mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
74 lines
2.0 KiB
Markdown
74 lines
2.0 KiB
Markdown
# API Reference: Implementing GCP Organization Policy Constraints
|
|
|
|
## gcloud CLI Commands
|
|
|
|
```bash
|
|
# List all org policies
|
|
gcloud org-policies list --organization=ORG_ID
|
|
|
|
# Describe specific constraint
|
|
gcloud org-policies describe constraints/compute.vmExternalIpAccess --organization=ORG_ID
|
|
|
|
# Set policy from YAML
|
|
gcloud resource-manager org-policies set-policy policy.yaml --organization=ORG_ID
|
|
|
|
# Set custom constraint
|
|
gcloud org-policies set-custom-constraint custom-constraint.yaml
|
|
|
|
# Check effective policy on project
|
|
gcloud org-policies list --project=PROJECT_ID
|
|
```
|
|
|
|
## Baseline Security Constraints
|
|
|
|
| Constraint | Type | Purpose |
|
|
|-----------|------|---------|
|
|
| `compute.vmExternalIpAccess` | List/Deny | Block public VM IPs |
|
|
| `compute.requireOsLogin` | Boolean | Mandate OS Login for SSH |
|
|
| `compute.disableSerialPortAccess` | Boolean | Disable serial port |
|
|
| `storage.uniformBucketLevelAccess` | Boolean | Uniform bucket ACLs |
|
|
| `sql.restrictPublicIp` | Boolean | No public Cloud SQL |
|
|
| `iam.disableServiceAccountKeyCreation` | Boolean | Force Workload Identity |
|
|
| `gcp.resourceLocations` | List/Allow | Restrict to approved regions |
|
|
|
|
## Policy YAML Formats
|
|
|
|
### Boolean Policy
|
|
```yaml
|
|
constraint: constraints/compute.requireOsLogin
|
|
booleanPolicy:
|
|
enforced: true
|
|
```
|
|
|
|
### List Policy (Deny All)
|
|
```yaml
|
|
constraint: constraints/compute.vmExternalIpAccess
|
|
listPolicy:
|
|
allValues: DENY
|
|
```
|
|
|
|
### List Policy (Allow Specific)
|
|
```yaml
|
|
constraint: constraints/gcp.resourceLocations
|
|
listPolicy:
|
|
allowedValues:
|
|
- "in:us-locations"
|
|
- "in:eu-locations"
|
|
```
|
|
|
|
## Terraform Resource
|
|
|
|
```hcl
|
|
resource "google_organization_policy" "example" {
|
|
org_id = var.org_id
|
|
constraint = "constraints/compute.requireOsLogin"
|
|
boolean_policy { enforced = true }
|
|
}
|
|
```
|
|
|
|
### References
|
|
|
|
- GCP Org Policy: https://cloud.google.com/resource-manager/docs/organization-policy/overview
|
|
- Constraint List: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
|
|
- CIS GCP Benchmark: https://www.cisecurity.org/benchmark/google_cloud_computing_platform
|