Preset packs

One page per pristine pack, derived from the pack file by satz doc-packs, in the groups and the order of presets/library-groups.txt. The library's conventions and its prose per group are presets/README.md; its history — what each release refuses and one row per pack version — is presets/CHANGELOG.md, repeated per pack under History on each page here.

49 packs · 237 resources · 83 claims over cis-gcp 4.0 and cis-gcp 5.0.

Estate map and core

pack	version	what it does	resources	claims
`estate_map`	2.9	The map: which packs make up this estate, asked as questions — so an interview has a path.	0	—
`estate_core`	2.4	The questions every estate has to answer on day 0, with the params they answer.	0	—

Security groups and exemptions

pack	version	what it does	resources	claims
`s1_security_groups`	1.2	The S1 security group model in ONE file: the five admin groups and their organization-level role grants.	11	—
`s2_security_groups`	1.2	The S2 security group model: S1's five admin groups plus a distinct NETWORK ADMINS group, and the org-level grants split accordingly.	13	—
`exemptions.exemption_tag`	2.0	Exemption classes: one organisation tag key, one value per KIND of exemption, and nothing bound to any of them.	9	—

Billing and budget

pack	version	what it does	resources	claims
`billing_account_permissions`	1.2	Billing-account IAM, split by audience.	4	—
`organization_budget`	2.0	Budgets on the infrastructure billing account with alert thresholds: one for the whole account, and one per entry of `budgets` for a set of projects or folders.	3	—
`billing_export`	1.0	Cloud Billing usage and cost data, exported to BigQuery in a project of its own — where the spend is KEPT, as opposed to the budget that alarms on it.	3	—

CIS baseline and extensions

pack	version	what it does	resources	claims
`CIS_GCP_Foundation_4_0`	2.19	The CIS GCP Foundation 4.0 organization-policy set, managed constraints included.	25	30 — cis-gcp 4.0, cis-gcp 5.0
`cis_extensions.dns_logging`	1.3	CIS 5.0 §2.13 — DNS query logging, as far as an org policy can carry it.	2	1 — cis-gcp 5.0
`cis_extensions.internet_ssh_rdp`	1.2	CIS 3.6 / 3.7 — SSH and RDP closed to the internet, for every network in the organisation at once.	6	4 — cis-gcp 4.0, cis-gcp 5.0
`cis_extensions.block_project_ssh_keys`	1.3	CIS 4.3 — block project-wide SSH keys.	1	2 — cis-gcp 4.0, cis-gcp 5.0
`cis_extensions.block_project_ssh_keys_dry_run`	1.3	GENERATED by scripts/build_dry_run_fragments.py from block-project-ssh-keys.satz — do not edit.	1	—
`cis_extensions.shielded_vm`	1.3	CIS 4.8 — Shielded VM.	1	2 — cis-gcp 4.0, cis-gcp 5.0
`cis_extensions.confidential_computing`	1.3	CIS 4.11 — Confidential Computing.	1	2 — cis-gcp 4.0, cis-gcp 5.0
`cis_extensions.confidential_computing_dry_run`	1.3	GENERATED by scripts/build_dry_run_fragments.py from confidential-computing.satz — do not edit.	1	—
`cis_extensions.cloud_sql`	1.4	CIS 6.5 and 6.6/6.7 — Cloud SQL network exposure.	4	4 — cis-gcp 4.0, cis-gcp 5.0
`cis_extensions.cloud_sql_dry_run`	1.4	GENERATED by scripts/build_dry_run_fragments.py from cloud-sql.satz — do not edit.	4	—
`cis_extensions.cloud_sql_iam_and_deletion_protection`	1.3	CIS 5.0 §6.6 / §6.9 — Cloud SQL instances sign database users in through IAM, and cannot be deleted while deletion protection is on.	4	2 — cis-gcp 5.0
`cis_extensions.cloud_sql_iam_and_deletion_protection_dry_run`	1.3	GENERATED by scripts/build_dry_run_fragments.py from cloud-sql-iam-and-deletion-protection.satz — do not edit.	4	—
`cis_extensions.cmek`	1.4	CIS 7.2, 7.3 and 8.1 — customer-managed encryption keys.	2	6 — cis-gcp 4.0, cis-gcp 5.0
`cis_extensions.api_key_services`	1.4	CIS 4.0 §1.14 / 5.0 §1.15 — API keys restricted to the APIs an application needs.	1	2 — cis-gcp 4.0, cis-gcp 5.0
`cis_extensions.api_key_services_dry_run`	1.4	GENERATED by scripts/build_dry_run_fragments.py from api-key-services.satz — do not edit.	1	—
`cis_extensions.bucket_retention`	1.5	CIS 4.0 §2.3 / 5.0 §2.4 — retention on the log-export bucket.	2	2 — cis-gcp 4.0, cis-gcp 5.0
`cis_extensions.bucket_retention_dry_run`	1.5	GENERATED by scripts/build_dry_run_fragments.py from bucket-retention.satz — do not edit.	2	—
`cis_extensions.access_approval`	1.1	CIS 4.0 §2.15 / 5.0 §2.16 — Access Approval: Google personnel reach the organisation's content only after someone approves the request.	1	2 — cis-gcp 4.0, cis-gcp 5.0

