cis_extensions.bucket_retention_dry_run — version 1.5
Source: presets
Purpose
GENERATED by scripts/build_dry_run_fragments.py from bucket-retention.satz — do not edit.
The dry-run twin of bucket-retention.satz. Google evaluates every rule below, writes a violation to the audit log for each action it WOULD have blocked, and blocks nothing — so the organisation's own numbers answer "will this break us?" before the control is enforced. Read them in Cloud Logging:
protoPayload.metadata."@type"="type.googleapis.com/google.cloud.audit.OrgPolicyViolationInfo"
Promote by switching cis_bucket_retention_dry_run off and cis_bucket_retention on. Both on at once is refused: the estate would declare the same policy twice, once measuring and once blocking.
This fragment carries NO claim. A dry run discharges no control while it runs, and
require reports the control as unmet, which is the truth.
Use it
params {
cis_bucket_retention_dry_run = true
// the pack's own defaults — copy only the lines you change
allowed_bucket_retention_seconds = [ "34560000" ]
}
use "presets/cis/bucket-retention-dry-run.satz" when cis_bucket_retention_dry_run
cis is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by CIS_GCP_Foundation_4_0, and the estate's own binding wins.
Needs from outside the pack:
customer_organization_id— declared byestate_core; use one of them alongside, or declare it in the estate.
Params
| param | default |
|---|---|
allowed |
[ "34560000" ] |
Questions
What to ask before this pack is configured, and what changing the answer costs.
| asks about | prompt | reversal | blast | recommends |
|---|---|---|---|---|
allowed |
The retention durations, in seconds, a bucket's retention policy may use | edit | low | — |
allowed_bucket_retention_seconds — The default is the 400 days the audit-logsink pack retains. Every bucket in the organisation with a retention policy on another duration can no longer be updated once this is enforced, so the estate's other durations have to be listed first.
Notices
What to run once this pack is switched on. satz shows each notice when the pack goes on and until the estate binds its param true; every command that writes to the organisation refuses while one whose severity is error is open.
| param | run | severity | what and why |
|---|---|---|---|
cis |
satz adopt <estate> --execute --import |
error | Google may already hold a policy this pack declares on the organisation, set by an administrator or by default, and an apply that creates a policy that exists stops on 409 POLICY_ALREADY_EXISTS. Run satz adopt once the pack is on, so every live policy is in the state before the apply; with --import it binds this param itself when it has run. |
Contributes
| resource type | labels |
|---|---|
google_org_policy_policy |
storage-managed-retention, storage-retention (off) |
Claims
None — this pack proves no control by itself.
History
| version | date | change |
|---|---|---|
| 1.5 | 2026-09-30 | GENERATED from bucket-retention.satz 1.5: the version follows the source pack, whose claims gained their measure without satz; a twin carries no claim, so nothing here changes but the version |
| 1.4 | 2026-09-20 | GENERATED from bucket-retention.satz 1.4: the same notice, now severity = error, on its own param |
| 1.3 | 2026-09-19 | GENERATED from bucket-retention.satz 1.3: the same notice, on its own param cis, because the twin is switched on on its own |
| 1.2 | 2026-09-13 | first version, GENERATED by scripts from bucket-retention.satz — do not edit. The same constraint with dry_run_spec instead of spec and every claim dropped: Google evaluates each rule, logs every action it would have blocked, and blocks none, so the violation count sizes the control against a live organisation before it bites. It discharges nothing while it runs and carries no claim, so require reports the control unmet, which is the truth. Its version tracks the fragment it is derived from |
The whole library's history: the changelog in presets/CHANGELOG.md.
Notes
No notes yet.