# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

values:
  google_storage_bucket_object.providers["0-org-setup"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-org-state\"\n    impersonate_service_account\
      \ = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n  }\n}\nprovider\
      \ \"google\" {\n  impersonate_service_account = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\nprovider \"google-beta\" {\n  impersonate_service_account = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: providers/0-org-setup-providers.tf
    retention: []
    source: null
    temporary_hold: null
    timeouts: null
  google_storage_bucket_object.providers["0-org-setup-ro"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-org-state\"\n    impersonate_service_account\
      \ = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n  }\n}\nprovider\
      \ \"google\" {\n  impersonate_service_account = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\nprovider \"google-beta\" {\n  impersonate_service_account = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: providers/0-org-setup-ro-providers.tf
    retention: []
    source: null
    temporary_hold: null
    timeouts: null
  google_storage_bucket_object.providers["1-vpcsc"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-stage-state\"\n    impersonate_service_account\
      \ = \"iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n    prefix\
      \ = \"1-vpcsc\"\n  }\n}\nprovider \"google\" {\n  impersonate_service_account\
      \ = \"iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n}\nprovider\
      \ \"google-beta\" {\n  impersonate_service_account = \"iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: providers/1-vpcsc-providers.tf
    retention: []
    source: null
    temporary_hold: null
    timeouts: null
  google_storage_bucket_object.providers["2-networking"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-stage-state\"\n    impersonate_service_account\
      \ = \"iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n    prefix\
      \ = \"2-networking\"\n  }\n}\nprovider \"google\" {\n  impersonate_service_account\
      \ = \"iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n}\nprovider\
      \ \"google-beta\" {\n  impersonate_service_account = \"iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: providers/2-networking-providers.tf
    retention: []
    source: null
    temporary_hold: null
    timeouts: null
  google_storage_bucket_object.providers["2-project-factory"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-stage-state\"\n    impersonate_service_account\
      \ = \"iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n    prefix =\
      \ \"2-project-factory\"\n  }\n}\nprovider \"google\" {\n  impersonate_service_account\
      \ = \"iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n}\nprovider \"\
      google-beta\" {\n  impersonate_service_account = \"iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: providers/2-project-factory-providers.tf
    retention: []
    source: null
    temporary_hold: null
    timeouts: null
  google_storage_bucket_object.providers["2-security"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-stage-state\"\n    impersonate_service_account\
      \ = \"iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n    prefix\
      \ = \"2-security\"\n  }\n}\nprovider \"google\" {\n  impersonate_service_account\
      \ = \"iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n}\nprovider\
      \ \"google-beta\" {\n  impersonate_service_account = \"iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: providers/2-security-providers.tf
    retention: []
    source: null
    temporary_hold: null
    timeouts: null
  google_storage_bucket_object.tfvars["globals"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content: '{"billing_account":{"id":"012345-012345-012345"},"groups":{"domain":"domain:example.org","gcp-billing-admins":"group:gcp-billing-admins@example.org","gcp-devops":"group:gcp-devops@example.org","gcp-network-admins":"group:gcp-network-admins@example.org","gcp-organization-admins":"group:fabric-fast-owners@google.com","gcp-secops-admins":"group:gcp-secops-admins@example.org","gcp-security-admins":"group:gcp-security-admins@example.org","gcp-support":"group:gcp-support@example.org"},"organization":{"customer_id":"abcd123456","domain":"example.org","id":"1234567890"},"prefix":"ft0","universe":null}'
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: tfvars/0-globals.auto.tfvars.json
    retention: []
    source: null
    temporary_hold: null
    timeouts: null
  google_storage_bucket_object.tfvars["org-setup"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: tfvars/0-org-setup.auto.tfvars.json
    retention: []
    source: null
    temporary_hold: null
    timeouts: null
  google_storage_bucket_object.version[0]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: versions/0-org-setup-version.txt
    retention: []
    source: fast_version.txt
    temporary_hold: null
    timeouts: null
  google_storage_bucket_object.workflows["org-setup"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    cache_control: null
    content: "# Copyright 2025 Google LLC\n#\n# Licensed under the Apache License,\
      \ Version 2.0 (the \"License\");\n# you may not use this file except in compliance\
      \ with the License.\n# You may obtain a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n\
      #\n# Unless required by applicable law or agreed to in writing, software\n#\
      \ distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT\
      \ WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the\
      \ License for the specific language governing permissions and\n# limitations\
      \ under the License.\n\nname: \"FAST org-setup stage\"\n\non:\n  pull_request:\n\
      \    branches:\n      - main\n    types:\n      - closed\n      - opened\n \
      \     - synchronize\n\nenv:\n  FAST_SERVICE_ACCOUNT: iac-org-cicd-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\n\
      \  FAST_SERVICE_ACCOUNT_PLAN: iac-org-cicd-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com\n\
      \  FAST_WIF_PROVIDER: projects/1234567890/locations/global/workloadIdentityPools/default\n\
      \  SSH_AUTH_SOCK: /tmp/ssh_agent.sock\n  TF_PROVIDERS_FILE: 0-org-setup-providers.tf\n\
      \  TF_PROVIDERS_FILE_PLAN: 0-org-setup-providers-ro.tf\n  TF_VERSION: 1.12.2\n\
      \njobs:\n  fast-pr:\n    # Skip PRs which are closed without being merged.\n\
      \    if: >-\n      github.event.action == 'closed' &&\n      github.event.pull_request.merged\
      \ == true ||\n      github.event.action == 'opened' ||\n      github.event.action\
      \ == 'synchronize'\n    permissions:\n      contents: read\n      id-token:\
      \ write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n\
      \    steps:\n      - id: checkout\n        name: Checkout repository\n     \
      \   uses: actions/checkout@v6\n\n      # set up SSH key authentication to the\
      \ modules repository\n\n      - id: ssh-config\n        name: Configure SSH\
      \ authentication\n        run: |\n          ssh-agent -a \"$SSH_AUTH_SOCK\"\
      \ > /dev/null\n          ssh-add - <<< \"${{ secrets.CICD_MODULES_KEY }}\"\n\
      \n      # set up step variables for plan / apply\n\n      - id: vars-plan\n\
      \        if: github.event.pull_request.merged != true && success()\n       \
      \ name: Set up plan variables\n        run: |\n          echo \"plan_opts=-lock=false\"\
      \ >> \"$GITHUB_ENV\"\n          echo \"provider_file=${{env.TF_PROVIDERS_FILE_PLAN}}\"\
      \ >> \"$GITHUB_ENV\"\n          echo \"service_account=${{env.FAST_SERVICE_ACCOUNT_PLAN}}\"\
      \ >> \"$GITHUB_ENV\"\n\n      - id: vars-apply\n        if: github.event.pull_request.merged\
      \ == true && success()\n        name: Set up apply variables\n        run: |\n\
      \          echo \"provider_file=${{env.TF_PROVIDERS_FILE}}\" >> \"$GITHUB_ENV\"\
      \n          echo \"service_account=${{env.FAST_SERVICE_ACCOUNT}}\" >> \"$GITHUB_ENV\"\
      \n\n      # set up authentication via Workload identity Federation and gcloud\n\
      \n      - id: gcp-auth\n        name: Authenticate to Google Cloud\n       \
      \ uses: google-github-actions/auth@v3\n        with:\n          workload_identity_provider:\
      \ ${{env.FAST_WIF_PROVIDER}}\n          service_account: ${{env.service_account}}\n\
      \          access_token_lifetime: 900s\n\n      - id: gcp-sdk\n        name:\
      \ Set up Cloud SDK\n        uses: google-github-actions/setup-gcloud@v3\n  \
      \      with:\n          install_components: alpha\n\n      # copy provider file\n\
      \n      - id: tf-config-provider\n        name: Copy Terraform provider file\n\
      \        run: |\n          gcloud storage cp -r \\\n            \"gs://ft0-prod-iac-core-0-iac-outputs/providers/${{env.provider_file}}\"\
      \ ./\n          gcloud storage cp -r \\\n            \"gs://ft0-prod-iac-core-0-iac-outputs/tfvars/0-org-setup.auto.tfvars\"\
      \ ./\n\n      - id: tf-setup\n        name: Set up Terraform\n        uses:\
      \ hashicorp/setup-terraform@v4\n        with:\n          terraform_version:\
      \ ${{env.TF_VERSION}}\n\n      # run Terraform init/validate/plan\n\n      -\
      \ id: tf-init\n        name: Terraform init\n        continue-on-error: true\n\
      \        run: |\n          terraform init -no-color\n\n      - id: tf-validate\n\
      \        continue-on-error: true\n        name: Terraform validate\n       \
      \ run: terraform validate -no-color\n\n      - id: tf-plan\n        name: Terraform\
      \ plan\n        continue-on-error: true\n        run: |\n          terraform\
      \ plan -input=false -out ../plan.out -no-color ${{env.plan_opts}}\n\n      -\
      \ id: tf-apply\n        if: github.event.pull_request.merged == true && success()\n\
      \        name: Terraform apply\n        continue-on-error: true\n        run:\
      \ |\n          terraform apply -input=false -auto-approve -no-color ../plan.out\n\
      \n      # PR comment with Terraform result from previous steps\n      # length\
      \ is checked and trimmed for length so as to stay within the limit\n\n     \
      \ - id: pr-comment\n        name: Post comment to Pull Request\n        continue-on-error:\
      \ true\n        uses: actions/github-script@v9\n        if: github.event_name\
      \ == 'pull_request'\n        env:\n          PLAN: ${{steps.tf-plan.outputs.stdout}}\\\
      n${{steps.tf-plan.outputs.stderr}}\n        with:\n          script: |\n   \
      \         const output = `### Terraform Initialization \\`${{steps.tf-init.outcome}}\\\
      `\n\n            ### Terraform Validation \\`${{steps.tf-validate.outcome}}\\\
      `\n\n            <details><summary>Validation Output</summary>\n\n         \
      \   \\`\\`\\`\\n\n            ${{steps.tf-validate.outputs.stdout}}\n      \
      \      \\`\\`\\`\n\n            </details>\n\n            ### Terraform Plan\
      \ \\`${{steps.tf-plan.outcome}}\\`\n\n            <details><summary>Show Plan</summary>\n\
      \n            \\`\\`\\`\\n\n            ${process.env.PLAN.split('\\n').filter(l\
      \ => l.match(/^([A-Z\\s].*|)$$/)).join('\\n')}\n            \\`\\`\\`\n\n  \
      \          </details>\n\n            ### Terraform Apply \\`${{steps.tf-apply.outcome}}\\\
      `\n\n            *Pusher: @${{github.actor}}, Action: \\`${{github.event_name}}\\\
      `, Working Directory: \\`${{env.tf_actions_working_dir}}\\`, Workflow: \\`${{github.workflow}}\\\
      `*`;\n\n            github.rest.issues.createComment({\n              issue_number:\
      \ context.issue.number,\n              owner: context.repo.owner,\n        \
      \      repo: context.repo.repo,\n              body: output\n            })\n\
      \n      - id: pr-short-comment\n        name: Post comment to Pull Request (abbreviated)\n\
      \        uses: actions/github-script@v9\n        if: github.event_name == 'pull_request'\
      \ && steps.pr-comment.outcome != 'success'\n        with:\n          script:\
      \ |\n            const output = `### Terraform Initialization \\`${{steps.tf-init.outcome}}\\\
      `\n\n            ### Terraform Validation \\`${{steps.tf-validate.outcome}}\\\
      `\n\n            ### Terraform Plan \\`${{steps.tf-plan.outcome}}\\`\n\n   \
      \         Plan output is in the action log.\n\n            ### Terraform Apply\
      \ \\`${{steps.tf-apply.outcome}}\\`\n\n            *Pusher: @${{github.actor}},\
      \ Action: \\`${{github.event_name}}\\`, Working Directory: \\`${{env.tf_actions_working_dir}}\\\
      `, Workflow: \\`${{github.workflow}}\\`*`;\n\n            github.rest.issues.createComment({\n\
      \              issue_number: context.issue.number,\n              owner: context.repo.owner,\n\
      \              repo: context.repo.repo,\n              body: output\n      \
      \      })\n\n      # exit on error from previous steps\n\n      - id: check-init\n\
      \        name: Check init failure\n        if: steps.tf-init.outcome != 'success'\n\
      \        run: exit 1\n\n      - id: check-validate\n        name: Check validate\
      \ failure\n        if: steps.tf-validate.outcome != 'success'\n        run:\
      \ exit 1\n\n      - id: check-plan\n        name: Check plan failure\n     \
      \   if: steps.tf-plan.outcome != 'success'\n        run: exit 1\n\n      - id:\
      \ check-apply\n        name: Check apply failure\n        if: github.event.pull_request.merged\
      \ == true && steps.tf-apply.outcome != 'success'\n        run: exit 1\n"
    content_disposition: null
    content_encoding: null
    content_language: null
    contexts: []
    customer_encryption: []
    deletion_policy: null
    detect_md5hash: null
    event_based_hold: null
    force_empty_content_type: null
    metadata: null
    name: workflows/org-setup.yaml
    retention: []
    source: null
    temporary_hold: null
    timeouts: null
  local_file.providers["0-org-setup"]:
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-org-state\"\n    impersonate_service_account\
      \ = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n  }\n}\nprovider\
      \ \"google\" {\n  impersonate_service_account = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\nprovider \"google-beta\" {\n  impersonate_service_account = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_base64: null
    directory_permission: '0777'
    file_permission: '0644'
    filename: /tmp/fast-config/providers/0-org-setup-providers.tf
    sensitive_content: null
    source: null
  local_file.providers["0-org-setup-ro"]:
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-org-state\"\n    impersonate_service_account\
      \ = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n  }\n}\nprovider\
      \ \"google\" {\n  impersonate_service_account = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\nprovider \"google-beta\" {\n  impersonate_service_account = \"iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_base64: null
    directory_permission: '0777'
    file_permission: '0644'
    filename: /tmp/fast-config/providers/0-org-setup-ro-providers.tf
    sensitive_content: null
    source: null
  local_file.providers["1-vpcsc"]:
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-stage-state\"\n    impersonate_service_account\
      \ = \"iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n    prefix\
      \ = \"1-vpcsc\"\n  }\n}\nprovider \"google\" {\n  impersonate_service_account\
      \ = \"iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n}\nprovider\
      \ \"google-beta\" {\n  impersonate_service_account = \"iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_base64: null
    directory_permission: '0777'
    file_permission: '0644'
    filename: /tmp/fast-config/providers/1-vpcsc-providers.tf
    sensitive_content: null
    source: null
  local_file.providers["2-networking"]:
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-stage-state\"\n    impersonate_service_account\
      \ = \"iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n    prefix\
      \ = \"2-networking\"\n  }\n}\nprovider \"google\" {\n  impersonate_service_account\
      \ = \"iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n}\nprovider\
      \ \"google-beta\" {\n  impersonate_service_account = \"iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_base64: null
    directory_permission: '0777'
    file_permission: '0644'
    filename: /tmp/fast-config/providers/2-networking-providers.tf
    sensitive_content: null
    source: null
  local_file.providers["2-project-factory"]:
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-stage-state\"\n    impersonate_service_account\
      \ = \"iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n    prefix =\
      \ \"2-project-factory\"\n  }\n}\nprovider \"google\" {\n  impersonate_service_account\
      \ = \"iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n}\nprovider \"\
      google-beta\" {\n  impersonate_service_account = \"iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_base64: null
    directory_permission: '0777'
    file_permission: '0644'
    filename: /tmp/fast-config/providers/2-project-factory-providers.tf
    sensitive_content: null
    source: null
  local_file.providers["2-security"]:
    content: "/**\n * Copyright 2022 Google LLC\n *\n * Licensed under the Apache\
      \ License, Version 2.0 (the \"License\");\n * you may not use this file except\
      \ in compliance with the License.\n * You may obtain a copy of the License at\n\
      \ *\n *      http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required\
      \ by applicable law or agreed to in writing, software\n * distributed under\
      \ the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR\
      \ CONDITIONS OF ANY KIND, either express or implied.\n * See the License for\
      \ the specific language governing permissions and\n * limitations under the\
      \ License.\n */\n\nterraform {\n  backend \"gcs\" {\n    bucket            \
      \          = \"ft0-prod-iac-core-0-iac-stage-state\"\n    impersonate_service_account\
      \ = \"iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n    prefix\
      \ = \"2-security\"\n  }\n}\nprovider \"google\" {\n  impersonate_service_account\
      \ = \"iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\n}\nprovider\
      \ \"google-beta\" {\n  impersonate_service_account = \"iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\"\
      \n}\n"
    content_base64: null
    directory_permission: '0777'
    file_permission: '0644'
    filename: /tmp/fast-config/providers/2-security-providers.tf
    sensitive_content: null
    source: null
  local_file.tfvars["globals"]:
    content: '{"billing_account":{"id":"012345-012345-012345"},"groups":{"domain":"domain:example.org","gcp-billing-admins":"group:gcp-billing-admins@example.org","gcp-devops":"group:gcp-devops@example.org","gcp-network-admins":"group:gcp-network-admins@example.org","gcp-organization-admins":"group:fabric-fast-owners@google.com","gcp-secops-admins":"group:gcp-secops-admins@example.org","gcp-security-admins":"group:gcp-security-admins@example.org","gcp-support":"group:gcp-support@example.org"},"organization":{"customer_id":"abcd123456","domain":"example.org","id":"1234567890"},"prefix":"ft0","universe":null}'
    content_base64: null
    directory_permission: '0777'
    file_permission: '0644'
    filename: /tmp/fast-config/tfvars/0-globals.auto.tfvars.json
    sensitive_content: null
    source: null
  local_file.tfvars["org-setup"]:
    content_base64: null
    directory_permission: '0777'
    file_permission: '0644'
    filename: /tmp/fast-config/tfvars/0-org-setup.auto.tfvars.json
    sensitive_content: null
    source: null
  local_file.workflows["org-setup"]:
    content: "# Copyright 2025 Google LLC\n#\n# Licensed under the Apache License,\
      \ Version 2.0 (the \"License\");\n# you may not use this file except in compliance\
      \ with the License.\n# You may obtain a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n\
      #\n# Unless required by applicable law or agreed to in writing, software\n#\
      \ distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT\
      \ WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the\
      \ License for the specific language governing permissions and\n# limitations\
      \ under the License.\n\nname: \"FAST org-setup stage\"\n\non:\n  pull_request:\n\
      \    branches:\n      - main\n    types:\n      - closed\n      - opened\n \
      \     - synchronize\n\nenv:\n  FAST_SERVICE_ACCOUNT: iac-org-cicd-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com\n\
      \  FAST_SERVICE_ACCOUNT_PLAN: iac-org-cicd-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com\n\
      \  FAST_WIF_PROVIDER: projects/1234567890/locations/global/workloadIdentityPools/default\n\
      \  SSH_AUTH_SOCK: /tmp/ssh_agent.sock\n  TF_PROVIDERS_FILE: 0-org-setup-providers.tf\n\
      \  TF_PROVIDERS_FILE_PLAN: 0-org-setup-providers-ro.tf\n  TF_VERSION: 1.12.2\n\
      \njobs:\n  fast-pr:\n    # Skip PRs which are closed without being merged.\n\
      \    if: >-\n      github.event.action == 'closed' &&\n      github.event.pull_request.merged\
      \ == true ||\n      github.event.action == 'opened' ||\n      github.event.action\
      \ == 'synchronize'\n    permissions:\n      contents: read\n      id-token:\
      \ write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n\
      \    steps:\n      - id: checkout\n        name: Checkout repository\n     \
      \   uses: actions/checkout@v6\n\n      # set up SSH key authentication to the\
      \ modules repository\n\n      - id: ssh-config\n        name: Configure SSH\
      \ authentication\n        run: |\n          ssh-agent -a \"$SSH_AUTH_SOCK\"\
      \ > /dev/null\n          ssh-add - <<< \"${{ secrets.CICD_MODULES_KEY }}\"\n\
      \n      # set up step variables for plan / apply\n\n      - id: vars-plan\n\
      \        if: github.event.pull_request.merged != true && success()\n       \
      \ name: Set up plan variables\n        run: |\n          echo \"plan_opts=-lock=false\"\
      \ >> \"$GITHUB_ENV\"\n          echo \"provider_file=${{env.TF_PROVIDERS_FILE_PLAN}}\"\
      \ >> \"$GITHUB_ENV\"\n          echo \"service_account=${{env.FAST_SERVICE_ACCOUNT_PLAN}}\"\
      \ >> \"$GITHUB_ENV\"\n\n      - id: vars-apply\n        if: github.event.pull_request.merged\
      \ == true && success()\n        name: Set up apply variables\n        run: |\n\
      \          echo \"provider_file=${{env.TF_PROVIDERS_FILE}}\" >> \"$GITHUB_ENV\"\
      \n          echo \"service_account=${{env.FAST_SERVICE_ACCOUNT}}\" >> \"$GITHUB_ENV\"\
      \n\n      # set up authentication via Workload identity Federation and gcloud\n\
      \n      - id: gcp-auth\n        name: Authenticate to Google Cloud\n       \
      \ uses: google-github-actions/auth@v3\n        with:\n          workload_identity_provider:\
      \ ${{env.FAST_WIF_PROVIDER}}\n          service_account: ${{env.service_account}}\n\
      \          access_token_lifetime: 900s\n\n      - id: gcp-sdk\n        name:\
      \ Set up Cloud SDK\n        uses: google-github-actions/setup-gcloud@v3\n  \
      \      with:\n          install_components: alpha\n\n      # copy provider file\n\
      \n      - id: tf-config-provider\n        name: Copy Terraform provider file\n\
      \        run: |\n          gcloud storage cp -r \\\n            \"gs://ft0-prod-iac-core-0-iac-outputs/providers/${{env.provider_file}}\"\
      \ ./\n          gcloud storage cp -r \\\n            \"gs://ft0-prod-iac-core-0-iac-outputs/tfvars/0-org-setup.auto.tfvars\"\
      \ ./\n\n      - id: tf-setup\n        name: Set up Terraform\n        uses:\
      \ hashicorp/setup-terraform@v4\n        with:\n          terraform_version:\
      \ ${{env.TF_VERSION}}\n\n      # run Terraform init/validate/plan\n\n      -\
      \ id: tf-init\n        name: Terraform init\n        continue-on-error: true\n\
      \        run: |\n          terraform init -no-color\n\n      - id: tf-validate\n\
      \        continue-on-error: true\n        name: Terraform validate\n       \
      \ run: terraform validate -no-color\n\n      - id: tf-plan\n        name: Terraform\
      \ plan\n        continue-on-error: true\n        run: |\n          terraform\
      \ plan -input=false -out ../plan.out -no-color ${{env.plan_opts}}\n\n      -\
      \ id: tf-apply\n        if: github.event.pull_request.merged == true && success()\n\
      \        name: Terraform apply\n        continue-on-error: true\n        run:\
      \ |\n          terraform apply -input=false -auto-approve -no-color ../plan.out\n\
      \n      # PR comment with Terraform result from previous steps\n      # length\
      \ is checked and trimmed for length so as to stay within the limit\n\n     \
      \ - id: pr-comment\n        name: Post comment to Pull Request\n        continue-on-error:\
      \ true\n        uses: actions/github-script@v9\n        if: github.event_name\
      \ == 'pull_request'\n        env:\n          PLAN: ${{steps.tf-plan.outputs.stdout}}\\\
      n${{steps.tf-plan.outputs.stderr}}\n        with:\n          script: |\n   \
      \         const output = `### Terraform Initialization \\`${{steps.tf-init.outcome}}\\\
      `\n\n            ### Terraform Validation \\`${{steps.tf-validate.outcome}}\\\
      `\n\n            <details><summary>Validation Output</summary>\n\n         \
      \   \\`\\`\\`\\n\n            ${{steps.tf-validate.outputs.stdout}}\n      \
      \      \\`\\`\\`\n\n            </details>\n\n            ### Terraform Plan\
      \ \\`${{steps.tf-plan.outcome}}\\`\n\n            <details><summary>Show Plan</summary>\n\
      \n            \\`\\`\\`\\n\n            ${process.env.PLAN.split('\\n').filter(l\
      \ => l.match(/^([A-Z\\s].*|)$$/)).join('\\n')}\n            \\`\\`\\`\n\n  \
      \          </details>\n\n            ### Terraform Apply \\`${{steps.tf-apply.outcome}}\\\
      `\n\n            *Pusher: @${{github.actor}}, Action: \\`${{github.event_name}}\\\
      `, Working Directory: \\`${{env.tf_actions_working_dir}}\\`, Workflow: \\`${{github.workflow}}\\\
      `*`;\n\n            github.rest.issues.createComment({\n              issue_number:\
      \ context.issue.number,\n              owner: context.repo.owner,\n        \
      \      repo: context.repo.repo,\n              body: output\n            })\n\
      \n      - id: pr-short-comment\n        name: Post comment to Pull Request (abbreviated)\n\
      \        uses: actions/github-script@v9\n        if: github.event_name == 'pull_request'\
      \ && steps.pr-comment.outcome != 'success'\n        with:\n          script:\
      \ |\n            const output = `### Terraform Initialization \\`${{steps.tf-init.outcome}}\\\
      `\n\n            ### Terraform Validation \\`${{steps.tf-validate.outcome}}\\\
      `\n\n            ### Terraform Plan \\`${{steps.tf-plan.outcome}}\\`\n\n   \
      \         Plan output is in the action log.\n\n            ### Terraform Apply\
      \ \\`${{steps.tf-apply.outcome}}\\`\n\n            *Pusher: @${{github.actor}},\
      \ Action: \\`${{github.event_name}}\\`, Working Directory: \\`${{env.tf_actions_working_dir}}\\\
      `, Workflow: \\`${{github.workflow}}\\`*`;\n\n            github.rest.issues.createComment({\n\
      \              issue_number: context.issue.number,\n              owner: context.repo.owner,\n\
      \              repo: context.repo.repo,\n              body: output\n      \
      \      })\n\n      # exit on error from previous steps\n\n      - id: check-init\n\
      \        name: Check init failure\n        if: steps.tf-init.outcome != 'success'\n\
      \        run: exit 1\n\n      - id: check-validate\n        name: Check validate\
      \ failure\n        if: steps.tf-validate.outcome != 'success'\n        run:\
      \ exit 1\n\n      - id: check-plan\n        name: Check plan failure\n     \
      \   if: steps.tf-plan.outcome != 'success'\n        run: exit 1\n\n      - id:\
      \ check-apply\n        name: Check apply failure\n        if: github.event.pull_request.merged\
      \ == true && steps.tf-apply.outcome != 'success'\n        run: exit 1\n"
    content_base64: null
    directory_permission: '0777'
    file_permission: '0644'
    filename: /tmp/fast-config/workflows/org-setup.yaml
    sensitive_content: null
    source: null
  module.billing-accounts["default"].google_billing_account_iam_member.bindings["billing_admin_org_admins"]:
    billing_account_id: 012345-012345-012345
    condition: []
    member: group:fabric-fast-owners@google.com
    role: roles/billing.admin
  module.billing-accounts["default"].google_billing_account_iam_member.bindings["billing_admin_org_sa"]:
    billing_account_id: 012345-012345-012345
    condition: []
    member: serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    role: roles/billing.admin
  module.billing-accounts["default"].google_billing_account_iam_member.bindings["billing_user_networking_sa"]:
    billing_account_id: 012345-012345-012345
    condition: []
    member: serviceAccount:iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    role: roles/billing.user
  module.billing-accounts["default"].google_billing_account_iam_member.bindings["billing_user_pf_sa"]:
    billing_account_id: 012345-012345-012345
    condition: []
    member: serviceAccount:iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    role: roles/billing.user
  module.billing-accounts["default"].google_billing_account_iam_member.bindings["billing_user_security_sa"]:
    billing_account_id: 012345-012345-012345
    condition: []
    member: serviceAccount:iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    role: roles/billing.user
  module.billing-accounts["default"].google_billing_account_iam_member.bindings["billing_viewer_org_ro"]:
    billing_account_id: 012345-012345-012345
    condition: []
    member: serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    role: roles/billing.viewer
  module.cicd-sa-apply["org-setup"].google_service_account_iam_binding.authoritative["roles/iam.workloadIdentityUser"]:
    condition: []
    members:
    - principalSet://iam.googleapis.com/$workload_identity_pools:iac-0/default/attribute.fast_sub/repo:gh-org/gh-repo:ref:refs/heads/fast-dev
    - principalSet://iam.googleapis.com/$workload_identity_pools:iac-0/default/attribute.fast_sub/repo:gh-org/gh-repo:ref:refs/heads/master
    role: roles/iam.workloadIdentityUser
    service_account_id: projects/ft0-prod-iac-core-0/serviceAccounts/iac-org-cicd-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
  module.cicd-sa-plan["org-setup"].google_service_account_iam_binding.authoritative["roles/iam.workloadIdentityUser"]:
    condition: []
    members:
    - principalSet://iam.googleapis.com/$workload_identity_pools:iac-0/default/attribute.repository/gh-org/gh-repo
    role: roles/iam.workloadIdentityUser
    service_account_id: projects/ft0-prod-iac-core-0/serviceAccounts/iac-org-cicd-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
  module.factory.module.bigquery-datasets["billing-0/billing_export"].google_bigquery_dataset.default:
    dataset_id: billing_export
    default_encryption_configuration:
    - {}
    default_partition_expiration_ms: null
    default_table_expiration_ms: null
    delete_contents_on_destroy: false
    description: Terraform managed.
    effective_labels:
      goog-terraform-provisioned: 'true'
    external_catalog_dataset_options: []
    external_dataset_reference: []
    friendly_name: Billing export
    labels: null
    location: europe-west1
    max_time_travel_hours: '168'
    project: ft0-prod-billing-exp-0
    resource_tags: null
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
  module.factory.module.buckets["iac-0/iac-org-state"].google_storage_bucket.bucket[0]:
    autoclass: []
    cors: []
    custom_placement_config: []
    default_event_based_hold: null
    effective_labels:
      goog-terraform-provisioned: 'true'
    enable_object_retention: null
    encryption:
    - customer_managed_encryption_enforcement_config: []
      customer_supplied_encryption_enforcement_config: []
      google_managed_encryption_enforcement_config: []
    force_destroy: false
    hierarchical_namespace: []
    ip_filter: []
    labels: null
    lifecycle_rule:
    - action:
      - storage_class: ARCHIVE
        type: SetStorageClass
      condition:
      - age: 365
        created_before: ''
        custom_time_before: ''
        days_since_custom_time: null
        days_since_noncurrent_time: null
        matches_prefix: []
        matches_storage_class:
        - COLDLINE
        matches_suffix: []
        noncurrent_time_before: ''
        num_newer_versions: null
        send_age_if_zero: null
        send_days_since_custom_time_if_zero: null
        send_days_since_noncurrent_time_if_zero: null
        send_num_newer_versions_if_zero: null
    - action:
      - storage_class: COLDLINE
        type: SetStorageClass
      condition:
      - age: 90
        created_before: ''
        custom_time_before: ''
        days_since_custom_time: null
        days_since_noncurrent_time: null
        matches_prefix: []
        matches_storage_class:
        - NEARLINE
        matches_suffix: []
        noncurrent_time_before: ''
        num_newer_versions: null
        send_age_if_zero: null
        send_days_since_custom_time_if_zero: null
        send_days_since_noncurrent_time_if_zero: null
        send_num_newer_versions_if_zero: null
    - action:
      - storage_class: NEARLINE
        type: SetStorageClass
      condition:
      - age: 30
        created_before: ''
        custom_time_before: ''
        days_since_custom_time: null
        days_since_noncurrent_time: null
        matches_prefix: []
        matches_storage_class:
        - STANDARD
        matches_suffix: []
        noncurrent_time_before: ''
        num_newer_versions: null
        send_age_if_zero: null
        send_days_since_custom_time_if_zero: null
        send_days_since_noncurrent_time_if_zero: null
        send_num_newer_versions_if_zero: null
    location: EUROPE-WEST1
    logging: []
    name: ft0-prod-iac-core-0-iac-org-state
    project: ft0-prod-iac-core-0
    requester_pays: null
    retention_policy: []
    storage_class: STANDARD
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
    uniform_bucket_level_access: true
    versioning:
    - enabled: true
  ? module.factory.module.buckets["iac-0/iac-org-state"].google_storage_bucket_iam_binding.authoritative["$custom_roles:storage_viewer"]
  : bucket: ft0-prod-iac-core-0-iac-org-state
    condition: []
    role: organizations/1234567890/roles/storageViewer
    timeouts: null
  ? module.factory.module.buckets["iac-0/iac-org-state"].google_storage_bucket_iam_binding.authoritative["roles/storage.admin"]
  : bucket: ft0-prod-iac-core-0-iac-org-state
    condition: []
    role: roles/storage.admin
    timeouts: null
  module.factory.module.buckets["iac-0/iac-outputs"].google_storage_bucket.bucket[0]:
    autoclass: []
    cors: []
    custom_placement_config: []
    default_event_based_hold: null
    effective_labels:
      goog-terraform-provisioned: 'true'
    enable_object_retention: null
    encryption:
    - customer_managed_encryption_enforcement_config: []
      customer_supplied_encryption_enforcement_config: []
      google_managed_encryption_enforcement_config: []
    force_destroy: false
    hierarchical_namespace: []
    ip_filter: []
    labels: null
    lifecycle_rule:
    - action:
      - storage_class: ARCHIVE
        type: SetStorageClass
      condition:
      - age: 365
        created_before: ''
        custom_time_before: ''
        days_since_custom_time: null
        days_since_noncurrent_time: null
        matches_prefix: []
        matches_storage_class:
        - COLDLINE
        matches_suffix: []
        noncurrent_time_before: ''
        num_newer_versions: null
        send_age_if_zero: null
        send_days_since_custom_time_if_zero: null
        send_days_since_noncurrent_time_if_zero: null
        send_num_newer_versions_if_zero: null
    - action:
      - storage_class: COLDLINE
        type: SetStorageClass
      condition:
      - age: 90
        created_before: ''
        custom_time_before: ''
        days_since_custom_time: null
        days_since_noncurrent_time: null
        matches_prefix: []
        matches_storage_class:
        - NEARLINE
        matches_suffix: []
        noncurrent_time_before: ''
        num_newer_versions: null
        send_age_if_zero: null
        send_days_since_custom_time_if_zero: null
        send_days_since_noncurrent_time_if_zero: null
        send_num_newer_versions_if_zero: null
    - action:
      - storage_class: NEARLINE
        type: SetStorageClass
      condition:
      - age: 30
        created_before: ''
        custom_time_before: ''
        days_since_custom_time: null
        days_since_noncurrent_time: null
        matches_prefix: []
        matches_storage_class:
        - STANDARD
        matches_suffix: []
        noncurrent_time_before: ''
        num_newer_versions: null
        send_age_if_zero: null
        send_days_since_custom_time_if_zero: null
        send_days_since_noncurrent_time_if_zero: null
        send_num_newer_versions_if_zero: null
    location: EUROPE-WEST1
    logging: []
    name: ft0-prod-iac-core-0-iac-outputs
    project: ft0-prod-iac-core-0
    requester_pays: null
    retention_policy: []
    storage_class: STANDARD
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
    uniform_bucket_level_access: true
    versioning:
    - enabled: true
  ? module.factory.module.buckets["iac-0/iac-outputs"].google_storage_bucket_iam_binding.authoritative["$custom_roles:storage_viewer"]
  : bucket: ft0-prod-iac-core-0-iac-outputs
    condition: []
    role: organizations/1234567890/roles/storageViewer
    timeouts: null
  module.factory.module.buckets["iac-0/iac-outputs"].google_storage_bucket_iam_binding.authoritative["roles/storage.admin"]:
    bucket: ft0-prod-iac-core-0-iac-outputs
    condition: []
    role: roles/storage.admin
    timeouts: null
  module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_bucket.bucket[0]:
    autoclass: []
    cors: []
    custom_placement_config: []
    default_event_based_hold: null
    effective_labels:
      goog-terraform-provisioned: 'true'
    enable_object_retention: null
    encryption:
    - customer_managed_encryption_enforcement_config: []
      customer_supplied_encryption_enforcement_config: []
      google_managed_encryption_enforcement_config: []
    force_destroy: false
    hierarchical_namespace: []
    ip_filter: []
    labels: null
    lifecycle_rule:
    - action:
      - storage_class: ARCHIVE
        type: SetStorageClass
      condition:
      - age: 365
        created_before: ''
        custom_time_before: ''
        days_since_custom_time: null
        days_since_noncurrent_time: null
        matches_prefix: []
        matches_storage_class:
        - COLDLINE
        matches_suffix: []
        noncurrent_time_before: ''
        num_newer_versions: null
        send_age_if_zero: null
        send_days_since_custom_time_if_zero: null
        send_days_since_noncurrent_time_if_zero: null
        send_num_newer_versions_if_zero: null
    - action:
      - storage_class: COLDLINE
        type: SetStorageClass
      condition:
      - age: 90
        created_before: ''
        custom_time_before: ''
        days_since_custom_time: null
        days_since_noncurrent_time: null
        matches_prefix: []
        matches_storage_class:
        - NEARLINE
        matches_suffix: []
        noncurrent_time_before: ''
        num_newer_versions: null
        send_age_if_zero: null
        send_days_since_custom_time_if_zero: null
        send_days_since_noncurrent_time_if_zero: null
        send_num_newer_versions_if_zero: null
    - action:
      - storage_class: NEARLINE
        type: SetStorageClass
      condition:
      - age: 30
        created_before: ''
        custom_time_before: ''
        days_since_custom_time: null
        days_since_noncurrent_time: null
        matches_prefix: []
        matches_storage_class:
        - STANDARD
        matches_suffix: []
        noncurrent_time_before: ''
        num_newer_versions: null
        send_age_if_zero: null
        send_days_since_custom_time_if_zero: null
        send_days_since_noncurrent_time_if_zero: null
        send_num_newer_versions_if_zero: null
    location: EUROPE-WEST1
    logging: []
    name: ft0-prod-iac-core-0-iac-stage-state
    project: ft0-prod-iac-core-0
    requester_pays: null
    retention_policy: []
    storage_class: STANDARD
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
    uniform_bucket_level_access: true
    versioning:
    - enabled: true
  module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder.folder["1-vpcsc/"]:
    bucket: ft0-prod-iac-core-0-iac-stage-state
    force_destroy: false
    name: 1-vpcsc/
    timeouts: null
  module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder.folder["2-networking/"]:
    bucket: ft0-prod-iac-core-0-iac-stage-state
    force_destroy: false
    name: 2-networking/
    timeouts: null
  module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder.folder["2-project-factory/"]:
    bucket: ft0-prod-iac-core-0-iac-stage-state
    force_destroy: false
    name: 2-project-factory/
    timeouts: null
  module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder.folder["2-security/"]:
    bucket: ft0-prod-iac-core-0-iac-stage-state
    force_destroy: false
    name: 2-security/
    timeouts: null
  ? module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder_iam_binding.authoritative["1-vpcsc/$custom_roles:storage_viewer"]
  : bucket: ft0-prod-iac-core-0-iac-stage-state
    condition: []
    managed_folder: 1-vpcsc/
    role: organizations/1234567890/roles/storageViewer
  ? module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder_iam_binding.authoritative["1-vpcsc/roles/storage.admin"]
  : bucket: ft0-prod-iac-core-0-iac-stage-state
    condition: []
    managed_folder: 1-vpcsc/
    role: roles/storage.admin
  ? module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder_iam_binding.authoritative["2-networking/$custom_roles:storage_viewer"]
  : bucket: ft0-prod-iac-core-0-iac-stage-state
    condition: []
    managed_folder: 2-networking/
    role: organizations/1234567890/roles/storageViewer
  ? module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder_iam_binding.authoritative["2-networking/roles/storage.admin"]
  : bucket: ft0-prod-iac-core-0-iac-stage-state
    condition: []
    managed_folder: 2-networking/
    role: roles/storage.admin
  ? module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder_iam_binding.authoritative["2-project-factory/$custom_roles:storage_viewer"]
  : bucket: ft0-prod-iac-core-0-iac-stage-state
    condition: []
    managed_folder: 2-project-factory/
    role: organizations/1234567890/roles/storageViewer
  ? module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder_iam_binding.authoritative["2-project-factory/roles/storage.admin"]
  : bucket: ft0-prod-iac-core-0-iac-stage-state
    condition: []
    managed_folder: 2-project-factory/
    role: roles/storage.admin
  ? module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder_iam_binding.authoritative["2-security/$custom_roles:storage_viewer"]
  : bucket: ft0-prod-iac-core-0-iac-stage-state
    condition: []
    managed_folder: 2-security/
    role: organizations/1234567890/roles/storageViewer
  ? module.factory.module.buckets["iac-0/iac-stage-state"].google_storage_managed_folder_iam_binding.authoritative["2-security/roles/storage.admin"]
  : bucket: ft0-prod-iac-core-0-iac-stage-state
    condition: []
    managed_folder: 2-security/
    role: roles/storage.admin
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["$custom_roles:project_iam_viewer"]
  : condition: []
    role: organizations/1234567890/roles/projectIamViewer
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["$custom_roles:service_networking_viewer"]
  : condition: []
    role: organizations/1234567890/roles/serviceNetworkingViewer
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["$custom_roles:service_project_network_admin"]
  : condition: []
    role: organizations/1234567890/roles/serviceProjectNetworkAdmin
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/browser"]:
    condition: []
    role: roles/browser
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/compute.networkAdmin"]:
    condition: []
    role: roles/compute.networkAdmin
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/compute.networkViewer"]:
    condition: []
    role: roles/compute.networkViewer
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/compute.securityAdmin"]:
    condition: []
    role: roles/compute.securityAdmin
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/compute.viewer"]:
    condition: []
    role: roles/compute.viewer
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/compute.xpnAdmin"]:
    condition: []
    role: roles/compute.xpnAdmin
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/dns.admin"]:
    condition: []
    role: roles/dns.admin
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/dns.reader"]:
    condition: []
    role: roles/dns.reader
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/iam.networkAdmin"]:
    condition: []
    role: roles/iam.networkAdmin
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/logging.admin"]:
    condition: []
    role: roles/logging.admin
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/logging.viewer"]:
    condition: []
    role: roles/logging.viewer
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/resourcemanager.folderAdmin"]
  : condition: []
    role: roles/resourcemanager.folderAdmin
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/resourcemanager.folderViewer"]
  : condition: []
    role: roles/resourcemanager.folderViewer
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectCreator"]
  : condition: []
    role: roles/resourcemanager.projectCreator
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectDeleter"]
  : condition: []
    role: roles/resourcemanager.projectDeleter
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectIamAdmin"]
  : condition: []
    role: roles/resourcemanager.projectIamAdmin
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/resourcemanager.tagUser"]:
    condition: []
    role: roles/resourcemanager.tagUser
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/resourcemanager.tagViewer"]
  : condition: []
    role: roles/resourcemanager.tagViewer
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/serviceusage.serviceUsageAdmin"]
  : condition: []
    role: roles/serviceusage.serviceUsageAdmin
  ? module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.authoritative["roles/serviceusage.serviceUsageViewer"]
  : condition: []
    role: roles/serviceusage.serviceUsageViewer
  module.factory.module.folder-1-iam["networking"].google_folder_iam_binding.bindings["project_factory"]:
    condition:
    - description: null
      expression: "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([\n\
        \  'roles/compute.networkUser', 'roles/composer.sharedVpcAgent',\n  'roles/container.hostServiceAgentUser',\
        \ 'roles/vpcaccess.user'\n])\n"
      title: Project factory delegated IAM grant.
    role: roles/resourcemanager.projectIamAdmin
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["$custom_roles:logging_viewer"]:
    condition: []
    role: organizations/1234567890/roles/loggingViewer
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["$custom_roles:project_iam_viewer"]:
    condition: []
    role: organizations/1234567890/roles/projectIamViewer
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/browser"]:
    condition: []
    role: roles/browser
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/cloudkms.admin"]:
    condition: []
    role: roles/cloudkms.admin
  ? module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/cloudkms.cryptoKeyEncrypterDecrypter"]
  : condition: []
    role: roles/cloudkms.cryptoKeyEncrypterDecrypter
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/cloudkms.viewer"]:
    condition: []
    role: roles/cloudkms.viewer
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/logging.admin"]:
    condition: []
    role: roles/logging.admin
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/logging.viewer"]:
    condition: []
    role: roles/logging.viewer
  ? module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/resourcemanager.folderAdmin"]
  : condition: []
    role: roles/resourcemanager.folderAdmin
  ? module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/resourcemanager.folderViewer"]
  : condition: []
    role: roles/resourcemanager.folderViewer
  ? module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectCreator"]
  : condition: []
    role: roles/resourcemanager.projectCreator
  ? module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectDeleter"]
  : condition: []
    role: roles/resourcemanager.projectDeleter
  ? module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectIamAdmin"]
  : condition: []
    role: roles/resourcemanager.projectIamAdmin
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/resourcemanager.tagUser"]:
    condition: []
    role: roles/resourcemanager.tagUser
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/resourcemanager.tagViewer"]:
    condition: []
    role: roles/resourcemanager.tagViewer
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/securitycenter.admin"]:
    condition: []
    role: roles/securitycenter.admin
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/securitycenter.viewer"]:
    condition: []
    role: roles/securitycenter.viewer
  ? module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/serviceusage.serviceUsageAdmin"]
  : condition: []
    role: roles/serviceusage.serviceUsageAdmin
  ? module.factory.module.folder-1-iam["security"].google_folder_iam_binding.authoritative["roles/serviceusage.serviceUsageViewer"]
  : condition: []
    role: roles/serviceusage.serviceUsageViewer
  module.factory.module.folder-1-iam["security"].google_folder_iam_binding.bindings["project_factory"]:
    condition:
    - description: null
      expression: "api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([\n\
        \  'roles/cloudkms.cryptoKeyEncrypterDecrypter'\n])\n"
      title: Project factory delegated IAM grant.
    role: roles/resourcemanager.projectIamAdmin
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["$custom_roles:logging_viewer"]:
    condition: []
    role: organizations/1234567890/roles/loggingViewer
  ? module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["$custom_roles:service_account_viewer"]
  : condition: []
    role: organizations/1234567890/roles/serviceAccountViewer
  ? module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["$custom_roles:service_project_network_admin"]
  : condition: []
    role: organizations/1234567890/roles/serviceProjectNetworkAdmin
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/bigquery.admin"]:
    condition: []
    role: roles/bigquery.admin
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/bigquery.dataViewer"]:
    condition: []
    role: roles/bigquery.dataViewer
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/bigquery.jobUser"]:
    condition: []
    role: roles/bigquery.jobUser
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/browser"]:
    condition: []
    role: roles/browser
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/compute.viewer"]:
    condition: []
    role: roles/compute.viewer
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/container.admin"]:
    condition: []
    role: roles/container.admin
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/container.clusterViewer"]:
    condition: []
    role: roles/container.clusterViewer
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/iam.serviceAccountAdmin"]:
    condition: []
    role: roles/iam.serviceAccountAdmin
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/logging.admin"]:
    condition: []
    role: roles/logging.admin
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/logging.viewer"]:
    condition: []
    role: roles/logging.viewer
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/pubsub.admin"]:
    condition: []
    role: roles/pubsub.admin
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/pubsub.viewer"]:
    condition: []
    role: roles/pubsub.viewer
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.folderAdmin"]:
    condition: []
    role: roles/resourcemanager.folderAdmin
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.folderViewer"]:
    condition: []
    role: roles/resourcemanager.folderViewer
  ? module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectCreator"]
  : condition: []
    role: roles/resourcemanager.projectCreator
  ? module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectDeleter"]
  : condition: []
    role: roles/resourcemanager.projectDeleter
  ? module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.projectIamAdmin"]
  : condition: []
    role: roles/resourcemanager.projectIamAdmin
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.tagUser"]:
    condition: []
    role: roles/resourcemanager.tagUser
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/resourcemanager.tagViewer"]:
    condition: []
    role: roles/resourcemanager.tagViewer
  ? module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/serviceusage.serviceUsageAdmin"]
  : condition: []
    role: roles/serviceusage.serviceUsageAdmin
  ? module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/serviceusage.serviceUsageViewer"]
  : condition: []
    role: roles/serviceusage.serviceUsageViewer
  module.factory.module.folder-1-iam["teams"].google_folder_iam_binding.authoritative["roles/storage.admin"]:
    condition: []
    role: roles/storage.admin
  module.factory.module.folder-1-iam["teams"].google_tags_tag_binding.binding["context"]:
    timeouts: null
  module.factory.module.folder-1["networking"].google_folder.folder[0]:
    deletion_protection: false
    display_name: Networking
    parent: organizations/1234567890
    tags: null
    timeouts: null
  module.factory.module.folder-1["security"].google_folder.folder[0]:
    deletion_protection: false
    display_name: Security
    parent: organizations/1234567890
    tags: null
    timeouts: null
  module.factory.module.folder-1["teams"].google_folder.folder[0]:
    deletion_protection: false
    display_name: Teams
    parent: organizations/1234567890
    tags: null
    timeouts: null
  module.factory.module.folder-2-iam["networking/dev"].google_tags_tag_binding.binding["environment"]:
    timeouts: null
  module.factory.module.folder-2-iam["networking/prod"].google_tags_tag_binding.binding["environment"]:
    timeouts: null
  ? module.factory.module.folder-2-iam["security/dev"].google_folder_iam_binding.authoritative["$custom_roles:cloudkms_viewer"]
  : condition: []
    role: organizations/1234567890/roles/cloudKmsViewer
  module.factory.module.folder-2-iam["security/dev"].google_tags_tag_binding.binding["environment"]:
    timeouts: null
  module.factory.module.folder-2-iam["security/prod"].google_tags_tag_binding.binding["environment"]:
    timeouts: null
  module.factory.module.folder-2["networking/dev"].google_folder.folder[0]:
    deletion_protection: false
    display_name: Development
    tags: null
    timeouts: null
  module.factory.module.folder-2["networking/prod"].google_folder.folder[0]:
    deletion_protection: false
    display_name: Production
    tags: null
    timeouts: null
  module.factory.module.folder-2["security/dev"].google_folder.folder[0]:
    deletion_protection: false
    display_name: Development
    tags: null
    timeouts: null
  module.factory.module.folder-2["security/prod"].google_folder.folder[0]:
    deletion_protection: false
    display_name: Production
    tags: null
    timeouts: null
  module.factory.module.kms["billing-0/ew1"].google_kms_crypto_key.default["bigquery"]:
    effective_labels:
      goog-terraform-provisioned: 'true'
    labels: null
    name: bigquery
    purpose: ENCRYPT_DECRYPT
    rotation_period: 7776000s
    skip_initial_version_creation: false
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
  module.factory.module.kms["billing-0/ew1"].google_kms_key_ring.default[0]:
    location: europe-west1
    name: ew1
    project: ft0-prod-billing-exp-0
    timeouts: null
  module.factory.module.kms["iac-0/ew1"].google_kms_crypto_key.default["storage"]:
    effective_labels:
      goog-terraform-provisioned: 'true'
    labels: null
    name: storage
    purpose: ENCRYPT_DECRYPT
    rotation_period: 7776000s
    skip_initial_version_creation: false
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
  module.factory.module.kms["iac-0/ew1"].google_kms_key_ring.default[0]:
    location: europe-west1
    name: ew1
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.kms["log-0/ew1"].google_kms_crypto_key.default["logging"]:
    effective_labels:
      goog-terraform-provisioned: 'true'
    labels: null
    name: logging
    purpose: ENCRYPT_DECRYPT
    rotation_period: 7776000s
    skip_initial_version_creation: false
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
  module.factory.module.kms["log-0/ew1"].google_kms_key_ring.default[0]:
    location: europe-west1
    name: ew1
    project: ft0-prod-audit-logs-0
    timeouts: null
  module.factory.module.log-buckets["billing-0/_Default"].google_logging_project_bucket_config.bucket[0]:
    bucket_id: _Default
    cmek_settings: []
    enable_analytics: false
    index_configs: []
    location: europe-west1
    locked: null
    project: ft0-prod-billing-exp-0
    retention_days: 90
  module.factory.module.log-buckets["iac-0/_Default"].google_logging_project_bucket_config.bucket[0]:
    bucket_id: _Default
    cmek_settings: []
    enable_analytics: false
    index_configs: []
    location: europe-west1
    locked: null
    project: ft0-prod-iac-core-0
    retention_days: 90
  module.factory.module.log-buckets["log-0/_Default"].google_logging_project_bucket_config.bucket[0]:
    bucket_id: _Default
    cmek_settings: []
    enable_analytics: false
    index_configs: []
    location: europe-west1
    locked: null
    project: ft0-prod-audit-logs-0
    retention_days: 90
  module.factory.module.log-buckets["log-0/audit-logs"].google_logging_project_bucket_config.bucket[0]:
    bucket_id: audit-logs
    cmek_settings:
    - {}
    enable_analytics: false
    index_configs: []
    location: europe-west1
    locked: null
    project: ft0-prod-audit-logs-0
    retention_days: 90
  module.factory.module.log-buckets["log-0/iam"].google_logging_project_bucket_config.bucket[0]:
    bucket_id: iam
    cmek_settings:
    - {}
    enable_analytics: false
    index_configs: []
    location: europe-west1
    locked: null
    project: ft0-prod-audit-logs-0
    retention_days: 90
  module.factory.module.log-buckets["log-0/vpc-sc"].google_logging_project_bucket_config.bucket[0]:
    bucket_id: vpc-sc
    cmek_settings:
    - {}
    enable_analytics: true
    index_configs: []
    location: europe-west1
    locked: null
    project: ft0-prod-audit-logs-0
    retention_days: 90
  ? module.factory.module.projects-iam["billing-0"].google_kms_crypto_key_iam_member.service_agent_cmek["key-0.bigquery-encryption"]
  : condition: []
    role: roles/cloudkms.cryptoKeyEncrypterDecrypter
  module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["$custom_roles:cloudkms_viewer"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: organizations/1234567890/roles/cloudKmsViewer
