Policy Packs

guardrails-samples

Regular key rotation ensures that any potentially exposed or compromised keys are rendered obsolete, thereby protecting access to GCP resources and ensuring compliance.

Enforce GCP IAM User-Managed Service Account Keys Are Rotated Every 90 Days

main

gcp_iam_service_account_active_age

The age after which the GCP IAM service account key&#92;nis no longer considered active. If a create time is unavailable, the time Guardrails discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use, and if not, has&#92;nthe ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; IAM &gt; Service Account Key &gt; Active &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action. Each Active&#92;nsub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n**Note** the contrast with Approved, where if the resource appears to be Unapproved&#92;nfor any reason it will be considered Unapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

serviceAccountKeyActiveAge

GCP > IAM > Service Account Key > Active > Age

gcp_iam_service_account_key_active

Determine the action to take when an GCP IAM service account key, based on the `GCP &gt; IAM &gt; Service Account Key &gt; Active &gt; *` policies.&#92;n&#92;nThe control determines whether the resource is in active use, and if not,&#92;nhas the ability to delete / cleanup the resource. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`GCP &gt; IAM &gt; Service Account Key &gt; Active &gt; *`), raises an alarm, and takes the defined enforcement&#92;naction. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n**Note** the contrast with Approved, where if the&#92;nresource appears to be Unapproved for any reason it will be considered&#92;nUnapproved.&#92;n&#92;nSee [Active](https://turbot.com/guardrails/docs/concepts/guardrails/active) for more information.&#92;n

serviceAccountKeyActive

GCP > IAM > Service Account Key > Active

turbot_policy_setting.gcp_iam_service_account_key_active

turbot_policy_setting.gcp_iam_service_account_active_age

Policy	Setting	Note
GCP > IAM > Service Account Key > Active	Check: Active
GCP > IAM > Service Account Key > Active > Age	Force inactive if age > 90 days

Policy Settings