cis_extensions.confidential_computing_dry_run — version 1.3
Source: presets
Purpose
GENERATED by scripts/build_dry_run_fragments.py from confidential-computing.satz — do not edit.
The dry-run twin of confidential-computing.satz. Google evaluates every rule below, writes a violation to the audit log for each action it WOULD have blocked, and blocks nothing — so the organisation's own numbers answer "will this break us?" before the control is enforced. Read them in Cloud Logging:
protoPayload.metadata."@type"="type.googleapis.com/google.cloud.audit.OrgPolicyViolationInfo"
Promote by switching cis_confidential_computing_dry_run off and cis_confidential_computing on. Both on at once is refused: the estate would declare the same policy twice, once measuring and once blocking.
This fragment carries NO claim. A dry run discharges no control while it runs, and
require reports the control as unmet, which is the truth.
Use it
params {
cis_confidential_computing_dry_run = true
}
use "presets/cis/confidential-computing-dry-run.satz" when cis_confidential_computing_dry_run
cis is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by CIS_GCP_Foundation_4_0, and the estate's own binding wins.
Needs from outside the pack:
customer_organization_id— declared byestate_core; use one of them alongside, or declare it in the estate.
Params
None — the pack takes everything from the estate's params.
Notices
What to run once this pack is switched on. satz shows each notice when the pack goes on and until the estate binds its param true; every command that writes to the organisation refuses while one whose severity is error is open.
| param | run | severity | what and why |
|---|---|---|---|
cis |
satz adopt <estate> --execute --import |
error | Google may already hold a policy this pack declares on the organisation, set by an administrator or by default, and an apply that creates a policy that exists stops on 409 POLICY_ALREADY_EXISTS. Run satz adopt once the pack is on, so every live policy is in the state before the apply; with --import it binds this param itself when it has run. |
Contributes
| resource type | labels |
|---|---|
google_org_policy_policy |
compute-managed-restrict |
Claims
None — this pack proves no control by itself.
History
| version | date | change |
|---|---|---|
| 1.3 | 2026-09-30 | GENERATED from confidential-computing.satz 1.3: the version follows the source pack, whose claims gained their measure without satz; a twin carries no claim, so nothing here changes but the version |
| 1.2 | 2026-09-20 | GENERATED from confidential-computing.satz 1.2: the same notice, now severity = error, on its own param |
| 1.1 | 2026-09-19 | GENERATED from confidential-computing.satz 1.1: the same notice, on its own param cis, because the twin is switched on on its own |
| 1.0 | 2026-09-13 | first version, GENERATED by scripts from confidential-computing.satz — do not edit. The same constraint with dry_run_spec instead of spec and every claim dropped: Google evaluates each rule, logs every action it would have blocked, and blocks none, so the violation count sizes the control against a live organisation before it bites. It discharges nothing while it runs and carries no claim, so require reports the control unmet, which is the truth. Its version tracks the fragment it is derived from |
The whole library's history: the changelog in presets/CHANGELOG.md.
Notes
No notes yet.