Monitoring and logging

pack	version	what it does	resources	claims
`monitoring.organization_audit_logsink`	1.8	Organization-wide audit log sink into a GCS bucket — the compliance archive.	5	6 — cis-gcp 4.0, cis-gcp 5.0
`monitoring.organization_cis_log_alerts_central`	1.7	Centralized log-based alerting for CIS 2.5-2.12 in 5.0 numbering, 2.4-2.11 in 4.0.	20	18 — cis-gcp 4.0, cis-gcp 5.0
`project_cis_log_alerts`	1.1	CIS log metric filters and alert policies, per project.	17	—
`essential_contacts_organization`	1.4	One organization-level Essential Contact, subscribed to every notification category Google routes.	1	—

Networking

pack	version	what it does	resources	claims
`shared_network`	1.0	A shared VPC in a host project of its own: one network, the subnets the projects ask for, and a network firewall policy whose rules they ask for.	7	—

Projects and interfaces

pack	version	what it does	resources	claims
`project_onboarding`	1.1	The projects on the estate, one entry of `projects` each.	1	—
`workload_deployer`	1.0	One deployer identity per customer team.	6	—
`interface_notice`	1.2	Tells the projects that read this estate's interface when an exported value changes: one Pub/Sub message per apply that changes one.	5	—

Security operations and integrations

pack	version	what it does	resources	claims
`scc_service_enablement`	1.2	Turns every Security Command Center service on at the organization, through the one step that has no provider resource.	0	—
`scc_notifications`	1.2	Security Command Center findings, published to a Pub/Sub topic as they are raised — the piece downstream of enablement that every customer needs.	3	—
`scc_findings_mail`	1.0	Security Command Center findings, delivered to a mailbox — the answer to "who gets told", for a customer who has no SIEM reading the topic.	3	—
`scc_findings_siem`	1.0	Security Command Center findings, pulled off the topic by an external SIEM.	2	—
`scc_export`	1.1	Security Command Center findings, exported to BigQuery as they are raised — where findings are KEPT, as opposed to where they are sent.	4	—
`sa_security_audit`	1.1	A read-only security-audit service account, with the group that may impersonate it.	4	—
`integrations.microsoft_defender_for_cloud`	0.7	Microsoft Defender for Cloud — GCP onboarding, the foundation.	6	—
`integrations.microsoft_defender_for_cloud_cspm`	0.1	Microsoft Defender for Cloud — the CSPM plan.	5	—
`integrations.microsoft_defender_for_cloud_cspm_role_default`	0.1	Microsoft Defender for Cloud — the CSPM custom role, DEFAULT access mode.	1	—
`integrations.microsoft_defender_for_cloud_cspm_role_least_privilege`	0.1	Microsoft Defender for Cloud — the CSPM custom role, LEAST PRIVILEGE mode.	1	—
`integrations.microsoft_sentinel`	1.1	Microsoft Sentinel's GCP connector — the federation half, once per customer.	7	—
`integrations.microsoft_sentinel_auditlogs`	1.0	The organisation's audit logs, on their way to Microsoft Sentinel.	5	—
`integrations.microsoft_sentinel_network_logs`	1.0	The four network log streams, on their way to Microsoft Sentinel.	20	—

Continuous verification

pack	version	what it does	resources	claims
`ci.verification_runner`	1.1	Watches an estate's repository: every push must still compile, every night the live organisation must still match.	7	—
`ci.verification_runner_grant`	1.1	Lets a verification runner act as this estate's IaC service account.	1	—

Framework coverage

What some pack in this library CLAIMS — never a verdict on an estate. A claim is proof only once its witnesses are emitted; satz require <framework> <estate> judges an estate.

framework	controls in the catalog	claimed by a pack	claimed by none
cis-gcp 4.0	38	35	2.12, 2.13, 2.14
cis-gcp 5.0	45	40	1.1.1, 1.1.2, 1.1.3, 2.2, 2.15