cis_extensions.api_key_services_dry_run — version 1.4

Source: presets/cis/api-key-services-dry-run.satz

Purpose

GENERATED by scripts/build_dry_run_fragments.py from api-key-services.satz — do not edit.

The dry-run twin of api-key-services.satz. Google evaluates every rule below, writes a violation to the audit log for each action it WOULD have blocked, and blocks nothing — so the organisation's own numbers answer "will this break us?" before the control is enforced. Read them in Cloud Logging:

protoPayload.metadata."@type"="type.googleapis.com/google.cloud.audit.OrgPolicyViolationInfo"

Promote by switching cis_api_key_services_dry_run off and cis_api_key_services on. Both on at once is refused: the estate would declare the same policy twice, once measuring and once blocking.

This fragment carries NO claim. A dry run discharges no control while it runs, and require reports the control as unmet, which is the truth.

Use it

params {
  cis_api_key_services_dry_run = true

  // the pack's own defaults — copy only the lines you change
  allowed_api_key_services = []
}

use "presets/cis/api-key-services-dry-run.satz" when cis_api_key_services_dry_run

cis_api_key_services_dry_run is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by CIS_GCP_Foundation_4_0, and the estate's own binding wins.

Needs from outside the pack:

Params

param default
allowed_api_key_services []

Questions

What to ask before this pack is configured, and what changing the answer costs.

asks about prompt reversal blast recommends
allowed_api_key_services The services an API key bound to a service account may target edit high —

allowed_api_key_services — The pack cannot know which APIs the customer's applications call. Empty is a legitimate answer — no such key may be created at all — but it has to be the customer's answer: every key whose targets are not in this list stops working the moment the control is enforced.

Notices

What to run once this pack is switched on. satz shows each notice when the pack goes on and until the estate binds its param true; every command that writes to the organisation refuses while one whose severity is error is open.

param run severity what and why
cis_api_key_services_dry_run_adopted satz adopt <estate> --execute --import error Google may already hold a policy this pack declares on the organisation, set by an administrator or by default, and an apply that creates a policy that exists stops on 409 POLICY_ALREADY_EXISTS. Run satz adopt once the pack is on, so every live policy is in the state before the apply; with --import it binds this param itself when it has run.

Contributes

resource type labels
google_org_policy_policy iam-managed-disableServiceAccountApiKeyCreation

Claims

None — this pack proves no control by itself.

History

version date change
1.4 2026-09-30 GENERATED from api-key-services.satz 1.4: the version follows the source pack, whose claims gained their measure without satz; a twin carries no claim, so nothing here changes but the version
1.3 2026-09-20 GENERATED from api-key-services.satz 1.3: the same notice, now severity = error, on its own param
1.2 2026-09-19 GENERATED from api-key-services.satz 1.2: the same notice, on its own param cis_api_key_services_dry_run_adopted, because the twin is switched on on its own
1.1 2026-09-13 first version, GENERATED by scripts/build_dry_run_fragments.py from api-key-services.satz — do not edit. The same constraint with dry_run_spec instead of spec and every claim dropped: Google evaluates each rule, logs every action it would have blocked, and blocks none, so the violation count sizes the control against a live organisation before it bites. It discharges nothing while it runs and carries no claim, so require reports the control unmet, which is the truth. Its version tracks the fragment it is derived from

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

No notes yet.