  module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/bigquery.admin"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: roles/bigquery.admin
  module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/bigquery.dataViewer"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: roles/bigquery.dataViewer
  module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/bigquery.jobUser"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: roles/bigquery.jobUser
  module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/browser"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: roles/browser
  module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/cloudkms.admin"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: roles/cloudkms.admin
  module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/owner"]:
    condition: []
    members: null
    project: ft0-prod-billing-exp-0
    role: roles/owner
  ? module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/resourcemanager.projectIamAdmin"]
  : condition: []
    project: ft0-prod-billing-exp-0
    role: roles/resourcemanager.projectIamAdmin
  ? module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/serviceusage.serviceUsageAdmin"]
  : condition: []
    project: ft0-prod-billing-exp-0
    role: roles/serviceusage.serviceUsageAdmin
  ? module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/serviceusage.serviceUsageViewer"]
  : condition: []
    project: ft0-prod-billing-exp-0
    role: roles/serviceusage.serviceUsageViewer
  module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/storage.admin"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: roles/storage.admin
  module.factory.module.projects-iam["billing-0"].google_project_iam_binding.authoritative["roles/storage.objectViewer"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: roles/storage.objectViewer
  ? module.factory.module.projects-iam["iac-0"].google_kms_crypto_key_iam_member.service_agent_cmek["key-0.gs-project-accounts"]
  : condition: []
    role: roles/cloudkms.cryptoKeyEncrypterDecrypter
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["$custom_roles:cloudkms_viewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: organizations/1234567890/roles/cloudKmsViewer
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["$custom_roles:storage_viewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: organizations/1234567890/roles/storageViewer
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/accesscontextmanager.policyAdmin"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/accesscontextmanager.policyAdmin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/bigquery.admin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/bigquery.admin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/bigquery.dataViewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/bigquery.dataViewer
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/bigquery.jobUser"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/bigquery.jobUser
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/billing.projectManager"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/billing.projectManager
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/browser"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/browser
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/cloudasset.owner"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/cloudasset.owner
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/cloudbuild.builds.editor"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/cloudbuild.builds.editor
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/cloudbuild.builds.viewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/cloudbuild.builds.viewer
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/cloudkms.admin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/cloudkms.admin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/compute.admin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/compute.admin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/compute.viewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/compute.viewer
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/container.admin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/container.admin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/container.viewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/container.viewer
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/datacatalog.admin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/datacatalog.admin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/iam.roleAdmin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/iam.roleAdmin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/iam.serviceAccountAdmin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/iam.serviceAccountAdmin
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/iam.serviceAccountTokenCreator"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/iam.serviceAccountTokenCreator
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/iam.serviceAccountViewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/iam.serviceAccountViewer
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/iam.workloadIdentityPoolAdmin"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/iam.workloadIdentityPoolAdmin
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/iam.workloadIdentityPoolViewer"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/iam.workloadIdentityPoolViewer
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/logging.admin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/logging.admin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/logging.viewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/logging.viewer
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/monitoring.admin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/monitoring.admin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/monitoring.viewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/monitoring.viewer
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/owner"]:
    condition: []
    members: null
    project: ft0-prod-iac-core-0
    role: roles/owner
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/pubsub.admin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/pubsub.admin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/pubsub.viewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/pubsub.viewer
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/resourcemanager.projectIamAdmin"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/resourcemanager.projectIamAdmin
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/securitycentermanagement.admin"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/securitycentermanagement.admin
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/securitycentermanagement.viewer"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/securitycentermanagement.viewer
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/servicenetworking.networksAdmin"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/servicenetworking.networksAdmin
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/serviceusage.serviceUsageAdmin"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/serviceusage.serviceUsageAdmin
  ? module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/serviceusage.serviceUsageConsumer"]
  : condition: []
    project: ft0-prod-iac-core-0
    role: roles/serviceusage.serviceUsageConsumer
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/storage.admin"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/storage.admin
  module.factory.module.projects-iam["iac-0"].google_project_iam_binding.authoritative["roles/storage.objectViewer"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/storage.objectViewer
  module.factory.module.projects-iam["log-0"].google_kms_crypto_key_iam_member.service_agent_cmek["key-0.logging"]:
    condition: []
    role: roles/cloudkms.cryptoKeyEncrypterDecrypter
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["$custom_roles:cloudkms_viewer"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: organizations/1234567890/roles/cloudKmsViewer
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/browser"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/browser
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/cloudkms.admin"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/cloudkms.admin
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/logging.admin"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/logging.admin
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/logging.viewer"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/logging.viewer
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/monitoring.admin"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/monitoring.admin
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/monitoring.viewer"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/monitoring.viewer
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/owner"]:
    condition: []
    members: null
    project: ft0-prod-audit-logs-0
    role: roles/owner
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/pubsub.admin"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/pubsub.admin
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/pubsub.viewer"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/pubsub.viewer
  ? module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/resourcemanager.projectIamAdmin"]
  : condition: []
    project: ft0-prod-audit-logs-0
    role: roles/resourcemanager.projectIamAdmin
  ? module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/serviceusage.serviceUsageAdmin"]
  : condition: []
    project: ft0-prod-audit-logs-0
    role: roles/serviceusage.serviceUsageAdmin
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/storage.admin"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/storage.admin
  module.factory.module.projects-iam["log-0"].google_project_iam_binding.authoritative["roles/storage.objectViewer"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/storage.objectViewer
  module.factory.module.projects["billing-0"].data.google_bigquery_default_service_account.bq_sa[0]:
    project: ft0-prod-billing-exp-0
  module.factory.module.projects["billing-0"].data.google_logging_project_settings.logging_sa[0]:
    project: ft0-prod-billing-exp-0
  module.factory.module.projects["billing-0"].data.google_storage_project_service_account.gcs_sa[0]:
    project: ft0-prod-billing-exp-0
    user_project: null
  module.factory.module.projects-iam["billing-0"].google_org_policy_policy.default["gcp.restrictCmekCryptoKeyProjects"]:
    dry_run_spec: []
    name: projects/ft0-prod-billing-exp-0/policies/gcp.restrictCmekCryptoKeyProjects
    parent: projects/ft0-prod-billing-exp-0
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: 'TRUE'
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values: []
    timeouts: null
  module.factory.module.projects["billing-0"].google_project.project[0]:
    auto_create_network: false
    billing_account: 012345-012345-012345
    deletion_policy: DELETE
    effective_labels:
      goog-terraform-provisioned: 'true'
    folder_id: null
    labels: null
    name: ft0-prod-billing-exp-0
    org_id: '1234567890'
    project_id: ft0-prod-billing-exp-0
    tags: null
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
  module.factory.module.projects["billing-0"].google_project_iam_member.service_agents["bigquerydatatransfer"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: roles/bigquerydatatransfer.serviceAgent
  module.factory.module.projects["billing-0"].google_project_iam_member.service_agents["cloudkms"]:
    condition: []
    project: ft0-prod-billing-exp-0
    role: roles/cloudkms.serviceAgent
  module.factory.module.projects["billing-0"].google_project_service.project_services["bigquery.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-billing-exp-0
    service: bigquery.googleapis.com
    timeouts: null
  module.factory.module.projects["billing-0"].google_project_service.project_services["bigquerydatatransfer.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-billing-exp-0
    service: bigquerydatatransfer.googleapis.com
    timeouts: null
  module.factory.module.projects["billing-0"].google_project_service.project_services["cloudkms.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-billing-exp-0
    service: cloudkms.googleapis.com
    timeouts: null
  module.factory.module.projects["billing-0"].google_project_service.project_services["logging.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-billing-exp-0
    service: logging.googleapis.com
    timeouts: null
  module.factory.module.projects["billing-0"].google_project_service.project_services["storage.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-billing-exp-0
    service: storage.googleapis.com
    timeouts: null
  module.factory.module.projects["billing-0"].google_project_service_identity.default["bigquerydatatransfer.googleapis.com"]:
    project: ft0-prod-billing-exp-0
    service: bigquerydatatransfer.googleapis.com
    timeouts: null
  module.factory.module.projects["billing-0"].google_project_service_identity.default["cloudkms.googleapis.com"]:
    project: ft0-prod-billing-exp-0
    service: cloudkms.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].data.google_bigquery_default_service_account.bq_sa[0]:
    project: ft0-prod-iac-core-0
  module.factory.module.projects["iac-0"].data.google_logging_project_settings.logging_sa[0]:
    project: ft0-prod-iac-core-0
  module.factory.module.projects["iac-0"].data.google_storage_project_service_account.gcs_sa[0]:
    project: ft0-prod-iac-core-0
    user_project: null
  module.factory.module.projects-iam["iac-0"].google_org_policy_policy.default["gcp.restrictCmekCryptoKeyProjects"]:
    dry_run_spec: []
    name: projects/ft0-prod-iac-core-0/policies/gcp.restrictCmekCryptoKeyProjects
    parent: projects/ft0-prod-iac-core-0
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: 'TRUE'
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values: []
    timeouts: null
  module.factory.module.projects-iam["iac-0"].google_org_policy_policy.default["iam.workloadIdentityPoolProviders"]:
    dry_run_spec: []
    name: projects/ft0-prod-iac-core-0/policies/iam.workloadIdentityPoolProviders
    parent: projects/ft0-prod-iac-core-0
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - https://token.actions.githubusercontent.com
          - https://gitlab.com
          - https://app.terraform.io
          denied_values: null
    timeouts: null
  module.factory.module.projects["iac-0"].google_project.project[0]:
    auto_create_network: false
    billing_account: 012345-012345-012345
    deletion_policy: DELETE
    effective_labels:
      goog-terraform-provisioned: 'true'
    folder_id: null
    labels: null
    name: ft0-prod-iac-core-0
    org_id: '1234567890'
    project_id: ft0-prod-iac-core-0
    tags: null
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["cloudasset"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/cloudasset.serviceAgent
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["cloudbuild"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/cloudbuild.serviceAgent
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["cloudbuild-sa"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/cloudbuild.builds.builder
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["cloudkms"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/cloudkms.serviceAgent
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["compute-system"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/compute.serviceAgent
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["container-engine-robot"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/container.serviceAgent
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["gkenode"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/container.defaultNodeServiceAgent
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["monitoring-notification"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/monitoring.notificationServiceAgent
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["pubsub"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/pubsub.serviceAgent
  module.factory.module.projects["iac-0"].google_project_iam_member.service_agents["service-networking"]:
    condition: []
    project: ft0-prod-iac-core-0
    role: roles/servicenetworking.serviceAgent
  module.factory.module.projects["iac-0"].google_project_service.org_policy_service[0]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: orgpolicy.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["accesscontextmanager.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: accesscontextmanager.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["bigquery.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: bigquery.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["bigqueryreservation.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: bigqueryreservation.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["bigquerystorage.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: bigquerystorage.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["billingbudgets.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: billingbudgets.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["cloudasset.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: cloudasset.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["cloudbilling.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: cloudbilling.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["cloudbuild.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: cloudbuild.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["cloudkms.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: cloudkms.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["cloudquotas.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: cloudquotas.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["cloudresourcemanager.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: cloudresourcemanager.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["compute.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: compute.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["container.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: container.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["datacatalog.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: datacatalog.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["essentialcontacts.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: essentialcontacts.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["iam.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: iam.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["iamcredentials.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: iamcredentials.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["logging.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: logging.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["monitoring.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: monitoring.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["networksecurity.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: networksecurity.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["pubsub.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: pubsub.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["securitycentermanagement.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: securitycentermanagement.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["servicenetworking.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: servicenetworking.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["serviceusage.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: serviceusage.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["storage-component.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: storage-component.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["storage.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: storage.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service.project_services["sts.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-iac-core-0
    service: sts.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service_identity.default["cloudasset.googleapis.com"]:
    project: ft0-prod-iac-core-0
    service: cloudasset.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service_identity.default["cloudkms.googleapis.com"]:
    project: ft0-prod-iac-core-0
    service: cloudkms.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service_identity.default["container.googleapis.com"]:
    project: ft0-prod-iac-core-0
    service: container.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service_identity.default["monitoring.googleapis.com"]:
    project: ft0-prod-iac-core-0
    service: monitoring.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service_identity.default["networksecurity.googleapis.com"]:
    project: ft0-prod-iac-core-0
    service: networksecurity.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service_identity.default["pubsub.googleapis.com"]:
    project: ft0-prod-iac-core-0
    service: pubsub.googleapis.com
    timeouts: null
  module.factory.module.projects["iac-0"].google_project_service_identity.default["servicenetworking.googleapis.com"]:
    project: ft0-prod-iac-core-0
    service: servicenetworking.googleapis.com
    timeouts: null
  module.factory.module.projects["log-0"].data.google_logging_project_settings.logging_sa[0]:
    project: ft0-prod-audit-logs-0
  module.factory.module.projects["log-0"].data.google_storage_project_service_account.gcs_sa[0]:
    project: ft0-prod-audit-logs-0
    user_project: null
  module.factory.module.projects-iam["log-0"].google_org_policy_policy.default["gcp.restrictCmekCryptoKeyProjects"]:
    dry_run_spec: []
    name: projects/ft0-prod-audit-logs-0/policies/gcp.restrictCmekCryptoKeyProjects
    parent: projects/ft0-prod-audit-logs-0
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: 'TRUE'
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values: []
    timeouts: null
  module.factory.module.projects["log-0"].google_project.project[0]:
    auto_create_network: false
    billing_account: 012345-012345-012345
    deletion_policy: DELETE
    effective_labels:
      goog-terraform-provisioned: 'true'
    folder_id: null
    labels: null
    name: ft0-prod-audit-logs-0
    org_id: '1234567890'
    project_id: ft0-prod-audit-logs-0
    tags: null
    terraform_labels:
      goog-terraform-provisioned: 'true'
    timeouts: null
  module.factory.module.projects["log-0"].google_project_iam_member.service_agents["cloudkms"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/cloudkms.serviceAgent
  module.factory.module.projects["log-0"].google_project_iam_member.service_agents["pubsub"]:
    condition: []
    project: ft0-prod-audit-logs-0
    role: roles/pubsub.serviceAgent
  module.factory.module.projects["log-0"].google_project_service.project_services["cloudkms.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-audit-logs-0
    service: cloudkms.googleapis.com
    timeouts: null
  module.factory.module.projects["log-0"].google_project_service.project_services["logging.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-audit-logs-0
    service: logging.googleapis.com
    timeouts: null
  module.factory.module.projects["log-0"].google_project_service.project_services["pubsub.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-audit-logs-0
    service: pubsub.googleapis.com
    timeouts: null
  module.factory.module.projects["log-0"].google_project_service.project_services["storage.googleapis.com"]:
    disable_dependent_services: false
    disable_on_destroy: false
    project: ft0-prod-audit-logs-0
    service: storage.googleapis.com
    timeouts: null
  module.factory.module.projects["log-0"].google_project_service_identity.default["cloudkms.googleapis.com"]:
    project: ft0-prod-audit-logs-0
    service: cloudkms.googleapis.com
    timeouts: null
  module.factory.module.projects["log-0"].google_project_service_identity.default["pubsub.googleapis.com"]:
    project: ft0-prod-audit-logs-0
    service: pubsub.googleapis.com
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-networking-ro"].google_service_account.service_account[0]:
    account_id: iac-networking-ro
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for networking (read-only).
    email: iac-networking-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-networking-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-networking-rw"].google_service_account.service_account[0]:
    account_id: iac-networking-rw
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for networking (read-write).
    email: iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-org-cicd-ro"].google_service_account.service_account[0]:
    account_id: iac-org-cicd-ro
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for org setup CI/CD (read-only).
    email: iac-org-cicd-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-org-cicd-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-org-cicd-rw"].google_service_account.service_account[0]:
    account_id: iac-org-cicd-rw
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for org setup CI/CD (read-write).
    email: iac-org-cicd-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-org-cicd-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-org-ro"].google_service_account.service_account[0]:
    account_id: iac-org-ro
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for org setup (read-only).
    email: iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-org-rw"].google_service_account.service_account[0]:
    account_id: iac-org-rw
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for org setup (read-write).
    email: iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-pf-ro"].google_service_account.service_account[0]:
    account_id: iac-pf-ro
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for project factory (read-only).
    email: iac-pf-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-pf-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-pf-rw"].google_service_account.service_account[0]:
    account_id: iac-pf-rw
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for project factory (read-write).
    email: iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-security-ro"].google_service_account.service_account[0]:
    account_id: iac-security-ro
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for security (read-only).
    email: iac-security-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-security-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-security-rw"].google_service_account.service_account[0]:
    account_id: iac-security-rw
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for security (read-write).
    email: iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-vpcsc-ro"].google_service_account.service_account[0]:
    account_id: iac-vpcsc-ro
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for VPC service controls (read-only).
    email: iac-vpcsc-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-vpcsc-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  module.factory.module.service-accounts["iac-0/iac-vpcsc-rw"].google_service_account.service_account[0]:
    account_id: iac-vpcsc-rw
    create_ignore_already_exists: null
    description: null
    disabled: false
    display_name: IaC service account for VPC service controls (read-write).
    email: iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    member: serviceAccount:iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    project: ft0-prod-iac-core-0
    timeouts: null
  ? module.factory.module.service-accounts-iam["iac-0/iac-org-cicd-ro"].google_service_account_iam_member.additive["$service_account_ids:iac-0/iac-org-ro-roles/iam.serviceAccountTokenCreator"]
  : condition: []
    role: roles/iam.serviceAccountTokenCreator
    service_account_id: projects/ft0-prod-iac-core-0/serviceAccounts/iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
  ? module.factory.module.service-accounts-iam["iac-0/iac-org-cicd-ro"].google_service_account_iam_member.additive["$service_account_ids:iac-0/iac-org-ro-roles/iam.workloadIdentityUser"]
  : condition: []
    role: roles/iam.workloadIdentityUser
    service_account_id: projects/ft0-prod-iac-core-0/serviceAccounts/iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
  ? module.factory.module.service-accounts-iam["iac-0/iac-org-cicd-rw"].google_service_account_iam_member.additive["$service_account_ids:iac-0/iac-org-rw-roles/iam.serviceAccountTokenCreator"]
  : condition: []
    role: roles/iam.serviceAccountTokenCreator
    service_account_id: projects/ft0-prod-iac-core-0/serviceAccounts/iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
  ? module.factory.module.service-accounts-iam["iac-0/iac-org-cicd-rw"].google_service_account_iam_member.additive["$service_account_ids:iac-0/iac-org-rw-roles/iam.workloadIdentityUser"]
  : condition: []
    role: roles/iam.workloadIdentityUser
    service_account_id: projects/ft0-prod-iac-core-0/serviceAccounts/iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
  module.factory.terraform_data.defaults_preconditions:
    input: null
    output: null
    triggers_replace: null
  module.factory.terraform_data.project_preconditions:
    input: null
    output: null
    triggers_replace: null
  module.organization-iam[0].google_logging_organization_sink.sink["audit-logs"]:
    description: audit-logs (Terraform-managed).
    disabled: false
    exclusions: []
    filter: 'log_id("cloudaudit.googleapis.com/activity") OR

      log_id("cloudaudit.googleapis.com/system_event") OR

      log_id("cloudaudit.googleapis.com/policy") OR

      log_id("cloudaudit.googleapis.com/access_transparency")

      '
    include_children: true
    intercept_children: false
    name: audit-logs
    org_id: '1234567890'
  module.organization-iam[0].google_logging_organization_sink.sink["iam"]:
    description: iam (Terraform-managed).
    disabled: false
    exclusions: []
    filter: 'protoPayload.serviceName="iamcredentials.googleapis.com" OR

      protoPayload.serviceName="iam.googleapis.com" OR

      protoPayload.serviceName="sts.googleapis.com"

      '
    include_children: true
    intercept_children: false
    name: iam
    org_id: '1234567890'
  module.organization-iam[0].google_logging_organization_sink.sink["vpc-sc"]:
    description: vpc-sc (Terraform-managed).
    disabled: false
    exclusions: []
    filter: 'protoPayload.metadata.@type="type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata"

      '
    include_children: true
    intercept_children: false
    name: vpc-sc
    org_id: '1234567890'
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.accesscontextmanagerDisableBridgePerimeters"]
  : action_type: DENY
    condition: resource.perimeterType == 'PERIMETER_TYPE_BRIDGE'
    description: Ensure no perimeter bridges are used. Instead, use ingress and egress
      rules.
    display_name: Deny usage of perimeter bridges
    method_types:
    - CREATE
    - UPDATE
    name: custom.accesscontextmanagerDisableBridgePerimeters
    parent: organizations/1234567890
    resource_types:
    - accesscontextmanager.googleapis.com/ServicePerimeter
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudbuildDisableWorkerPoolExternalIP"]:
    action_type: DENY
    condition: (resource.privatePoolV1Config.networkConfig.egressOption != "NO_PUBLIC_EGRESS")
    description: Ensure no unauthorized worker pools external ip used for each build
    display_name: Deny unauthorized worker pools external ip used for each build
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudbuildDisableWorkerPoolExternalIP
    parent: organizations/1234567890
    resource_types:
    - cloudbuild.googleapis.com/WorkerPool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudkmsAllowedAlgorithms"]:
    action_type: DENY
    condition: "has(resource.versionTemplate.algorithm) && resource.versionTemplate.algorithm\
      \ in [\n  'GOOGLE_SYMMETRIC_ENCRYPTION',\n  'RSA_SIGN_PSS_2048_SHA256',\n  'RSA_SIGN_PSS_3072_SHA256',\n\
      \  'RSA_SIGN_PSS_4096_SHA256',\n  'RSA_DECRYPT_OAEP_2048_SHA256',\n  'RSA_DECRYPT_OAEP_4096_SHA256',\n\
      \  'RSA_DECRYPT_OAEP_2048_SHA1',\n  'RSA_DECRYPT_OAEP_4096_SHA1'\n] == false"
    description: Ensure the algorithm for Cloud KMS keys is configured correctly
    display_name: Require Cloud KMS keys algorithm to be configured correctly
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudkmsAllowedAlgorithms
    parent: organizations/1234567890
    resource_types:
    - cloudkms.googleapis.com/CryptoKey
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudkmsAllowedProtectionLevel"]:
    action_type: DENY
    condition: has(resource.versionTemplate.protectionLevel) && resource.versionTemplate.protectionLevel
      in ["SOFTWARE"] == false
    description: Ensure the protection level for Cloud KMS keys is configured correctly
    display_name: Require Cloud KMS keys protection level to be configured correctly
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudkmsAllowedProtectionLevel
    parent: organizations/1234567890
    resource_types:
    - cloudkms.googleapis.com/CryptoKey
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudkmsAllowedRotationPeriod"]:
    action_type: DENY
    condition: has(resource.rotationPeriod) && resource.rotationPeriod > duration("7776000s")
    description: Ensure the rotation period for Cloud KMS keys is configured correctly
    display_name: Require Cloud KMS keys to have rotation period configured correctly
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudkmsAllowedRotationPeriod
    parent: organizations/1234567890
    resource_types:
    - cloudkms.googleapis.com/CryptoKey
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudrunDisableEnvironmentVariablePattern"]
  : action_type: DENY
    condition: "resource.spec.template.spec.containers.exists(container,\n  container.env.exists(env,\n\
      \    [\"[sS][eE][cC][rR][eE][tT]\", \"[kK][eE][yY]\", \"[pP][aA][sS][sS][wW][oO][rR][dD]\"\
      , \"[tT][oO][kK][eE][nN]\"].exists(\n      pattern, env.name.matches(pattern)\n\
      \    )\n  )\n)"
    description: Enforce that certain patterns are not used in environment variables
      of Cloud Run Service or Cloud Run Functions
    display_name: Disable usage of certain patterns in Cloud Run Service or Cloud
      Run Functions environment variables
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudrunDisableEnvironmentVariablePattern
    parent: organizations/1234567890
    resource_types:
    - run.googleapis.com/Service
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudrunJobDisableDefaultServiceAccount"]
  : action_type: DENY
    condition: resource.spec.template.spec.template.spec.serviceAccountName.endsWith('@developer.gserviceaccount.com')
    description: Enforce that service account associated with Cloud Run Job use a
      non-default service account
    display_name: Disable creation of Cloud Run Job using default service account
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudrunJobDisableDefaultServiceAccount
    parent: organizations/1234567890
    resource_types:
    - run.googleapis.com/Job
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudrunJobRequireBinaryAuthorization"]:
    action_type: DENY
    condition: '!(''run.googleapis.com/binary-authorization'' in resource.metadata.annotations)'
    description: Enforce that Cloud Run Job are using binary authorization
    display_name: Disable creation of Cloud Run Job without Binary Authorization
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudrunJobRequireBinaryAuthorization
    parent: organizations/1234567890
    resource_types:
    - run.googleapis.com/Job
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudrunServiceDisableDefaultServiceAccount"]
  : action_type: DENY
    condition: resource.spec.template.spec.serviceAccountName.endsWith('@developer.gserviceaccount.com')
    description: Enforce that service account associated with Cloud Run Service use
      a non-default service account
    display_name: Disable creation of Cloud Run Service using default service account
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudrunServiceDisableDefaultServiceAccount
    parent: organizations/1234567890
    resource_types:
    - run.googleapis.com/Service
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudrunServiceRequireBinaryAuthorization"]
  : action_type: DENY
    condition: '!(''run.googleapis.com/binary-authorization'' in resource.metadata.annotations)'
    description: Enforce that Cloud Run Service are using binary authorization
    display_name: Disable creation of Cloud Run Service without Binary Authorization
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudrunServiceRequireBinaryAuthorization
    parent: organizations/1234567890
    resource_types:
    - run.googleapis.com/Service
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlDisablePublicAuthorizedNetworks"]
  : action_type: DENY
    condition: resource.settings.ipConfiguration.authorizedNetworks.exists(network,
      network.value == '0.0.0.0/0')
    description: Ensure That Cloud SQL database instances do not implicitly whitelist
      all public IP addresses
    display_name: Require Cloud SQL database instances to not whitelist all public
      IP addresses
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlDisablePublicAuthorizedNetworks
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlEnforcePasswordComplexity"]:
    action_type: DENY
    condition: 'resource.settings.passwordValidationPolicy.complexity != ''COMPLEXITY_DEFAULT''
      ||

      resource.settings.passwordValidationPolicy.minLength < 12'
    description: Ensure that Cloud SQL instance is configured with a password complexity
      to be combination of lowercase, uppercase, numeric, and non-alphanumeric characters
    display_name: Require Cloud SQL instances to configure password complexity to
      COMPLEXITY_DEFAULT
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlEnforcePasswordComplexity
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlRequireAutomatedBackup"]:
    action_type: DENY
    condition: resource.settings.backupConfiguration.enabled != true
    description: Ensure that Cloud SQL instance have automated backup enabled
    display_name: Require Cloud SQL instances to have automated backup enabled
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlRequireAutomatedBackup
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlRequireHighAvailability"]:
    action_type: DENY
    condition: resource.settings.availabilityType != "REGIONAL"
    description: Ensure that Cloud SQL instance is configured with high availability
    display_name: Require Cloud SQL instances to be configured with high availability
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlRequireHighAvailability
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlRequireMySQLDatabaseFlags"]:
    action_type: DENY
    condition: "resource.databaseVersion.startsWith('MYSQL') && (\n  !resource.settings.databaseFlags.exists(flag,\n\
      \    flag.name == 'skip_show_database' && flag.value == 'on'\n  ) ||\n  !resource.settings.databaseFlags.exists(flag,\n\
      \    flag.name == 'local_infile' && flag.value == 'off'\n  )\n)"
    description: Ensure Cloud SQL for MySQL instance database flags are set correctly
      (e.g skip_show_database, local_infile)
    display_name: Require Cloud SQL for MySQL instance database flags to be configured
      correctly (e.g skip_show_database, local_infile)
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlRequireMySQLDatabaseFlags
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlRequirePointInTimeRecovery"]:
    action_type: DENY
    condition: "(resource.databaseVersion.contains(\"POSTGRES\")\n  || resource.databaseVersion.contains(\"\
      SQLSERVER\"))\n  && resource.settings.backupConfiguration.pointInTimeRecoveryEnabled\
      \ == false"
    description: Ensure that Cloud SQL instance is configure enable point in time
      recovery in the backup configuration. This setting is possibly for Postgres
      and SQLServer databases.
    display_name: Require Cloud SQL instances to enable point in time recovery
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlRequirePointInTimeRecovery
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlRequirePostgreSQLDatabaseAdditionalFlags"]
  : action_type: DENY
    condition: "resource.databaseVersion.startsWith('POSTGRES') && (\n  !resource.settings.databaseFlags.exists(flag,\
      \ flag.name == 'log_checkpoints' && flag.value == 'on') ||\n  !resource.settings.databaseFlags.exists(flag,\
      \ flag.name == 'log_executor_stats' && flag.value == 'off') ||\n  !resource.settings.databaseFlags.exists(flag,\
      \ flag.name == 'log_lock_waits' && flag.value == 'on')\n)"
    description: Ensure Cloud SQL for PostgreSQL instance database flags are set correctly
      (e.g log_checkpoints, log_executor_stats, log_lock_waits)
    display_name: Require Cloud SQL for PostgreSQL instance database flags to be configured
      correctly (e.g log_checkpoints, log_executor_stats, log_lock_waits)
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlRequirePostgreSQLDatabaseAdditionalFlags
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlRequirePostgreSQLDatabaseFlags"]:
    action_type: DENY
    condition: "resource.databaseVersion.startsWith('POSTGRES') && (\n  !resource.settings.databaseFlags.exists(f,\
      \ f.name == 'log_connections' && f.value == 'on') ||\n  !resource.settings.databaseFlags.exists(f,\
      \ f.name == 'log_disconnections' && f.value == 'on') ||\n  !resource.settings.databaseFlags.exists(f,\
      \ f.name == 'log_min_duration_statement' && f.value == '-1') ||\n  !resource.settings.databaseFlags.exists(f,\
      \ f.name == 'cloudsql.enable_pgaudit' && f.value == 'on') ||\n  resource.settings.databaseFlags.exists(f,\
      \ f.name == 'log_error_verbosity' && f.value == 'terse') ||\n  resource.settings.databaseFlags.exists(f,\
      \ f.name == 'log_statement' && f.value == 'none') ||\n  resource.settings.databaseFlags.exists(f,\n\
      \    f.name == 'log_min_messages' && f.value in ['error' , 'log', 'fatal', 'panic']\n\
      \  ) ||\n  resource.settings.databaseFlags.exists(f,\n    f.name == 'log_min_error_statement'\
      \ && f.value in ['log', 'fatal', 'panic']\n  )\n)"
    description: Ensure Cloud SQL for PostgreSQL instance database flags are set correctly
      (e.g log_connections)
    display_name: Require Cloud SQL for PostgreSQL instance database flags to be configured
      correctly (e.g log_connections)
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlRequirePostgreSQLDatabaseFlags
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlRequireRootPassword"]:
    action_type: DENY
    condition: resource.settings.passwordValidationPolicy.minLength == 0
    description: Ensure that Cloud SQL instance is configured to use a root password
    display_name: Require Cloud SQL instances to configure root password
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlRequireRootPassword
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlRequireSQLServerDatabaseFlags"]:
    action_type: DENY
    condition: "resource.databaseVersion.startsWith('SQLSERVER') && (\n  resource.settings.databaseFlags.exists(flag,\n\
      \    flag.name == 'external scripts enabled' && flag.value == 'on'\n  ) ||\n\
      \  resource.settings.databaseFlags.exists(flag,\n    flag.name == 'cross db\
      \ ownership chaining' && flag.value == 'on'\n  ) ||\n  resource.settings.databaseFlags.exists(flag,\n\
      \    flag.name == 'contained database authentication' && flag.value == 'on'\n\
      \  ) ||\n  resource.settings.databaseFlags.exists(flag,\n    flag.name == 'user\
      \ connections' && flag.value != '0'\n  ) ||\n  resource.settings.databaseFlags.exists(flag,\n\
      \    flag.name == 'user options' && flag.value != '0'\n  ) ||\n  !resource.settings.databaseFlags.exists(flag,\n\
      \    flag.name == 'remote access' && flag.value == 'off'\n  ) ||\n  !resource.settings.databaseFlags.exists(flag,\n\
      \    flag.name == '3625' && flag.value == 'on'\n  )\n)"
    description: Ensure Cloud SQL for SQLServer instance database flags are set correctly
      (e.g external scripts enabled ...)
    display_name: Require Cloud SQL for SQLServer instance database flags to be configured
      correctly (e.g external scripts enabled ...)
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlRequireSQLServerDatabaseFlags
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.cloudsqlRequireSSLConnection"]:
    action_type: DENY
    condition: resource.settings.ipConfiguration.sslMode in ['ENCRYPTED_ONLY', 'TRUSTED_CLIENT_CERTIFICATE_REQUIRED']
      == false
    description: Ensure that Cloud SQL instance is configured to allow only connections
      that are encrypted with SSL/TLS
    display_name: Require Cloud SQL instances to allow only connections that are encrypted
      with SSL/TLS
    method_types:
    - CREATE
    - UPDATE
    name: custom.cloudsqlRequireSSLConnection
    parent: organizations/1234567890
    resource_types:
    - sqladmin.googleapis.com/Instance
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.dataprocDisableDefaultServiceAccount"]:
    action_type: DENY
    condition: "has(resource.config.gceClusterConfig.serviceAccount) == false ||\n\
      \  resource.config.gceClusterConfig.serviceAccount.contains('-compute@developer.gserviceaccount.com')"
    description: Enforce that the Dataproc VMs is not using default user-managed service
      accounts
    display_name: Disable Dataproc cluster with default service accounts
    method_types:
    - CREATE
    - UPDATE
    name: custom.dataprocDisableDefaultServiceAccount
    parent: organizations/1234567890
    resource_types:
    - dataproc.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.dataprocRequireDiskCmekEncryption"]:
    action_type: DENY
    condition: has(resource.config.encryptionConfig.gcePdKmsKeyName) == false
    description: Enforce that the Dataproc cluster is created with an CMEK encryption
      key.
    display_name: Enable Dataproc CMEK encryption
    method_types:
    - CREATE
    - UPDATE
    name: custom.dataprocRequireDiskCmekEncryption
    parent: organizations/1234567890
    resource_types:
    - dataproc.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.dataprocRequireInternalIp"]:
    action_type: DENY
    condition: resource.config.gceClusterConfig.internalIpOnly == false
    description: Enforce that the Dataproc cluster is created with Internal IPs only
    display_name: Require Dataproc with internal IPs
    method_types:
    - CREATE
    - UPDATE
    name: custom.dataprocRequireInternalIp
    parent: organizations/1234567890
    resource_types:
    - dataproc.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.dataprocRequireKerberos"]:
    action_type: DENY
    condition: resource.config.securityConfig.kerberosConfig.enableKerberos == false
    description: Enforce that Dataproc cluster is configured using secure mode via
      Kerberos for authentication
    display_name: Require Dataproc with Kerberos authentication
    method_types:
    - CREATE
    - UPDATE
    name: custom.dataprocRequireKerberos
    parent: organizations/1234567890
    resource_types:
    - dataproc.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.dnsAllowedSigningAlgorithms"]:
    action_type: DENY
    condition: "resource.visibility == 'PUBLIC' &&\nresource.dnssecConfig.state ==\
      \ 'ON' &&\nresource.dnssecConfig.defaultKeySpecs.exists(spec,\n  spec.algorithm\
      \ in [\"ECDSAP256SHA256\"] == false\n)"
    description: Ensure that allowed signing algorithms are used for the Key-Signing
      key and Zone-Signing key in Cloud DNS DNSSEC
    display_name: Require Cloud DNS DNSSEC configured to use only allowed algorithms
      in Cloud DNS DNSSEC
    method_types:
    - CREATE
    - UPDATE
    name: custom.dnsAllowedSigningAlgorithms
    parent: organizations/1234567890
    resource_types:
    - dns.googleapis.com/ManagedZone
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.dnsRequireManageZoneDNSSEC"]:
    action_type: DENY
    condition: resource.visibility == "PUBLIC" && (resource.dnssecConfig.state in
      ["ON", "TRANSFER"] == false)
    description: Ensure that Cloud DNS DNSSEC is enabled when configuring a DNS Public
      Managed Zone
    display_name: Require Cloud DNS DNSSEC enabled when configuring a DNS Public Managed
      Zone
    method_types:
    - CREATE
    - UPDATE
    name: custom.dnsRequireManageZoneDNSSEC
    parent: organizations/1234567890
    resource_types:
    - dns.googleapis.com/ManagedZone
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.dnsRequirePolicyLogging"]:
    action_type: DENY
    condition: resource.enableLogging != true
    description: Ensure that Cloud DNS logging is enabled when configuring a DNS Policy
    display_name: Require Cloud DNS logging enabled when configuring a DNS Policy
    method_types:
    - CREATE
    - UPDATE
    name: custom.dnsRequirePolicyLogging
    parent: organizations/1234567890
    resource_types:
    - dns.googleapis.com/Policy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallEnforcePolicyRuleLogging"]:
    action_type: DENY
    condition: resource.rules.exists(rule, rule.action != 'goto_next' && rule.enableLogging
      == false)
    description: Ensure that Firewall Policy rules have logging enabled
    display_name: Require Firewall Policy rules to have logging enabled
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallEnforcePolicyRuleLogging
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallEnforceRuleLogging"]:
    action_type: DENY
    condition: "(\n  (has(resource.logConfig) == false || resource.logConfig.enable\
      \ == false) &&\n  !resource.name.startsWith(\"gke-\") &&\n  !resource.name.startsWith(\"\
      k8s-\") &&\n  !resource.name.endsWith(\"-hc\") &&\n  !resource.name.startsWith(\"\
      k8s2-\") &&\n  !resource.name.startsWith(\"gkegw1-l7-\") &&\n  !resource.name.startsWith(\"\
      gkemcg1-l7-\")\n)"
    description: Ensure that VPC Firewall rules have logging enabled
    display_name: Require VPC Firewall rules to have logging enabled
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallEnforceRuleLogging
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRequireDescription"]:
    action_type: DENY
    condition: "(\n  resource.description == \"\" &&\n  !resource.name.startsWith(\"\
      gke-\") &&\n  !resource.name.startsWith(\"k8s-\") &&\n  !resource.name.endsWith(\"\
      -hc\") &&\n  !resource.name.startsWith(\"k8s2-\") &&\n  !resource.name.startsWith(\"\
      gkegw1-l7-\") &&\n  !resource.name.startsWith(\"gkemcg1-l7-\")\n)"
    description: Prevent the creation of VPC firewall rule that does not have description
      provided. Description can be used for auditing to refer to security control
    display_name: Require description on Firewall rule
    method_types:
    - CREATE
    name: custom.firewallRequireDescription
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictCacheSearchDatabasesPolicyRule"]
  : action_type: DENY
    condition: "resource.rules.exists(r, r.priority < 2147483644 && r.direction ==\
      \ 'INGRESS' &&\n  r.match.srcIpRanges.exists(r, r == '0.0.0.0/0') &&\n  (\n\
      \    r.match.layer4Configs.containsIpProtocolAndPort('tcp', '6379') ||\n   \
      \ r.match.layer4Configs.containsIpProtocolAndPort('udp', '6379') ||\n    r.match.layer4Configs.containsIpProtocolAndPort('tcp',\
      \ '9200') ||\n    r.match.layer4Configs.containsIpProtocolAndPort('udp', '9200')\
      \ ||\n    r.match.layer4Configs.containsIpProtocolAndPort('tcp', '9300') ||\n\
      \    r.match.layer4Configs.containsIpProtocolAndPort('udp', '9300') ||\n   \
      \ r.match.layer4Configs.containsIpProtocolAndPort('tcp', '11211') ||\n    r.match.layer4Configs.containsIpProtocolAndPort('udp',\
      \ '11211') ||\n    r.match.layer4Configs.containsIpProtocolAndPort('tcp', '11214')\
      \ ||\n    r.match.layer4Configs.containsIpProtocolAndPort('udp', '11214') ||\n\
      \    r.match.layer4Configs.containsIpProtocolAndPort('tcp', '11215') ||\n  \
      \  r.match.layer4Configs.containsIpProtocolAndPort('udp', '11215')\n  )\n)"
    description: Ensure that cache and search database ports (Elasticsearch, Memcached,
      Redis) are not accessible from any source when using Firewall Policy Rule
    display_name: Restrict Firewall Policy rules allowing cache/search database port
      access from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictCacheSearchDatabasesPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictCacheSearchDatabasesRule"]
  : action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n  resource.sourceRanges.exists(range,\
      \ range == '0.0.0.0/0') &&\n  (\n    resource.allowed.containsFirewallPort('tcp',\
      \ '9200') ||\n    resource.allowed.containsFirewallPort('tcp', '9300') ||\n\
      \    resource.allowed.containsFirewallPort('tcp', '11211') ||\n    resource.allowed.containsFirewallPort('tcp',\
      \ '11214') ||\n    resource.allowed.containsFirewallPort('tcp', '11215') ||\n\
      \    resource.allowed.containsFirewallPort('tcp', '6379') ||\n    resource.allowed.containsFirewallPort('udp',\
      \ '11211') ||\n    resource.allowed.containsFirewallPort('udp', '11214') ||\n\
      \    resource.allowed.containsFirewallPort('udp', '11215')\n  )"
    description: Ensure that cache and search database ports (Elasticsearch, Memcached,
      Redis) are not accessible from any source when using VPC Firewall Rule.
    display_name: Restrict VPC Firewall rules allowing cache/search database port
      access from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictCacheSearchDatabasesRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictDirectoryServicesPolicyRule"]
  : action_type: DENY
    condition: "resource.rules.exists(rule,\n  rule.priority < 2147483644 &&\n  rule.direction\
      \ == 'INGRESS' &&\n  rule.match.srcIpRanges.exists(range, range == '0.0.0.0/0')\
      \ &&\n  (\n    rule.match.layer4Configs.containsIpProtocolAndPort('udp', '445')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('udp', '389') ||\n\
      \    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '445') ||\n \
      \   rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '389') ||\n  \
      \  rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '636')\n  )\n)"
    description: Ensure that directory and authentication services (SMB/CIFS, LDAP)
      are not accessible from the Internet when using Firewall Policy Rule
    display_name: Restrict Firewall Policy rules allowing directory service access
      from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictDirectoryServicesPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictDirectoryServicesRule"]:
    action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n  resource.sourceRanges.exists(range,\
      \ range == '0.0.0.0/0') &&\n  (\n    resource.allowed.containsFirewallPort('tcp',\
      \ '445') ||\n    resource.allowed.containsFirewallPort('tcp', '389') ||\n  \
      \  resource.allowed.containsFirewallPort('tcp', '636') ||\n    resource.allowed.containsFirewallPort('udp',\
      \ '445') ||\n    resource.allowed.containsFirewallPort('udp', '389')\n  )"
    description: Ensure that directory and authentication services (SMB/CIFS, LDAP)
      are not accessible from the Internet when using VPC Firewall Rule
    display_name: Restrict VPC Firewall rules allowing directory service access from
      any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictDirectoryServicesRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictExplicitAllPortsPolicyRule"]
  : action_type: DENY
    condition: "resource.rules.exists(rule,\n  rule.action == 'allow' &&\n  rule.priority\
      \ < 2147483644 &&\n  rule.direction == 'INGRESS' &&\n  rule.match.layer4Configs.exists(l4,\n\
      \    l4.ipProtocol in ['tcp', 'udp'] && (\n      !has(l4.ports) ||\n      '0-65535'\
      \ in l4.ports ||\n      '1-65535' in l4.ports\n    )\n  )\n)"
    description: Prevent Firewall Policy rules that explicitly specify all TCP/UDP
      ports using ranges like 0-65535 or 1-65535
    display_name: Restrict Firewall Policy rules with explicit all-ports specifications
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictExplicitAllPortsPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictExplicitAllPortsRule"]:
    action_type: DENY
    condition: "resource.direction == 'INGRESS' &&\nresource.allowed.exists(rule,\n\
      \  rule.IPProtocol in ['tcp', 'udp'] && (\n    !has(rule.ports) ||\n    '0-65535'\
      \ in rule.ports ||\n    '1-65535' in rule.ports\n  )\n) &&\n!resource.name.startsWith('gke-')\
      \ &&\n!resource.name.startsWith('k8s-') &&\n!resource.name.endsWith('-hc') &&\n\
      !resource.name.startsWith('k8s2-') &&\n!resource.name.startsWith('gkegw1-l7-')\
      \ &&\n!resource.name.startsWith('gkemcg1-l7-')"
    description: Prevent VPC firewall rules that explicitly specify all TCP/UDP ports
      using ranges like 0-65535 or 1-65535
    display_name: Restrict VPC Firewall rules with explicit all-ports specifications
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictExplicitAllPortsRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictInsecureProtocolsPolicyRule"]
  : action_type: DENY
    condition: "resource.rules.exists(rule,\n  rule.priority < 2147483644 &&\n  rule.direction\
      \ == 'INGRESS' &&\n  rule.match.srcIpRanges.exists(range, range == '0.0.0.0/0')\
      \ &&\n  (\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '21')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '23') ||\n\
      \    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '80')\n  )\n)"
    description: Ensure that insecure legacy protocols (Telnet, FTP, HTTP) are not
      accessible from any source when using Firewall Policy Rule
    display_name: Restrict Firewall Policy rules allowing insecure protocol access
      from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictInsecureProtocolsPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictInsecureProtocolsRule"]:
    action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n  resource.sourceRanges.exists(range,\
      \ range == '0.0.0.0/0') &&\n  (\n    resource.allowed.containsFirewallPort('tcp',\
      \ '21') ||\n    resource.allowed.containsFirewallPort('tcp', '23') ||\n    resource.allowed.containsFirewallPort('tcp',\
      \ '80')\n  )"
    description: Ensure that insecure legacy protocols (Telnet, FTP, HTTP) are not
      accessible from any source when using VPC Firewall Rule
    display_name: Restrict VPC Firewall rules allowing insecure protocol access from
      any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictInsecureProtocolsRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictMailProtocolsPolicyRule"]
  : action_type: DENY
    condition: "resource.rules.exists(rule,\n  rule.priority < 2147483644 &&\n  rule.direction\
      \ == 'INGRESS' &&\n  rule.match.srcIpRanges.exists(range, range == '0.0.0.0/0')\
      \ &&\n  (\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '25')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '110')\n\
      \  )\n)"
    description: Ensure that mail protocols (SMTP, POP3) are not accessible from any
      source when using Firewall Policy Rule
    display_name: Restrict Firewall Policy rules allowing mail protocol access from
      any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictMailProtocolsPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictMailProtocolsRule"]:
    action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n  resource.sourceRanges.exists(range,\
      \ range == '0.0.0.0/0') &&\n  (\n    resource.allowed.containsFirewallPort('tcp',\
      \ '25') ||\n    resource.allowed.containsFirewallPort('tcp', '110')\n  )"
    description: Ensure that mail protocols (SMTP, POP3) are not accessible from any
      source when using VPC Firewall Rule
    display_name: Restrict VPC Firewall rules allowing mail protocol access from any
      source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictMailProtocolsRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictManagementPortsPolicyRule"]
  : action_type: DENY
    condition: "resource.rules.exists(rule,\n  rule.priority < 2147483644 &&\n  rule.direction\
      \ == 'INGRESS' &&\n  rule.match.srcIpRanges.exists(range, range == '0.0.0.0/0')\
      \ &&\n  rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '9090')\n)"
    description: Ensure that management interfaces (Cisco Secure WebSM) are not accessible
      from any source when using Firewall Policy Rule
    display_name: Restrict Firewall Policy rules allowing management port access from
      any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictManagementPortsPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictManagementPortsRule"]:
    action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n  resource.sourceRanges.exists(range,\
      \ range == '0.0.0.0/0') &&\n  resource.allowed.containsFirewallPort('tcp', '9090')"
    description: Ensure that management interfaces (Cisco Secure WebSM) are not accessible
      from any source when using VPC Firewall Rule
    display_name: Restrict VPC Firewall rules allowing management port access from
      any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictManagementPortsRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictNetworkServicesPolicyRule"]
  : action_type: DENY
    condition: "resource.rules.exists(rule,\n  rule.priority < 2147483644 &&\n  rule.direction\
      \ == 'INGRESS' &&\n  rule.match.srcIpRanges.exists(range, range == '0.0.0.0/0')\
      \ &&\n  (\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '53')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('udp', '53') ||\n\
      \    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '137') ||\n \
      \   rule.match.layer4Configs.containsIpProtocolAndPort('udp', '137') ||\n  \
      \  rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '138') ||\n   \
      \ rule.match.layer4Configs.containsIpProtocolAndPort('udp', '138') ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp',\
      \ '139') ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('udp', '139')\n\
      \  )\n)"
    description: Ensure that network infrastructure services (DNS, NetBIOS) are not
      accessible from any source when using Firewall Policy Rule
    display_name: Restrict Firewall Policy rules allowing network service access from
      any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictNetworkServicesPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictNetworkServicesRule"]:
    action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n  resource.sourceRanges.exists(range,\
      \ range == '0.0.0.0/0') &&\n  (\n    resource.allowed.containsFirewallPort('tcp',\
      \ '53') ||\n    resource.allowed.containsFirewallPort('udp', '53') ||\n    resource.allowed.containsFirewallPort('tcp',\
      \ '137') ||\n    resource.allowed.containsFirewallPort('udp', '137') ||\n  \
      \  resource.allowed.containsFirewallPort('tcp', '138') ||\n    resource.allowed.containsFirewallPort('udp',\
      \ '138') ||\n    resource.allowed.containsFirewallPort('tcp', '139') ||\n  \
      \  resource.allowed.containsFirewallPort('udp', '139')\n  )"
    description: Ensure that network infrastructure services (DNS, NetBIOS) are not
      accessible from any source when using VPC Firewall Rule
    display_name: Restrict VPC Firewall rules allowing network service access from
      any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictNetworkServicesRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictNoSQLDatabasesPolicyRule"]
  : action_type: DENY
    condition: "resource.rules.exists(rule,\n  rule.priority < 2147483644 &&\n  rule.direction\
      \ == 'INGRESS' &&\n  rule.match.srcIpRanges.exists(range, range == '0.0.0.0/0')\
      \ &&\n  (\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '7000')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '7001')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '7199')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '8888')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '9042')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '9160')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '61620')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '61621')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '27017')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '27018')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '27019')\n\
      \  )\n)"
    description: Ensure that NoSQL database ports (Cassandra, MongoDB) are not accessible
      from any source when using Firewall Policy Rule
    display_name: Restrict Firewall Policy rules allowing NoSQL database port access
      from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictNoSQLDatabasesPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictNoSQLDatabasesRule"]:
    action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n  resource.sourceRanges.exists(range,\
      \ range == '0.0.0.0/0') &&\n  (\n    resource.allowed.containsFirewallPort('tcp',\
      \ '7000') ||\n    resource.allowed.containsFirewallPort('tcp', '7001') ||\n\
      \    resource.allowed.containsFirewallPort('tcp', '7199') ||\n    resource.allowed.containsFirewallPort('tcp',\
      \ '8888') ||\n    resource.allowed.containsFirewallPort('tcp', '9042') ||\n\
      \    resource.allowed.containsFirewallPort('tcp', '9160') ||\n    resource.allowed.containsFirewallPort('tcp',\
      \ '61620') ||\n    resource.allowed.containsFirewallPort('tcp', '61621') ||\n\
      \    resource.allowed.containsFirewallPort('tcp', '27017') ||\n    resource.allowed.containsFirewallPort('tcp',\
      \ '27018') ||\n    resource.allowed.containsFirewallPort('tcp', '27019')\n \
      \ )"
    description: Ensure that NoSQL database ports (Cassandra, MongoDB) are not accessible
      from any source when using Firewall Policy Rule
    display_name: Restrict VPC Firewall rules allowing NoSQL database port access
      from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictNoSQLDatabasesRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictPublicAccessPolicyRule"]:
    action_type: DENY
    condition: "resource.rules.exists(rule,\n  rule.action == 'allow' &&\n  rule.priority\
      \ < 2147483644 &&\n  rule.direction == 'INGRESS' &&\n  rule.match.srcIpRanges.exists(range,\
      \ range == '0.0.0.0/0') &&\n  !rule.match.layer4Configs.exists(l4,\n    l4.ipProtocol\
      \ == 'icmp'\n  )\n)"
    description: Prevent Firewall Policy ingress rules from 0.0.0.0/0 except for allowed
      protocols (ICMP)
    display_name: Restrict Firewall Policy ingress rules allowing public Internet
      access
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictPublicAccessPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictPublicAccessRule"]:
    action_type: DENY
    condition: "resource.direction == 'INGRESS' &&\nsize(resource.allowed) > 0 &&\n\
      resource.sourceRanges.exists(r, r == '0.0.0.0/0') &&\n!resource.allowed.exists(a,\n\
      \  a.IPProtocol == 'icmp'\n)"
    description: Prevent VPC Firewall ingress rules from 0.0.0.0/0 except for allowed
      protocols (ICMP).
    display_name: Restrict VPC Firewall ingress rules allowing public Internet access
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictPublicAccessRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictRdpPolicyRule"]:
    action_type: DENY
    condition: "resource.rules.exists(rule,\n    rule.priority < 2147483644 &&\n \
      \   rule.direction == 'INGRESS' &&\n    !rule.match.srcIpRanges.all(ipRange,\n\
      \        ipRange == '35.235.240.0/20' ||\n        ipRange.startsWith('192.168.')\
      \ ||\n        ipRange.matches('^172\\\\.(?:1[6-9]|2\\\\d|3[0-1]).*') ||\n  \
      \      ipRange.startsWith('10.')\n    ) &&\n    rule.match.layer4Configs.all(l4config,\n\
      \        l4config.ipProtocol == 'tcp' &&\n        l4config.ports.all(port, port\
      \ == '3389')\n    )\n)"
    description: Ensure that RDP access is restricted from any source when using Firewall
      Policy Rule
    display_name: Restrict Firewall Policy rules allowing RDP access from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictRdpPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictRdpRule"]:
    action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n!resource.name.startsWith('gke-')\
      \ &&\n!resource.name.startsWith('k8s-') &&\n!resource.name.endsWith('-hc') &&\n\
      !resource.name.startsWith('k8s2-') &&\n!resource.name.startsWith('gkegw1-l7-')\
      \ &&\n!resource.name.startsWith('gkemcg1-l7-') &&\nresource.allowed.containsFirewallPort('tcp',\
      \ '3389') &&\n!resource.sourceRanges.all(range,\n  range == '35.235.240.0/20'\
      \ ||\n  range.startsWith('10.') ||\n  range.matches('^172\\\\.(?:1[6-9]|2\\\\\
      d|3[0-1]).*') ||\n  range.startsWith('192.168.')\n)"
    description: Ensure that RDP access is restricted from any source when using VPC
      Firewall Rule
    display_name: Restrict VPC Firewall rules allowing RDP access from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictRdpRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictSQLDatabasesPolicyRule"]:
    action_type: DENY
    condition: "resource.rules.exists(rule,\n  rule.priority < 2147483644 &&\n  rule.direction\
      \ == 'INGRESS' &&\n  rule.match.srcIpRanges.exists(range, range == '0.0.0.0/0')\
      \ &&\n  (\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '3306')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '1521')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '2483')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '2484')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('tcp', '5432')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('udp', '2483')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('udp', '2484')\
      \ ||\n    rule.match.layer4Configs.containsIpProtocolAndPort('udp', '5432')\n\
      \  )\n)"
    description: Ensure that SQL database ports (MySQL, Oracle, PostgreSQL) are not
      accessible from any source when using Firewall Policy Rule
    display_name: Restrict Firewall Policy rules allowing SQL database port access
      from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictSQLDatabasesPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictSQLDatabasesRule"]:
    action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n  resource.sourceRanges.exists(range,\
      \ range == '0.0.0.0/0') &&\n  (\n    resource.allowed.containsFirewallPort('tcp',\
      \ '3306') ||\n    resource.allowed.containsFirewallPort('tcp', '1521') ||\n\
      \    resource.allowed.containsFirewallPort('tcp', '2483') ||\n    resource.allowed.containsFirewallPort('tcp',\
      \ '2484') ||\n    resource.allowed.containsFirewallPort('tcp', '5432') ||\n\
      \    resource.allowed.containsFirewallPort('udp', '2483') ||\n    resource.allowed.containsFirewallPort('udp',\
      \ '2484') ||\n    resource.allowed.containsFirewallPort('udp', '5432')\n  )"
    description: Ensure that SQL database ports (MySQL, Oracle, PostgreSQL) are not
      accessible from any source when using VPC Firewall Rule
    display_name: Restrict VPC Firewall rules allowing SQL database port access from
      any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictSQLDatabasesRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictSshPolicyRule"]:
    action_type: DENY
    condition: "resource.rules.exists(rule,\n    rule.priority < 2147483644 &&\n \
      \   rule.direction == 'INGRESS' &&\n    !rule.match.srcIpRanges.all(ipRange,\n\
      \        ipRange == '35.235.240.0/20' ||\n        ipRange.startsWith('192.168.')\
      \ ||\n        ipRange.matches('^172\\\\.(?:1[6-9]|2\\\\d|3[0-1]).*') ||\n  \
      \      ipRange.startsWith('10.')\n    ) &&\n    rule.match.layer4Configs.all(l4config,\n\
      \        l4config.ipProtocol == 'tcp' &&\n        l4config.ports.all(port, port\
      \ == '22')\n    )\n)"
    description: Ensure that SSH access is restricted from any source when using Firewall
      Policy Rule
    display_name: Restrict Firewall Policy rules allowing SSH access from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictSshPolicyRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/FirewallPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.firewallRestrictSshRule"]:
    action_type: DENY
    condition: "resource.direction.matches('INGRESS') &&\n!resource.name.startsWith('gke-')\
      \ &&\n!resource.name.startsWith('k8s-') &&\n!resource.name.endsWith('-hc') &&\n\
      !resource.name.startsWith('k8s2-') &&\n!resource.name.startsWith('gkegw1-l7-')\
      \ &&\n!resource.name.startsWith('gkemcg1-l7-') &&\nresource.allowed.containsFirewallPort('tcp',\
      \ '22') &&\n!resource.sourceRanges.all(range,\n  range == '35.235.240.0/20'\
      \ ||\n  range.startsWith('10.') ||\n  range.matches('^172\\\\.(?:1[6-9]|2\\\\\
      d|3[0-1]).*') ||\n  range.startsWith('192.168.')\n)"
    description: Ensure that SSH access is restricted from any source when using VPC
      Firewall Rule
    display_name: Restrict VPC Firewall rules allowing SSH access from any source
    method_types:
    - CREATE
    - UPDATE
    name: custom.firewallRestrictSshRule
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Firewall
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeAllowedNodePoolImages"]:
    action_type: DENY
    condition: resource.config.imageType in ["COS_CONTAINERD"] == false
    description: Enforce that GKE nodes are using authorized node images
    display_name: Allow only authorized node pool images
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeAllowedNodePoolImages
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeAllowedReleaseChannels"]:
    action_type: DENY
    condition: resource.releaseChannel.channel in ["REGULAR", "STABLE"] == false
    description: Enforce that GKE cluster are using authorized release channels
    display_name: Allow only authorized release channels
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeAllowedReleaseChannels
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeDisableAlphaCluster"]:
    action_type: DENY
    condition: resource.enableKubernetesAlpha == true
    description: Enforce that GKE clusters are not using alpha features for production
      workloads
    display_name: Disable alpha features for production workloads
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeDisableAlphaCluster
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeDisableKubernetesDashboard"]:
    action_type: DENY
    condition: resource.addonsConfig.kubernetesDashboard.disabled == false
    description: Enforce that GKE clusters does not have Web UI dashboard enabled
    display_name: Disable Web UI dashboard
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeDisableKubernetesDashboard
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeDisableLegacyAbac"]:
    action_type: DENY
    condition: resource.legacyAbac.enabled == true
    description: Enforce that GKE clusters is configured with no legacy ABAC enabled
    display_name: Disable legacy ABAC
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeDisableLegacyAbac
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeDisableLegacyMetadataEndpoints"]:
    action_type: DENY
    condition: '(''disable-legacy-endpoints'' in resource.config.metadata &&

      resource.config.metadata[''disable-legacy-endpoints''] == ''false'')'
    description: Enforce that GKE clusters are created with legacy metadata endpoints
      disabled
    display_name: Disable legacy metadata endpoints
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeDisableLegacyMetadataEndpoints
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireCOSImage"]:
    action_type: DENY
    condition: resource.config.imageType != "COS_CONTAINERD"
    description: Enforce the nodes pool are using Container-Optimized OS for running
      containers
    display_name: Require Container-Optimized OS on node pools
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireCOSImage
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireConfidentialNodes"]:
    action_type: DENY
    condition: resource.confidentialNodes.enabled == false
    description: Enforce that the GKE clusters is using confidential nodes
    display_name: Require confidential nodes
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireConfidentialNodes
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireDataplaneV2"]:
    action_type: DENY
    condition: resource.networkConfig.datapathProvider != 'ADVANCED_DATAPATH'
    description: Enforce that the GKE clusters is configured to use dataplane v2
    display_name: Require dataplane v2
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireDataplaneV2
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireGKEMetadataServer"]:
    action_type: DENY
    condition: resource.config.workloadMetadataConfig.mode != 'GKE_METADATA'
    description: Enforce that GKE clusters are configured with GKE metadata server
      enabled
    display_name: Require GKE metadata server
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireGKEMetadataServer
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireIntegrityMonitoring"]:
    action_type: DENY
    condition: resource.config.shieldedInstanceConfig.enableIntegrityMonitoring ==
      false
    description: Enforce that GKE nodes are configured with integrity monitoring enabled
    display_name: Enable integrity monitoring
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireIntegrityMonitoring
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireIntraNodeVisibility"]:
    action_type: DENY
    condition: resource.networkConfig.enableIntraNodeVisibility == false
    description: Enforce that GKE clusters intranode visibility is enabled
    display_name: Enable intranode visibility
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireIntraNodeVisibility
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireMasterAuthorizedNetworks"]:
    action_type: DENY
    condition: resource.masterAuthorizedNetworksConfig.enabled == false
    description: Enforce that GKE clusters restrict network access to the control
      planes by configuring master authorized networks with authorized CIDR IP ranges
    display_name: Require master authorized network with authorized CIDR IP ranges
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireMasterAuthorizedNetworks
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireMonitoring"]:
    action_type: DENY
    condition: resource.monitoringService != 'monitoring.googleapis.com/kubernetes'
    description: Enforce that GKE clusters monitoring is enabled
    display_name: Enable monitoring
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireMonitoring
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireNodePoolAutoRepair"]:
    action_type: DENY
    condition: resource.management.autoRepair == false
    description: Enforce that GKE clusters are configured with node auto-repair enabled
    display_name: Enable node auto-repair
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireNodePoolAutoRepair
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireNodePoolAutoUpgrade"]:
    action_type: DENY
    condition: resource.management.autoUpgrade == false
    description: Enforce that GKE clusters are configured with node auto-upgrade enabled
    display_name: Enable node auto-upgrade
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireNodePoolAutoUpgrade
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireNodePoolCMEKEncryption"]:
    action_type: DENY
    condition: has(resource.config.bootDiskKmsKey) == false
    description: Enforce that GKE nodes are configured with CMEK Encryption
    display_name: Require NodePool CMEK Encryption
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireNodePoolCMEKEncryption
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireNodePoolSandbox"]:
    action_type: DENY
    condition: "resource.name.matches(\"default-pool\") == false &&\n  has(resource.config.sandboxConfig)\
      \ == false &&\n  resource.config.sandboxConfig.type != 'GVISOR'"
    description: Enforce that the GKE clusters nodes are isolated using GKE sandbox
      (excepting the default node pool)
    display_name: Require GKE Sandbox runtime
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireNodePoolSandbox
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequirePrivateEndpoint"]:
    action_type: DENY
    condition: resource.privateClusterConfig.enablePrivateEndpoint == false
    description: Enforce that GKE clusters are created as private clusters with public
      endpoint disabled
    display_name: Disable public endpoints
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequirePrivateEndpoint
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireRegionalClusters"]:
    action_type: DENY
    condition: resource.location.matches("^[a-z]+(-[a-z, 1-9]+)$") == false
    description: Enforce the creation of regional GKE clusters
    display_name: Require regional GKE cluster
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireRegionalClusters
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireSecureBoot"]:
    action_type: DENY
    condition: resource.config.shieldedInstanceConfig.enableSecureBoot == false
    description: Enforce that GKE nodes are configured with secure boot enabled
    display_name: Enable secure boot
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireSecureBoot
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/NodePool
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.gkeRequireVPCNativeCluster"]:
    action_type: DENY
    condition: resource.ipAllocationPolicy.useIpAliases == false
    description: Enforce that GKE clusters are created with VPC-native
    display_name: Require VPC-native
    method_types:
    - CREATE
    - UPDATE
    name: custom.gkeRequireVPCNativeCluster
    parent: organizations/1234567890
    resource_types:
    - container.googleapis.com/Cluster
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.iamAllowedMembers"]:
    action_type: DENY
    condition: "resource.bindings.exists(binding,\n  binding.members.exists(member,\n\
      \    MemberSubjectStartsWith(member, ['user:', 'group:']) &&\n    !MemberSubjectEndsWith(member,\
      \ ['@example.org', 'group:fabric-fast-owners@google.com'])\n  )\n)"
    description: Ensure no binding are done with members outside the organization
      domain
    display_name: Deny principals and members outside the organization domain
    method_types:
    - CREATE
    - UPDATE
    name: custom.iamAllowedMembers
    parent: organizations/1234567890
    resource_types:
    - iam.googleapis.com/AllowPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.iamDisableAdminServiceAccount"]:
    action_type: DENY
    condition: "resource.bindings.exists(binding,\n  binding.members.exists(member,\n\
      \    !MemberSubjectEndsWith(member, ['@cloudservices.gserviceaccount.com'])\
      \ &&\n    MemberSubjectStartsWith(member, ['serviceAccount:']) &&\n    !MemberSubjectEndsWith(member,\
      \ ['@ft0-prod-iac-core-0.iam.gserviceaccount.com'])\n  ) &&\n  (\n    RoleNameMatches(binding.role,\
      \ ['roles/owner', 'roles/admin']) ||\n    RoleNameMatches(binding.role, ['roles/editor',\
      \ 'roles/writer']) ||\n    RoleNameContains(binding.role, ['admin', 'Admin'])\n\
      \  )\n)"
    description: Ensure no use of the legacy basic roles (owner and editor), basic
      roles (admin, writer) and usage of admin roles for service account
    display_name: Deny use of the legacy basic roles, basic roles and usage of admin
      role for service account
    method_types:
    - CREATE
    - UPDATE
    name: custom.iamDisableAdminServiceAccount
    parent: organizations/1234567890
    resource_types:
    - iam.googleapis.com/AllowPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.iamDisableBasicRoles"]:
    action_type: DENY
    condition: "resource.bindings.exists(binding,\n  binding.members.exists(member,\n\
      \    MemberSubjectStartsWith(member, ['user:', 'group:']) &&\n    !MemberSubjectStartsWith(member,\
      \ ['group:fabric-fast-owners@google.com']) &&\n    (\n      RoleNameMatches(binding.role,\
      \ ['roles/owner', 'roles/admin']) ||\n      RoleNameMatches(binding.role, ['roles/editor',\
      \ 'roles/writer']) ||\n      RoleNameContains(binding.role, ['roles/viewer',\
      \ 'roles/reader'])\n    )\n  )\n)"
    description: Ensure no use of the legacy basic roles (viewer, editor and owner)
      and basic roles (reader, writer and admin)
    display_name: Deny use of the basic roles
    method_types:
    - CREATE
    - UPDATE
    name: custom.iamDisableBasicRoles
    parent: organizations/1234567890
    resource_types:
    - iam.googleapis.com/AllowPolicy
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.iamDisableProjectServiceAccountImpersonationRoles"]
  : action_type: DENY
    condition: "resource.bindings.exists(binding,\n  binding.members.exists(member,\n\
      \    MemberSubjectStartsWith(member, ['user:', 'group:']) &&\n    !MemberSubjectStartsWith(member,\
      \ ['group:fabric-fast-owners@google.com'])\n  ) &&\n  (\n    RoleNameMatches(binding.role,\
      \ ['roles/iam.serviceAccountUser']) ||\n    RoleNameMatches(binding.role, ['roles/iam.serviceAccountTokenCreator'])\n\
      \  )\n)"
    description: Ensure that IAM Users are not assigned the service account user or
      service account token creator roles (requires usage of IAM Condition and tags
      to ensure the constraint is not applied on allowed service accounts)
    display_name: Deny assignment of the service account user or service account token
      creator roles to users
    method_types:
    - CREATE
    - UPDATE
    name: custom.iamDisableProjectServiceAccountImpersonationRoles
    parent: organizations/1234567890
    resource_types:
    - iam.googleapis.com/AllowPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.iamDisablePublicBindings"]:
    action_type: DENY
    condition: "resource.bindings.exists(binding,\n  binding.members.exists(member,\n\
      \    MemberSubjectMatches(member, ['allUsers', 'allAuthenticatedUsers'])\n \
      \ )\n)"
    description: Ensure no use of public bindings (allUsers, allAuthenticatedUsers)
    display_name: Deny use of public access bindings with allUsers or allAuthenticatedUsers
    method_types:
    - CREATE
    - UPDATE
    name: custom.iamDisablePublicBindings
    parent: organizations/1234567890
    resource_types:
    - iam.googleapis.com/AllowPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.iamDisableRedisAdminRoles"]:
    action_type: DENY
    condition: "resource.bindings.exists(binding,\n  binding.members.exists(member,\n\
      \    !MemberSubjectMatches(member, []) &&\n    (\n      RoleNameMatches(binding.role,\
      \ ['roles/redis.admin']) ||\n      RoleNameMatches(binding.role, ['roles/redis.editor'])\
      \ ||\n      RoleNameContains(binding.role, ['roles/redis.viewer'])\n    )\n\
      \  )\n)"
    description: Ensure no use of the basic roles (viewer, editor and owner)
    display_name: Deny use of the basic roles
    method_types:
    - CREATE
    - UPDATE
    name: custom.iamDisableRedisAdminRoles
    parent: organizations/1234567890
    resource_types:
    - iam.googleapis.com/AllowPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.networkDisableTargetHTTPProxy"]:
    action_type: DENY
    condition: true == true
    description: Ensure Target HTTP Proxy are not used
    display_name: Deny usage and creation of Target HTTP Proxy
    method_types:
    - CREATE
    - UPDATE
    name: custom.networkDisableTargetHTTPProxy
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/TargetHttpProxy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.networkDisableWeakSSLPolicy"]:
    action_type: DENY
    condition: "(resource.profile == \"COMPATIBLE\") || (resource.profile == \"CUSTOM\"\
      \ &&\n  resource.customFeatures.exists(feature, feature in [\n  \"TLS_RSA_WITH_AES_128_GCM_SHA256\"\
      ,\n  \"TLS_RSA_WITH_AES_256_GCM_SHA384\",\n  \"TLS_RSA_WITH_AES_128_CBC_SHA\"\
      ,\n  \"TLS_RSA_WITH_AES_256_CBC_SHA\",\n  \"TLS_RSA_WITH_3DES_EDE_CBC_SHA\"\
      ,\n  ])\n) || (resource.profile == \"CUSTOM\" &&\n  resource.minTlsVersion in\
      \ [\"TLS_1_2\", \"TLS_1_3\"] == false\n) || (resource.profile == \"MODERN\"\
      \ &&\n  resource.minTlsVersion in [\"TLS_1_2\", \"TLS_1_3\"] == false\n) ||\
      \ (resource.profile == \"RESTRICTED\" &&\n  resource.minTlsVersion in [\"TLS_1_2\"\
      , \"TLS_1_3\"] == false\n)"
    description: Ensure SSL Policies created does not have weak cipher suites
    display_name: Deny usage of SSL Policies with weak cipher suites
    method_types:
    - CREATE
    - UPDATE
    name: custom.networkDisableWeakSSLPolicy
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/SslPolicy
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.networkRequireBackendServiceLogging"]:
    action_type: DENY
    condition: has(resource.logConfig) == false || resource.logConfig.enable == false
    description: Enforce that Backend Services have logging enabled
    display_name: Require logging to be enabled on Backend Services
    method_types:
    - CREATE
    - UPDATE
    name: custom.networkRequireBackendServiceLogging
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/BackendService
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.networkRequireCustomModeVpc"]:
    action_type: DENY
    condition: resource.autoCreateSubnetworks == true
    description: Enforce that the subnets creation is using custom mode for a VPC
      network
    display_name: Require custom mode VPC network
    method_types:
    - CREATE
    name: custom.networkRequireCustomModeVpc
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Network
    timeouts: null
  ? module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.networkRequireSubnetPrivateGoogleAccess"]
  : action_type: DENY
    condition: '!resource.privateIpGoogleAccess && resource.purpose in [''REGIONAL_MANAGED_PROXY'',
      ''GLOBAL_MANAGED_PROXY''] == false'
    description: Enforce that the VPC network subnets are configured with private
      Google access
    display_name: Require Private Google Access
    method_types:
    - CREATE
    name: custom.networkRequireSubnetPrivateGoogleAccess
    parent: organizations/1234567890
    resource_types:
    - compute.googleapis.com/Subnetwork
    timeouts: null
  module.organization-iam[0].google_org_policy_custom_constraint.constraint["custom.storageRequireBucketObjectVersionning"]:
    action_type: DENY
    condition: resource.versioning.enabled == false
    description: Enforce Cloud Storage bucket object versioning to be configured
    display_name: Require object versioning
    method_types:
    - CREATE
    - UPDATE
    name: custom.storageRequireBucketObjectVersionning
    parent: organizations/1234567890
    resource_types:
    - storage.googleapis.com/Bucket
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["ainotebooks.disableFileDownloads"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/ainotebooks.disableFileDownloads
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["ainotebooks.disableRootAccess"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/ainotebooks.disableRootAccess
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["ainotebooks.restrictPublicIp"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/ainotebooks.restrictPublicIp
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["ainotebooks.restrictVpcNetworks"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/ainotebooks.restrictVpcNetworks
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - under:organizations/1234567890
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["appengine.disableCodeDownload"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/appengine.disableCodeDownload
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["bigquery.disableBQOmniAWS"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/bigquery.disableBQOmniAWS
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["bigquery.disableBQOmniAzure"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/bigquery.disableBQOmniAzure
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["cloudbuild.allowedIntegrations"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/cloudbuild.allowedIntegrations
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: 'TRUE'
        enforce: null
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["cloudbuild.allowedWorkerPools"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/cloudbuild.allowedWorkerPools
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - under:organizations/1234567890
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["cloudbuild.disableCreateDefaultServiceAccount"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/cloudbuild.disableCreateDefaultServiceAccount
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["cloudfunctions.allowedIngressSettings"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/cloudfunctions.allowedIngressSettings
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - ALLOW_INTERNAL_AND_GCLB
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["cloudfunctions.allowedVpcConnectorEgressSettings"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/cloudfunctions.allowedVpcConnectorEgressSettings
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - ALL_TRAFFIC
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["cloudfunctions.requireVPCConnector"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/cloudfunctions.requireVPCConnector
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.disableGuestAttributesAccess"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.disableGuestAttributesAccess
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.disableInternetNetworkEndpointGroup"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.disableInternetNetworkEndpointGroup
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.disableNestedVirtualization"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.disableNestedVirtualization
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.disableSerialPortAccess"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.disableSerialPortAccess
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.disableVpcExternalIpv6"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.disableVpcExternalIpv6
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.disableVpcInternalIpv6"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.disableVpcInternalIpv6
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.managed.blockPreviewFeatures"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.managed.blockPreviewFeatures
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.managed.disableSerialPortLogging"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.managed.disableSerialPortLogging
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.managed.vmCanIpForward"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.managed.vmCanIpForward
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.requireOsLogin"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.requireOsLogin
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.requireShieldedVm"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.requireShieldedVm
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.requireSslPolicy"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.requireSslPolicy
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - under:organizations/1234567890
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.requireVpcFlowLogs"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.requireVpcFlowLogs
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - ESSENTIAL
          - LIGHT
          - COMPREHENSIVE
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.restrictCloudNATUsage"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.restrictCloudNATUsage
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.restrictDedicatedInterconnectUsage"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.restrictDedicatedInterconnectUsage
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.restrictLoadBalancerCreationForTypes"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.restrictLoadBalancerCreationForTypes
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - in:INTERNAL
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.restrictPartnerInterconnectUsage"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.restrictPartnerInterconnectUsage
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.restrictProtocolForwardingCreationForTypes"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.restrictProtocolForwardingCreationForTypes
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - is:INTERNAL
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.restrictSharedVpcHostProjects"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.restrictSharedVpcHostProjects
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.restrictVpcPeering"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.restrictVpcPeering
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - under:organizations/1234567890
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.setNewProjectDefaultToZonalDNSOnly"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.setNewProjectDefaultToZonalDNSOnly
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.skipDefaultNetworkCreation"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.skipDefaultNetworkCreation
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.trustedImageProjects"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.trustedImageProjects
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - is:projects/centos-cloud
          - is:projects/cos-cloud
          - is:projects/debian-cloud
          - is:projects/fedora-cloud
          - is:projects/fedora-coreos-cloud
          - is:projects/opensuse-cloud
          - is:projects/rhel-cloud
          - is:projects/rhel-sap-cloud
          - is:projects/rocky-linux-cloud
          - is:projects/suse-cloud
          - is:projects/suse-sap-cloud
          - is:projects/ubuntu-os-cloud
          - is:projects/ubuntu-os-pro-cloud
          - is:projects/windows-cloud
          - is:projects/windows-sql-cloud
          - is:projects/confidential-vm-images
          - is:projects/confidential-space-images
          - is:projects/backupdr-images
          - is:projects/deeplearning-platform-release
          - is:projects/serverless-vpc-access-images
          - is:projects/gke-node-images
          - is:projects/gke-windows-node-images
          - is:projects/ubuntu-os-gke-cloud
          - is:projects/rocky-linux-accelerator-cloud
          - is:projects/ubuntu-os-accelerator-images
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["compute.vmExternalIpAccess"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/compute.vmExternalIpAccess
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: 'TRUE'
        enforce: null
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.disableABAC"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.disableABAC
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.disableInsecureKubeletReadOnlyPort"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.disableInsecureKubeletReadOnlyPort
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.disableLegacyClientCertificateIssuance"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.disableLegacyClientCertificateIssuance
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.disableRBACSystemBindings"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.disableRBACSystemBindings
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.disallowDefaultComputeServiceAccount"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.disallowDefaultComputeServiceAccount
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.enableBinaryAuthorization"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.enableBinaryAuthorization
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.enableCloudLogging"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.enableCloudLogging
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.enableGoogleGroupsRBAC"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.enableGoogleGroupsRBAC
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.enableNetworkPolicy"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.enableNetworkPolicy
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.enablePrivateNodes"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.enablePrivateNodes
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.enableSecretsEncryption"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.enableSecretsEncryption
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.enableSecurityBulletinNotifications"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.enableSecurityBulletinNotifications
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.enableShieldedNodes"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.enableShieldedNodes
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["container.managed.enableWorkloadIdentityFederation"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/container.managed.enableWorkloadIdentityFederation
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.accesscontextmanagerDisableBridgePerimeters"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.accesscontextmanagerDisableBridgePerimeters
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudbuildDisableWorkerPoolExternalIP"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudbuildDisableWorkerPoolExternalIP
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudkmsAllowedAlgorithms"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudkmsAllowedAlgorithms
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudkmsAllowedProtectionLevel"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudkmsAllowedProtectionLevel
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudkmsAllowedRotationPeriod"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudkmsAllowedRotationPeriod
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudrunDisableEnvironmentVariablePattern"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudrunDisableEnvironmentVariablePattern
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudrunJobDisableDefaultServiceAccount"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudrunJobDisableDefaultServiceAccount
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudrunJobRequireBinaryAuthorization"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudrunJobRequireBinaryAuthorization
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudrunServiceDisableDefaultServiceAccount"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudrunServiceDisableDefaultServiceAccount
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudrunServiceRequireBinaryAuthorization"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudrunServiceRequireBinaryAuthorization
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlDisablePublicAuthorizedNetworks"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlDisablePublicAuthorizedNetworks
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlEnforcePasswordComplexity"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlEnforcePasswordComplexity
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlRequireAutomatedBackup"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlRequireAutomatedBackup
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlRequireHighAvailability"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlRequireHighAvailability
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlRequireMySQLDatabaseFlags"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlRequireMySQLDatabaseFlags
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlRequirePointInTimeRecovery"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlRequirePointInTimeRecovery
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlRequirePostgreSQLDatabaseAdditionalFlags"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlRequirePostgreSQLDatabaseAdditionalFlags
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'FALSE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlRequirePostgreSQLDatabaseFlags"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlRequirePostgreSQLDatabaseFlags
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlRequireRootPassword"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlRequireRootPassword
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlRequireSQLServerDatabaseFlags"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlRequireSQLServerDatabaseFlags
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.cloudsqlRequireSSLConnection"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.cloudsqlRequireSSLConnection
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.dataprocDisableDefaultServiceAccount"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.dataprocDisableDefaultServiceAccount
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.dataprocRequireDiskCmekEncryption"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.dataprocRequireDiskCmekEncryption
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.dataprocRequireInternalIp"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.dataprocRequireInternalIp
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.dataprocRequireKerberos"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.dataprocRequireKerberos
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.dnsAllowedSigningAlgorithms"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.dnsAllowedSigningAlgorithms
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.dnsRequireManageZoneDNSSEC"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.dnsRequireManageZoneDNSSEC
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.dnsRequirePolicyLogging"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.dnsRequirePolicyLogging
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallEnforcePolicyRuleLogging"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallEnforcePolicyRuleLogging
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallEnforceRuleLogging"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallEnforceRuleLogging
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRequireDescription"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRequireDescription
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictCacheSearchDatabasesPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictCacheSearchDatabasesPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictCacheSearchDatabasesRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictCacheSearchDatabasesRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictDirectoryServicesPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictDirectoryServicesPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictDirectoryServicesRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictDirectoryServicesRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictExplicitAllPortsPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictExplicitAllPortsPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictExplicitAllPortsRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictExplicitAllPortsRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictInsecureProtocolsPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictInsecureProtocolsPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictInsecureProtocolsRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictInsecureProtocolsRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictMailProtocolsPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictMailProtocolsPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictMailProtocolsRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictMailProtocolsRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictManagementPortsPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictManagementPortsPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictManagementPortsRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictManagementPortsRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictNetworkServicesPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictNetworkServicesPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictNetworkServicesRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictNetworkServicesRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictNoSQLDatabasesPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictNoSQLDatabasesPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictNoSQLDatabasesRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictNoSQLDatabasesRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictPublicAccessPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictPublicAccessPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictPublicAccessRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictPublicAccessRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictRdpPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictRdpPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictRdpRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictRdpRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictSQLDatabasesPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictSQLDatabasesPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictSQLDatabasesRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictSQLDatabasesRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictSshPolicyRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictSshPolicyRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.firewallRestrictSshRule"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.firewallRestrictSshRule
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeAllowedNodePoolImages"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeAllowedNodePoolImages
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeAllowedReleaseChannels"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeAllowedReleaseChannels
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeDisableAlphaCluster"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeDisableAlphaCluster
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeDisableKubernetesDashboard"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeDisableKubernetesDashboard
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeDisableLegacyAbac"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeDisableLegacyAbac
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeDisableLegacyMetadataEndpoints"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeDisableLegacyMetadataEndpoints
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireCOSImage"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireCOSImage
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireDataplaneV2"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireDataplaneV2
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireGKEMetadataServer"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireGKEMetadataServer
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireIntegrityMonitoring"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireIntegrityMonitoring
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireIntraNodeVisibility"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireIntraNodeVisibility
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireMasterAuthorizedNetworks"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireMasterAuthorizedNetworks
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireMonitoring"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireMonitoring
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireNodePoolAutoRepair"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireNodePoolAutoRepair
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireNodePoolAutoUpgrade"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireNodePoolAutoUpgrade
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireNodePoolCMEKEncryption"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireNodePoolCMEKEncryption
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireNodePoolSandbox"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireNodePoolSandbox
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequirePrivateEndpoint"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequirePrivateEndpoint
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireRegionalClusters"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireRegionalClusters
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireSecureBoot"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireSecureBoot
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.gkeRequireVPCNativeCluster"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.gkeRequireVPCNativeCluster
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.iamDisableAdminServiceAccount"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.iamDisableAdminServiceAccount
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.iamDisableBasicRoles"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.iamDisableBasicRoles
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.iamDisableProjectServiceAccountImpersonationRoles"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.iamDisableProjectServiceAccountImpersonationRoles
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition:
        - description: null
          expression: 'resource.matchTag(''1234567890/org-policies'', ''allowed-sa-impersonation'')

            '
          location: null
          title: Allow service account impersonation for tagged users
        deny_all: null
        enforce: 'FALSE'
        parameters: null
        values: []
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.iamDisablePublicBindings"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.iamDisablePublicBindings
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.iamDisableRedisAdminRoles"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.iamDisableRedisAdminRoles
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'FALSE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.networkDisableTargetHTTPProxy"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.networkDisableTargetHTTPProxy
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.networkDisableWeakSSLPolicy"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.networkDisableWeakSSLPolicy
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.networkRequireBackendServiceLogging"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.networkRequireBackendServiceLogging
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.networkRequireCustomModeVpc"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.networkRequireCustomModeVpc
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["custom.networkRequireSubnetPrivateGoogleAccess"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/custom.networkRequireSubnetPrivateGoogleAccess
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["essentialcontacts.allowedContactDomains"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/essentialcontacts.allowedContactDomains
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition:
        - description: null
          expression: '!resource.matchTag(''1234567890/org-policies'', ''allowed-essential-contacts-domains-all'')

            '
          location: null
          title: Restrict essential contacts domains
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - '@example.org'
          denied_values: null
      - allow_all: 'TRUE'
        condition:
        - description: null
          expression: 'resource.matchTag(''1234567890/org-policies'', ''allowed-essential-contacts-domains-all'')

            '
          location: null
          title: Allow essential contacts from any domain
        deny_all: null
        enforce: null
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["gcp.restrictCmekCryptoKeyProjects"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/gcp.restrictCmekCryptoKeyProjects
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition:
        - description: null
          expression: 'resource.matchTag(''1234567890/environment'', ''development'')

            '
          location: null
          title: Restrict CMEK Projects for development projects
        deny_all: null
        enforce: null
        parameters: null
      - allow_all: null
        condition:
        - description: null
          expression: '!resource.matchTag(''1234567890/environment'', ''development'')

