`scc_service_enablement` — version 1.2

Source: presets/scc/scc-service-enablement.satz

Purpose

Turns every Security Command Center service on at the organization, through the one step that has no provider resource.

This pack contains no resources.

google/google-beta carry NO binding for securitycentermanagement's SecurityCenterService. Re-verified against provider 7.14.1: the provider ships 35 google_scc_* / google_securityposture_* types and none of them is service enablement or tier activation — the google_scc_management_* ones are custom modules only. Turning Security Health Analytics, Event Threat Detection, Container Threat Detection and the rest on therefore cannot be written as a resource in any language satz compiles.

So the step stays a script, and this pack binds it: satz run-actions <estate>.satz --execute runs it with the organisation id the estate already declares, instead of a human retyping it into a shell.

WHAT THIS DOES NOT COVER Everything DOWNSTREAM of enablement is codeable and belongs in a preset of its own: custom modules (SHA + ETD), sources and source IAM, notification configs (the v2 resources — the v1 API answers "This API is no longer available" on a live org), BigQuery exports, mute configs, and google_securityposture_posture(_deployment).

TIER ACTIVATION IS NOT HERE EITHER. Enabling a service on an organisation on the Standard tier fails at the API, and no flag changes that. Activate the tier first — a console action — then run this.

PREREQUISITES; the script reports each one that is missing:

securitycenter.googleapis.com and securitycentermanagement.googleapis.com enabled on the quota project.
The §1.1 domain-lock interaction: SCC's service agents are granted roles at the organisation, and a managed iam.managed.allowedPolicyMembers policy refuses any agent the baseline does not list. In the console, a refused agent shows as SCC not staying activated and asking to be activated on every visit. The CIS pack's subject list carries the five agents SCC activation creates; enabling more services does not add to them (measured on a live organisation).

NOTHING RUNS AT TRANSPILE TIME. An action is inert until run-actions is invoked, it emits nothing, and no claim can cover it — satz records that the step exists and never says what it did. report-compliance does not report whether SCC is on; Cloud Asset Inventory does not carry it.

Use it

params {
  // the pack's own defaults — copy only the lines you change
  scc_optional_services = "leave"
}

use "presets/scc/scc-service-enablement.satz"

Needs from outside the pack:

customer_organization_id — declared by estate_core; use one of them alongside, or declare it in the estate.

Params

param	default
`scc_optional_services`	`"leave"`

Questions

What to ask before this pack is configured, and what changing the answer costs.

asks about	prompt	reversal	blast	recommends
`scc_optional_services`	Two detectors are not switched on with the rest — which of them does this organisation want? (leave · none · all · the ones you name)	edit	low	—

scc_optional_services — Web Security Scanner crawls the customer's own web applications with real requests against whatever is listening, and Artifact Analysis is billed per container image scanned. Everything else Security Command Center offers is switched on with the baseline. leave, the default, touches neither — which is how one somebody switched on in the console survives. none switches both off, all switches both on, and naming them makes the estate the source of truth: the ones named are on and the rest go off.

Contributes

No resources: this pack's content is the action below — a step with no provider binding.

Actions: 1 — satz run-actions executes scc-services (scc-enable-all.sh). Not covered by any claim.

scc-services — SCC service enablement has no provider resource — google 7.14.1 ships 35 google_scc_/google_securityposture_ types and none of them is enablement or tier activation (phase before-apply)

Claims

None — this pack proves no control by itself.

History

version	date	change
1.2	2026-09-12	the optional-detector question names what each of the two does — Web Security Scanner sends real requests at whatever is listening, Artifact Analysis is billed per image — and spells out the four answers. No emission change
1.1	2026-09-12	`scc_optional_services` (asked): `leave`, `all`, `none`, or the ones it names, for the two detectors outside the baseline — Web Security Scanner, which crawls the customer's web applications, and Artifact Analysis, billed per image scan. The script could only ever switch services ON, so an opt-in enabled by hand in the console stayed on for ever; `disable` is how an estate takes them back
1.0	2026-09-04	first version: no resources, one `action` binding `scc/scc-enable-all.sh`. SCC service enablement and tier activation have no provider resource (7.14.1 ships 35 `google_scc_`/`google_securityposture_` types and none of them is enablement), so the estate declares the step and `satz run-actions` runs it with the org id the estate already carries. `phase = "before-apply"`; everything downstream of enablement stays for a later pack

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

No resources: this pack is an action, and it runs only under satz run-actions --execute. Tier activation is NOT here — enabling a service on an organisation with no Premium or Enterprise subscription fails at the API, so the tier is activated in the console first.

Security Command Center's five service agents must be in the CIS pack's allowed_policy_member_subjects before activation, or the domain-restriction policy refuses their grants.

This pack decides whether findings are raised; scc_notifications decides where they go. Enablement on its own means findings only someone opening the console will see.

scc_service_enablement — version 1.2