cis_extensions.block_project_ssh_keys — version 1.3

Source: presets/cis/block-project-ssh-keys.satz

Purpose

CIS 4.3 — block project-wide SSH keys.

Opt-in because Google still marks this managed constraint PREVIEW, and because an estate that relies on project-wide keys for break-glass access loses it the moment this is enforced. There is no legacy equivalent to fall back to.

The constraint name and its shape were verified against a live organisation's OrgPolicy ListConstraints, not transcribed.

Use it

params {
  cis_block_project_ssh_keys = true
}

use "presets/cis/block-project-ssh-keys.satz" when cis_block_project_ssh_keys

cis_block_project_ssh_keys is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by CIS_GCP_Foundation_4_0, and the estate's own binding wins.

Needs from outside the pack:

Params

None — the pack takes everything from the estate's params.

Notices

What to run once this pack is switched on. satz shows each notice when the pack goes on and until the estate binds its param true; every command that writes to the organisation refuses while one whose severity is error is open.

param run severity what and why
cis_block_project_ssh_keys_adopted satz adopt <estate> --execute --import error Google may already hold a policy this pack declares on the organisation, set by an administrator or by default, and an apply that creates a policy that exists stops on 409 POLICY_ALREADY_EXISTS. Run satz adopt once the pack is on, so every live policy is in the state before the apply; with --import it binds this param itself when it has run.

Contributes

resource type labels
google_org_policy_policy compute-managed-blockProjectSshKeys

Claims

framework control title kind witnesses interpretation
cis-gcp 4.0 4.3 Block project-wide SSH keys on VM instances implements google_org_policy_policy.compute_managed_blockProjectSshKeys The block-project-ssh-keys metadata key cannot be set to false, so instances do not accept project-wide keys.
cis-gcp 5.0 4.3 Block project-wide SSH keys on VM instances implements google_org_policy_policy.compute_managed_blockProjectSshKeys As for 4.0 §4.3 (5.0 §4.3, unchanged).

What the controls ask (this project's paraphrase from the catalog — never the framework's own text):

Every resource this pack contributes is a witness of a claim above.

History

version date change
1.3 2026-09-30 every claim states its measure without satz: gcloud (the commands that meet the control the way the claim's resources do), gcloud_check (the commands that show whether it is met) and risk (what goes wrong without it); require and report-compliance carry them in each control's measures. Nothing emitted changes
1.2 2026-09-20 the notice's before = apply becomes severity = error: the same refusal, stated once by the pack instead of inside the two commands that read it — every command that writes to the organisation refuses while it is open. Nothing emitted changes, and the param that acknowledges it is unchanged
1.1 2026-09-19 a notice: once the pack is switched on, satz adopt <estate> --execute --import is to run before the apply, because a policy it declares may already be live and creating it stops on 409 POLICY_ALREADY_EXISTS. The estate acknowledges it with cis_block_project_ssh_keys_adopted = true, which adopt --execute --import binds itself when it has run; transpile --apply and bootstrap refuse while it is open. The param is never emitted, so the plan does not move
1.0 2026-09-04 CIS 4.3, opt-in: the managed constraint is still PREVIEW and has no legacy equivalent

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

Google still marks this managed constraint PREVIEW, and there is no legacy form to fall back to. Project-wide SSH keys are a common break-glass path: check what uses them, and have OS Login or per-instance keys working first.