Add new org policies to FAST (#2215)

* Add new org policies to FAST * Fix tests
GoogleCloudPlatform · Apr 15, 2024 · a74a106 · a74a106
1 parent e919bb6
commit a74a106
Show file tree

Hide file tree

Showing 5 changed files with 21 additions and 4 deletions.
diff --git a/fast/stages/0-bootstrap/data/org-policies/iam.yaml b/fast/stages/0-bootstrap/data/org-policies/iam.yaml
@@ -17,3 +17,9 @@ iam.disableServiceAccountKeyCreation:
 iam.disableServiceAccountKeyUpload:
   rules:
     - enforce: true
+
+iam.serviceAccountKeyExposureResponse:
+  rules:
+    - allow:
+        values:
+          - DISABLE_KEY
diff --git a/fast/stages/0-bootstrap/data/org-policies/serverless.yaml b/fast/stages/0-bootstrap/data/org-policies/serverless.yaml
@@ -11,6 +11,7 @@ run.allowedIngress:
     - allow:
         values:
           - is:internal-and-cloud-load-balancing
+
 # run.allowedVPCEgress:
 #   rules:
 #   - allow:
@@ -32,3 +33,8 @@ run.allowedIngress:
 # cloudfunctions.requireVPCConnector:
 #   rules:
 #   - enforce: true
+
+# constraints/cloudfunctions.restrictAllowedGenerations:
+#   - allow:
+#       values:
+#       - is:2ndGen
diff --git a/fast/stages/0-bootstrap/data/org-policies/storage.yaml b/fast/stages/0-bootstrap/data/org-policies/storage.yaml
@@ -13,3 +13,8 @@ storage.uniformBucketLevelAccess:
 storage.publicAccessPrevention:
   rules:
     - enforce: true
+
+
+storage.secureHttpTransport:
+  rules:
+    - enforce: true
diff --git a/tests/fast/stages/s0_bootstrap/checklist.yaml b/tests/fast/stages/s0_bootstrap/checklist.yaml
@@ -362,7 +362,7 @@ counts:
   google_essential_contacts_contact: 3
   google_logging_organization_sink: 3
   google_logging_project_bucket_config: 3
-  google_org_policy_policy: 20
+  google_org_policy_policy: 22
   google_organization_iam_binding: 27
   google_organization_iam_custom_role: 7
   google_organization_iam_member: 35
@@ -381,4 +381,4 @@ counts:
   google_tags_tag_key: 1
   google_tags_tag_value: 1
   modules: 17
-  resources: 196
+  resources: 198
diff --git a/tests/fast/stages/s0_bootstrap/simple.yaml b/tests/fast/stages/s0_bootstrap/simple.yaml
@@ -41,7 +41,7 @@ counts:
   google_essential_contacts_contact: 3
   google_logging_organization_sink: 3
   google_logging_project_bucket_config: 3
-  google_org_policy_policy: 20
+  google_org_policy_policy: 22
   google_organization_iam_binding: 27
   google_organization_iam_custom_role: 7
   google_organization_iam_member: 22
@@ -61,7 +61,7 @@ counts:
   google_tags_tag_value: 1
   local_file: 7
   modules: 16
-  resources: 187
+  resources: 189
 
 outputs:
   custom_roles: