Policy Packs

guardrails-samples

Ensure that only authorized and verified domains can interact with your project's IAM policies.

Enforce Trusted Domains to Access GCP IAM Project Policy

main

gcp_iam_project_iam_policy_trusted_access

Check or Enforce access checking on the Project IAM Policy.&#92;n&#92;nGoogle Cloud IAM allows you to control who has access to the&#92;nproject via an IAM Policy.  The Trusted Access policy&#92;nallows you to configure whether Guardrails will evaluate or&#92;nenforce restrictions on which members are allowed to be granted&#92;naccess.&#92;n&#92;nIf enabled, the members in the IAM policy will be evaluated&#92;nagainst the list of allowed members in each of the Trusted&#92;nAccess sub-policies (Trusted Access &gt; Domains,&#92;nTrusted Access &gt; Groups, etc).&#92;n&#92;nIf set to &quot;Enforce: Trusted Access &gt; *&quot;, access to non-trusted&#92;nmembers will be removed.&#92;n

projectIamPolicyTrustedAccess

GCP > Project > Policy > Trusted Access

gcp_iam_project_iam_policy_trusted_domains

List of GCP Domains that are trusted for access in the Project IAM Policy.&#92;n&#92;nThis policy is used by the GCP &gt; Project &gt; Policy &gt; Trusted Access&#92;ncontrol to determine which members of type &quot;domain&quot; are allowed&#92;nto be granted access. You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;n```&#92;nexample:&#92;n  - company.com&#92;n  - company-dev.org&#92;n```&#92;n&#92;n**Note**: Setting the policy to `Empty` will remove all domains.&#92;n

projectIamPolicyTrustedDomains

GCP > Project > Policy > Trusted Access > Domains

turbot_policy_setting.gcp_iam_project_iam_policy_trusted_access

turbot_policy_setting.gcp_iam_project_iam_policy_trusted_domains

Policy	Setting	Note
GCP > Project > Policy > Trusted Access	Check: Trusted Access > *
GCP > Project > Policy > Trusted Access > Domains	- example.com - acme.com

Policy Settings