saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 00:23:15 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/implementing-gcp-organization-policy-constraints/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.0 KiB
Raw Blame History

API Reference: Implementing GCP Organization Policy Constraints

gcloud CLI Commands

# List all org policies
gcloud org-policies list --organization=ORG_ID

# Describe specific constraint
gcloud org-policies describe constraints/compute.vmExternalIpAccess --organization=ORG_ID

# Set policy from YAML
gcloud resource-manager org-policies set-policy policy.yaml --organization=ORG_ID

# Set custom constraint
gcloud org-policies set-custom-constraint custom-constraint.yaml

# Check effective policy on project
gcloud org-policies list --project=PROJECT_ID

Baseline Security Constraints

Constraint Type Purpose
compute.vmExternalIpAccess List/Deny Block public VM IPs
compute.requireOsLogin Boolean Mandate OS Login for SSH
compute.disableSerialPortAccess Boolean Disable serial port
storage.uniformBucketLevelAccess Boolean Uniform bucket ACLs
sql.restrictPublicIp Boolean No public Cloud SQL
iam.disableServiceAccountKeyCreation Boolean Force Workload Identity
gcp.resourceLocations List/Allow Restrict to approved regions

Policy YAML Formats

Boolean Policy

constraint: constraints/compute.requireOsLogin
booleanPolicy:
  enforced: true

List Policy (Deny All)

constraint: constraints/compute.vmExternalIpAccess
listPolicy:
  allValues: DENY

List Policy (Allow Specific)

constraint: constraints/gcp.resourceLocations
listPolicy:
  allowedValues:
    - "in:us-locations"
    - "in:eu-locations"

Terraform Resource

resource "google_organization_policy" "example" {
  org_id     = var.org_id
  constraint = "constraints/compute.requireOsLogin"
  boolean_policy { enforced = true }
}

References