GCP Spanner resources are approved for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP Spanner resources&#39; Approved &gt; Regions policies.&#92;n

GCP > Spanner > Approved Regions [Default]

Configure whether to record and synchronize details for the GCP Spanner spanner into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;nAll policies and controls in Guardrails are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

GCP logs [advanced filter](https://cloud.google.com/logging/docs/view/advanced-filters)&#92;nused to specify a subset of log entries that is forwarded to the Guardrails Event Handlers&#92;nby the logging sink on behalf of GCP Spanner.&#92;n

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter

GCP > Turbot > Event Handlers > Logging > Sink > Compiled Filter > @turbot/gcp-spanner

GCP > Spanner > Enabled

A template used to generate the keys and values for GCP Spanner resources.&#92;n&#92;nBy default, all Spanner resource Labels &gt; Template policies will use this value.&#92;n

GCP > Spanner > Labels Template [Default]

GCP > Spanner > Permissions > Levels

Configure whether permissions policies are in effect for GCP Spanner.&#92;nThis setting does not affect Project level permissions (GCP/Admin, GCP/Owner, etc).&#92;n&#92;n**Note:** The behavior of this policy depends on the value of GCP &gt; Permissions.&#92;n

GCP > Spanner > Permissions

GCP > Spanner > Permissions > Levels > Modifiers

Define the permissions levels that can be used to grant access to Spanner&#92;nan GCP project. Permissions levels defined will appear in the UI to assign access to Guardrails users.&#92;n&#92;n**Note:** Some services do not use all permissions levels, and any permissions level that has&#92;nno permissions associated will not be created even if it is selected here.&#92;n

A map of GCP API to Guardrails Permission Level used to customize Guardrails&#39; standard permissions.&#92;nYou can add, remove or redefine the mapping of GCP API operations to Guardrails permissions levels here.&#92;n&#92;n**Note:** Modifiers are cumulative - if you add a permission to the metadata level, it is also added&#92;n to readOnly, operator and admin. Modifier policies set here will “roll up” to the GCP level too - if&#92;n you add a permission to Admin, it will be granted to GCP/Storage/Admin and also GCP/Admin&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;storage.bucket.create&quot;: admin&#92;n  - &quot;sql.database.create&quot;: metadata&#92;n```&#92;n

A list of GCP regions in which GCP Spanner resources are supported for use.&#92;n&#92;nThe expected format is an array of regions names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all GCP Spanner resources&#39; Regions policies.&#92;n

GCP > Spanner > Regions

List of GCP Domains that are trusted for access in the GCP Spanner policy.&#92;n&#92;nThis policy is used by the GCP &gt; Spanner &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` array will remove all domains.&#92;n

GCP > Spanner > Trusted Domains [Default]

List of GCP Groups that are trusted for access in the GCP Spanner policy.&#92;n&#92;nThis policy is used by the GCP &gt; Spanner &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;group&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - notification@company.com&#92;n  - &quot;*@company.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all groups.&#92;n

GCP > Spanner > Trusted Groups [Default]

List of GCP Projects that are trusted for access in the GCP Spanner policy.&#92;n&#92;nThis policy is used by the GCP &gt; Spanner &gt; Policy &gt; Trusted Access&#92;ncontrol to determine whether members of type &quot;project&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n```&#92;nexample:&#92;n  - dev-aaa&#92;n  - dev-aab&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all projects.&#92;n

GCP > Spanner > Trusted Projects [Default]

List of GCP Service Accounts that are trusted for access in the GCP Spanner policy.&#92;n&#92;nThis policy is used by the GCP &gt; Spanner &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;serviceAccount&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - project-owner@dev-aaa.iam.gserviceaccount.com&#92;n  - &quot;*&quot; # All service account trusted&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all service accounts.&#92;n

GCP > Spanner > Trusted Service Accounts [Default]

List of GCP Users that are trusted for access in the GCP Spanner policy.&#92;n&#92;nThis policy is used by the GCP &gt; Spanner &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;user&quot; are allowed&#92;nto be granted access.You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;*@company.com&quot; # All users with email ending in @company.com are trusted&#92;n  - &quot;test@dev-company.com&quot;&#92;n  - &quot;dummy@gmail.com&quot;&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all users.&#92;n

Mod: gcp-spanner

Recommended Version

Resource Types

Controls

IAM Roles

Policies