rage.fail

gcp-orgpolicy-has-policy

explicit gcp emits HasPolicy

match (record)

{ "field": "spec.rules", "resource_type": "google.cloud.orgpolicy.Policy" }

where

the policy is ENFORCED: spec.rules present with boolean enforce==true OR a suppressing list rule (denyValues/denyAll/allowAll widening); NOT a dryRunSpec-only policy

emit

source type	`*`
target type	`Policy`
source	`<scope boundary node (Organization/Folder/Project)>`
target	`<OrganizationPolicy node (scope x constraint), subtype OrganizationPolicy>`

Narrative

{scope.name} enforces org policy {constraint} (guardrail): {orgpolicy.name}.

Raw rule rules/explicit/gcp-orgpolicy.yaml

id: gcp-orgpolicy-has-policy
emits: HasPolicy
applies_to:
- gcp
match_record:
  resource_type: google.cloud.orgpolicy.Policy
  field: spec.rules
where:
- 'the policy is ENFORCED: spec.rules present with boolean enforce==true OR a suppressing list rule (denyValues/denyAll/allowAll
  widening); NOT a dryRunSpec-only policy'
emit:
  source_type: '*'
  target_type: Policy
  source: <scope boundary node (Organization/Folder/Project)>
  target: <OrganizationPolicy node (scope x constraint), subtype OrganizationPolicy>
  api_source: orgpolicy.policy.get / cloudasset.assets.analyzeOrgPolicies
  evidence_field: spec.rules, constraint, name
  annotate:
    constraint: <constraints/... verbatim identifier>
    enforced_at: <scope resource name>
    gates: "<edge signatures this constraint suppresses \u2014 see providers/gcp/orgpolicy.md GUARDRAIL\
      \ SECTION>"
  narrative: '{scope.name} enforces org policy {constraint} (guardrail): {orgpolicy.name}.'