rage.fail

gcp-orgpolicy-custom-constraint-node

explicit gcp emits HasPolicy

match (record)

{ "field": "name", "resource_type": "google.cloud.orgpolicy.CustomConstraint" }

emit

source type	`*`
target type	`Policy`
source	`<organization boundary node>`
target	`<OrganizationPolicy node (custom constraint definition), subtype OrganizationPolicy>`

Narrative

Organization defines custom org-policy constraint {constraint}.

Raw rule rules/explicit/gcp-orgpolicy.yaml

id: gcp-orgpolicy-custom-constraint-node
emits: HasPolicy
applies_to:
- gcp
match_record:
  resource_type: google.cloud.orgpolicy.CustomConstraint
  field: name
emit:
  source_type: '*'
  target_type: Policy
  source: <organization boundary node>
  target: <OrganizationPolicy node (custom constraint definition), subtype OrganizationPolicy>
  api_source: orgpolicy.customConstraints.list / .get
  evidence_field: name, actionType, condition, resourceTypes
  annotate:
    constraint: <constraints/custom.<name> verbatim>
    custom: true
  narrative: Organization defines custom org-policy constraint {constraint}.