            '
          location: null
          title: Restrict CMEK Projects for non-development projects
        deny_all: null
        enforce: null
        parameters: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["gcp.restrictNonCmekServices"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/gcp.restrictNonCmekServices
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values: null
          denied_values:
          - aiplatform.googleapis.com
          - alloydb.googleapis.com
          - apigee.googleapis.com
          - artifactregistry.googleapis.com
          - bigquery.googleapis.com
          - bigquerydatatransfer.googleapis.com
          - bigtable.googleapis.com
          - cloudfunctions.googleapis.com
          - cloudtasks.googleapis.com
          - composer.googleapis.com
          - compute.googleapis.com
          - contactcenterinsights.googleapis.com
          - container.googleapis.com
          - dataflow.googleapis.com
          - dataform.googleapis.com
          - datafusion.googleapis.com
          - dataproc.googleapis.com
          - dialogflow.googleapis.com
          - discoveryengine.googleapis.com
          - documentai.googleapis.com
          - file.googleapis.com
          - firestore.googleapis.com
          - gkebackup.googleapis.com
          - integrations.googleapis.com
          - logging.googleapis.com
          - looker.googleapis.com
          - notebooks.googleapis.com
          - pubsub.googleapis.com
          - redis.googleapis.com
          - run.googleapis.com
          - secretmanager.googleapis.com
          - securesourcemanager.googleapis.com
          - spanner.googleapis.com
          - speech.googleapis.com
          - sqladmin.googleapis.com
          - storage.googleapis.com
          - storagetransfer.googleapis.com
          - workstations.googleapis.com
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["gcp.restrictServiceUsage"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/gcp.restrictServiceUsage
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - accesscontextmanager.googleapis.com
          - analyticshub.googleapis.com
          - anthos.googleapis.com
          - anthosconfigmanagement.googleapis.com
          - appoptimize.googleapis.com
          - artifactregistry.googleapis.com
          - autoscaling.googleapis.com
          - bigquery.googleapis.com
          - bigqueryconnection.googleapis.com
          - bigquerydatapolicy.googleapis.com
          - bigquerydatatransfer.googleapis.com
          - bigquerymigration.googleapis.com
          - bigqueryreservation.googleapis.com
          - bigquerystorage.googleapis.com
          - billingbudgets.googleapis.com
          - certificatemanager.googleapis.com
          - cloudaicompanion.googleapis.com
          - cloudapis.googleapis.com
          - cloudasset.googleapis.com
          - cloudbilling.googleapis.com
          - cloudbuild.googleapis.com
          - cloudkms.googleapis.com
          - cloudquotas.googleapis.com
          - cloudresourcemanager.googleapis.com
          - cloudsecuritycompliance.googleapis.com
          - cloudtrace.googleapis.com
          - composer.googleapis.com
          - compute.googleapis.com
          - container.googleapis.com
          - containerfilesystem.googleapis.com
          - containerregistry.googleapis.com
          - containersecurity.googleapis.com
          - containerthreatdetection.googleapis.com
          - datacatalog.googleapis.com
          - dataform.googleapis.com
          - datalineage.googleapis.com
          - dataplex.googleapis.com
          - datastore.googleapis.com
          - deploymentmanager.googleapis.com
          - dns.googleapis.com
          - essentialcontacts.googleapis.com
          - geminicloudassist.googleapis.com
          - gkebackup.googleapis.com
          - gkeconnect.googleapis.com
          - gkehub.googleapis.com
          - iam.googleapis.com
          - iamcredentials.googleapis.com
          - iap.googleapis.com
          - logging.googleapis.com
          - monitoring.googleapis.com
          - multiclusteringress.googleapis.com
          - multiclustermetering.googleapis.com
          - multiclusterservicediscovery.googleapis.com
          - networkconnectivity.googleapis.com
          - networkmanagement.googleapis.com
          - networksecurity.googleapis.com
          - notebooksecurityscanner.googleapis.com
          - orgpolicy.googleapis.com
          - oslogin.googleapis.com
          - privateca.googleapis.com
          - pubsub.googleapis.com
          - recommender.googleapis.com
          - secretmanager.googleapis.com
          - securitycenter.googleapis.com
          - securitycentermanagement.googleapis.com
          - servicedirectory.googleapis.com
          - servicemanagement.googleapis.com
          - servicenetworking.googleapis.com
          - serviceusage.googleapis.com
          - sql-component.googleapis.com
          - sqladmin.googleapis.com
          - stackdriver.googleapis.com
          - storage-api.googleapis.com
          - storage-component.googleapis.com
          - storage.googleapis.com
          - sts.googleapis.com
          - trafficdirector.googleapis.com
          - vpcaccess.googleapis.com
          - websecurityscanner.googleapis.com
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["gcp.restrictTLSCipherSuites"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/gcp.restrictTLSCipherSuites
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - in:NIST-800-52-recommended-ciphers
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["gcp.restrictTLSVersion"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/gcp.restrictTLSVersion
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values: null
          denied_values:
          - TLS_VERSION_1
          - TLS_VERSION_1_1
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["iam.allowedPolicyMemberDomains"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/iam.allowedPolicyMemberDomains
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition:
        - description: null
          expression: '!resource.matchTag(''1234567890/org-policies'', ''allowed-policy-member-domains-all'')

            '
          location: null
          title: Restrict member domains
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - is:abcd123456
          denied_values: null
      - allow_all: 'TRUE'
        condition:
        - description: null
          expression: 'resource.matchTag(''1234567890/org-policies'', ''allowed-policy-member-domains-all'')

            '
          location: null
          title: Allow any member domain
        deny_all: null
        enforce: null
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["iam.automaticIamGrantsForDefaultServiceAccounts"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/iam.automaticIamGrantsForDefaultServiceAccounts
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["iam.disableAuditLoggingExemption"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/iam.disableAuditLoggingExemption
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["iam.disableServiceAccountKeyCreation"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/iam.disableServiceAccountKeyCreation
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["iam.disableServiceAccountKeyUpload"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/iam.disableServiceAccountKeyUpload
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["iam.managed.disableServiceAccountApiKeyCreation"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/iam.managed.disableServiceAccountApiKeyCreation
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  ? module.organization-iam[0].google_org_policy_policy.default["iam.managed.preventPrivilegedBasicRolesForDefaultServiceAccounts"]
  : dry_run_spec: []
    name: organizations/1234567890/policies/iam.managed.preventPrivilegedBasicRolesForDefaultServiceAccounts
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["iam.serviceAccountKeyExposureResponse"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/iam.serviceAccountKeyExposureResponse
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - is:DISABLE_KEY
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["iam.workloadIdentityPoolAwsAccounts"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/iam.workloadIdentityPoolAwsAccounts
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: 'TRUE'
        enforce: null
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["iam.workloadIdentityPoolProviders"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/iam.workloadIdentityPoolProviders
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: 'TRUE'
        enforce: null
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["run.allowedBinaryAuthorizationPolicies"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/run.allowedBinaryAuthorizationPolicies
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - default
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["run.allowedIngress"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/run.allowedIngress
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - is:internal-and-cloud-load-balancing
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["run.allowedVPCEgress"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/run.allowedVPCEgress
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values:
          - all-traffic
          denied_values: null
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["run.managed.requireInvokerIam"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/run.managed.requireInvokerIam
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["sql.restrictAuthorizedNetworks"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/sql.restrictAuthorizedNetworks
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["sql.restrictPublicIp"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/sql.restrictPublicIp
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["storage.publicAccessPrevention"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/storage.publicAccessPrevention
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["storage.restrictAuthTypes"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/storage.restrictAuthTypes
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: null
        parameters: null
        values:
        - allowed_values: null
          denied_values:
          - in:ALL_HMAC_SIGNED_REQUESTS
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["storage.secureHttpTransport"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/storage.secureHttpTransport
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_org_policy_policy.default["storage.uniformBucketLevelAccess"]:
    dry_run_spec: []
    name: organizations/1234567890/policies/storage.uniformBucketLevelAccess
    parent: organizations/1234567890
    spec:
    - inherit_from_parent: null
      reset: null
      rules:
      - allow_all: null
        condition: []
        deny_all: null
        enforce: 'TRUE'
        parameters: null
        values: []
    timeouts: null
  module.organization-iam[0].google_organization_iam_audit_config.default["allServices"]:
    audit_log_config:
    - exempted_members: []
      log_type: ADMIN_READ
    org_id: '1234567890'
    service: allServices
  module.organization-iam[0].google_organization_iam_binding.authoritative["$custom_roles:organization_admin_viewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: organizations/1234567890/roles/organizationAdminViewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["$custom_roles:tag_viewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: organizations/1234567890/roles/tagViewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/accesscontextmanager.policyAdmin"]:
    condition: []
    members:
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/accesscontextmanager.policyAdmin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/accesscontextmanager.policyReader"]:
    condition: []
    members:
    - serviceAccount:iac-vpcsc-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/accesscontextmanager.policyReader
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/billing.creator"]:
    condition: []
    members: null
    org_id: '1234567890'
    role: roles/billing.creator
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/cloudasset.owner"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    org_id: '1234567890'
    role: roles/cloudasset.owner
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/cloudasset.viewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-security-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-vpcsc-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-vpcsc-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/cloudasset.viewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/cloudsupport.admin"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    org_id: '1234567890'
    role: roles/cloudsupport.admin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/cloudsupport.techSupportEditor"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    org_id: '1234567890'
    role: roles/cloudsupport.techSupportEditor
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/compute.orgFirewallPolicyAdmin"]:
    condition: []
    members:
    - serviceAccount:iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/compute.orgFirewallPolicyAdmin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/compute.orgFirewallPolicyUser"]:
    condition: []
    members:
    - serviceAccount:iac-networking-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/compute.orgFirewallPolicyUser
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/compute.osAdminLogin"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    org_id: '1234567890'
    role: roles/compute.osAdminLogin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/compute.osLoginExternalUser"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    org_id: '1234567890'
    role: roles/compute.osLoginExternalUser
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/compute.viewer"]:
    condition: []
    members:
    - serviceAccount:iac-networking-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/compute.viewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/compute.xpnAdmin"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    - serviceAccount:iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/compute.xpnAdmin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/essentialcontacts.admin"]:
    condition: []
    members:
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/essentialcontacts.admin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/essentialcontacts.viewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/essentialcontacts.viewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/iam.organizationRoleAdmin"]:
    condition: []
    members:
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/iam.organizationRoleAdmin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/iam.organizationRoleViewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/iam.organizationRoleViewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/iam.workforcePoolAdmin"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/iam.workforcePoolAdmin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/iam.workforcePoolViewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/iam.workforcePoolViewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/logging.admin"]:
    condition: []
    members:
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/logging.admin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/logging.viewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/logging.viewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/orgpolicy.policyAdmin"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/orgpolicy.policyAdmin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/orgpolicy.policyViewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/orgpolicy.policyViewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/owner"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    org_id: '1234567890'
    role: roles/owner
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/resourcemanager.folderAdmin"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/resourcemanager.folderAdmin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/resourcemanager.folderViewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/resourcemanager.folderViewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/resourcemanager.organizationAdmin"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/resourcemanager.organizationAdmin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/resourcemanager.projectCreator"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/resourcemanager.projectCreator
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/resourcemanager.projectDeleter"]:
    condition: []
    members:
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/resourcemanager.projectDeleter
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/resourcemanager.projectMover"]:
    condition: []
    members:
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/resourcemanager.projectMover
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/resourcemanager.tagAdmin"]:
    condition: []
    members:
    - group:fabric-fast-owners@google.com
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/resourcemanager.tagAdmin
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/resourcemanager.tagUser"]:
    condition: []
    members:
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/resourcemanager.tagUser
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/resourcemanager.tagViewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/resourcemanager.tagViewer
  ? module.organization-iam[0].google_organization_iam_binding.authoritative["roles/securitycentermanagement.customModulesEditor"]
  : condition: []
    members:
    - serviceAccount:iac-org-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/securitycentermanagement.customModulesEditor
  ? module.organization-iam[0].google_organization_iam_binding.authoritative["roles/securitycentermanagement.customModulesViewer"]
  : condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/securitycentermanagement.customModulesViewer
  module.organization-iam[0].google_organization_iam_binding.authoritative["roles/serviceusage.serviceUsageViewer"]:
    condition: []
    members:
    - serviceAccount:iac-org-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/serviceusage.serviceUsageViewer
  module.organization-iam[0].google_organization_iam_binding.bindings["pf_org_policy_admin"]:
    condition:
    - description: null
      expression: resource.matchTag('1234567890/context', 'project-factory')
      title: Project factory org policy admin
    members:
    - serviceAccount:iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/orgpolicy.policyAdmin
  module.organization-iam[0].google_organization_iam_binding.bindings["pf_org_policy_viewer"]:
    condition:
    - description: null
      expression: resource.matchTag('1234567890/context', 'project-factory')
      title: Project factory org policy viewer
    members:
    - serviceAccount:iac-pf-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    org_id: '1234567890'
    role: roles/orgpolicy.policyViewer
  module.organization-iam[0].google_project_iam_member.bucket_sinks_binding["audit-logs"]:
    condition:
    - title: audit-logs bucket writer
    role: roles/logging.bucketWriter
  module.organization-iam[0].google_project_iam_member.bucket_sinks_binding["iam"]:
    condition:
    - title: iam bucket writer
    role: roles/logging.bucketWriter
  module.organization-iam[0].google_project_iam_member.bucket_sinks_binding["vpc-sc"]:
    condition:
    - title: vpc-sc bucket writer
    role: roles/logging.bucketWriter
  ? module.organization-iam[0].google_tags_tag_value_iam_binding.default["environment/development:roles/resourcemanager.tagUser"]
  : condition: []
    members:
    - serviceAccount:iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    role: roles/resourcemanager.tagUser
  ? module.organization-iam[0].google_tags_tag_value_iam_binding.default["environment/development:roles/resourcemanager.tagViewer"]
  : condition: []
    members:
    - serviceAccount:iac-networking-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-pf-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-security-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    role: roles/resourcemanager.tagViewer
  ? module.organization-iam[0].google_tags_tag_value_iam_binding.default["environment/production:roles/resourcemanager.tagUser"]
  : condition: []
    members:
    - serviceAccount:iac-networking-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-pf-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-security-rw@ft0-prod-iac-core-0.iam.gserviceaccount.com
    role: roles/resourcemanager.tagUser
  ? module.organization-iam[0].google_tags_tag_value_iam_binding.default["environment/production:roles/resourcemanager.tagViewer"]
  : condition: []
    members:
    - serviceAccount:iac-networking-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-pf-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    - serviceAccount:iac-security-ro@ft0-prod-iac-core-0.iam.gserviceaccount.com
    role: roles/resourcemanager.tagViewer
  module.organization[0].google_essential_contacts_contact.contact["$email_addresses:gcp-organization-admins"]:
    email: $email_addresses:gcp-organization-admins
    language_tag: en
    notification_category_subscriptions:
    - ALL
    parent: organizations/1234567890
    timeouts: null
  module.organization[0].google_logging_organization_settings.default[0]:
    organization: '1234567890'
    storage_location: europe-west1
    timeouts: null
  module.organization[0].google_organization_iam_custom_role.roles["cloudkms_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - cloudkms.autokeyConfigs.get
    - cloudkms.cryptoKeyVersions.get
    - cloudkms.cryptoKeyVersions.list
    - cloudkms.cryptoKeys.get
    - cloudkms.cryptoKeys.getIamPolicy
    - cloudkms.cryptoKeys.list
    - cloudkms.ekmConfigs.get
    - cloudkms.ekmConfigs.getIamPolicy
    - cloudkms.ekmConnections.get
    - cloudkms.ekmConnections.getIamPolicy
    - cloudkms.ekmConnections.list
    - cloudkms.importJobs.get
    - cloudkms.importJobs.getIamPolicy
    - cloudkms.importJobs.list
    - cloudkms.kajPolicyConfigs.get
    - cloudkms.keyHandles.get
    - cloudkms.keyHandles.list
    - cloudkms.keyRings.get
    - cloudkms.keyRings.getIamPolicy
    - cloudkms.keyRings.list
    - cloudkms.locations.get
    - cloudkms.locations.list
    - cloudkms.operations.get
    - cloudkms.singleTenantHsmInstanceProposals.get
    - cloudkms.singleTenantHsmInstanceProposals.list
    - cloudkms.singleTenantHsmInstances.get
    - cloudkms.singleTenantHsmInstances.list
    role_id: cloudKmsViewer
    stage: GA
    title: Custom role cloudKmsViewer
  module.organization[0].google_organization_iam_custom_role.roles["folder_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - resourcemanager.folders.get
    - resourcemanager.folders.getIamPolicy
    - resourcemanager.folders.list
    - resourcemanager.folders.searchPolicyBindings
    role_id: folderViewer
    stage: GA
    title: Custom role folderViewer
  module.organization[0].google_organization_iam_custom_role.roles["logging_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - logging.buckets.get
    - logging.buckets.list
    - logging.buckets.listEffectiveTags
    - logging.buckets.listTagBindings
    - logging.exclusions.get
    - logging.exclusions.list
    - logging.fields.access
    - logging.links.get
    - logging.links.list
    - logging.locations.get
    - logging.locations.list
    - logging.logEntries.list
    - logging.logMetrics.get
    - logging.logMetrics.list
    - logging.logScopes.get
    - logging.logScopes.list
    - logging.logServiceIndexes.list
    - logging.logServices.list
    - logging.logs.list
    - logging.notificationRules.get
    - logging.notificationRules.list
    - logging.operations.get
    - logging.operations.list
    - logging.privateLogEntries.list
    - logging.queries.getShared
    - logging.queries.listShared
    - logging.settings.get
    - logging.sinks.get
    - logging.sinks.list
    - logging.usage.get
    - logging.views.get
    - logging.views.getIamPolicy
    - logging.views.list
    - logging.views.listLogs
    - logging.views.listResourceKeys
    - logging.views.listResourceValues
    - observability.scopes.get
    - resourcemanager.projects.get
    - resourcemanager.projects.list
    - resourcemanager.tagHolds.list
    - resourcemanager.tagKeys.get
    - resourcemanager.tagKeys.getIamPolicy
    - resourcemanager.tagKeys.list
    - resourcemanager.tagValues.get
    - resourcemanager.tagValues.getIamPolicy
    - resourcemanager.tagValues.list
    role_id: loggingViewer
    stage: GA
    title: Custom role loggingViewer
  module.organization[0].google_organization_iam_custom_role.roles["network_firewall_policies_admin"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - compute.networks.setFirewallPolicy
    - networksecurity.firewallEndpointAssociations.create
    - networksecurity.firewallEndpointAssociations.delete
    - networksecurity.firewallEndpointAssociations.get
    - networksecurity.firewallEndpointAssociations.list
    - networksecurity.firewallEndpointAssociations.update
    role_id: networkFirewallPoliciesAdmin
    stage: GA
    title: Custom role networkFirewallPoliciesAdmin
  module.organization[0].google_organization_iam_custom_role.roles["ngfw_enterprise_admin"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - networksecurity.firewallEndpoints.create
    - networksecurity.firewallEndpoints.delete
    - networksecurity.firewallEndpoints.get
    - networksecurity.firewallEndpoints.list
    - networksecurity.firewallEndpoints.update
    - networksecurity.firewallEndpoints.use
    - networksecurity.locations.get
    - networksecurity.locations.list
    - networksecurity.operations.cancel
    - networksecurity.operations.delete
    - networksecurity.operations.get
    - networksecurity.operations.list
    - networksecurity.securityProfileGroups.create
    - networksecurity.securityProfileGroups.delete
    - networksecurity.securityProfileGroups.get
    - networksecurity.securityProfileGroups.list
    - networksecurity.securityProfileGroups.update
    - networksecurity.securityProfileGroups.use
    - networksecurity.securityProfiles.create
    - networksecurity.securityProfiles.delete
    - networksecurity.securityProfiles.get
    - networksecurity.securityProfiles.list
    - networksecurity.securityProfiles.update
    - networksecurity.securityProfiles.use
    - networksecurity.tlsInspectionPolicies.create
    - networksecurity.tlsInspectionPolicies.delete
    - networksecurity.tlsInspectionPolicies.get
    - networksecurity.tlsInspectionPolicies.list
    - networksecurity.tlsInspectionPolicies.update
    - networksecurity.tlsInspectionPolicies.use
    role_id: ngfwEnterpriseAdmin
    stage: GA
    title: Custom role ngfwEnterpriseAdmin
  module.organization[0].google_organization_iam_custom_role.roles["ngfw_enterprise_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - networksecurity.firewallEndpoints.get
    - networksecurity.firewallEndpoints.list
    - networksecurity.firewallEndpoints.use
    - networksecurity.locations.get
    - networksecurity.locations.list
    - networksecurity.operations.get
    - networksecurity.operations.list
    - networksecurity.securityProfileGroups.get
    - networksecurity.securityProfileGroups.list
    - networksecurity.securityProfileGroups.use
    - networksecurity.securityProfiles.get
    - networksecurity.securityProfiles.list
    - networksecurity.securityProfiles.use
    - networksecurity.tlsInspectionPolicies.get
    - networksecurity.tlsInspectionPolicies.list
    - networksecurity.tlsInspectionPolicies.use
    role_id: ngfwEnterpriseViewer
    stage: GA
    title: Custom role ngfwEnterpriseViewer
  module.organization[0].google_organization_iam_custom_role.roles["organization_admin_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - essentialcontacts.contacts.get
    - essentialcontacts.contacts.list
    - logging.settings.get
    - orgpolicy.constraints.list
    - orgpolicy.policies.list
    - orgpolicy.policy.get
    - resourcemanager.folders.get
    - resourcemanager.folders.getIamPolicy
    - resourcemanager.folders.list
    - resourcemanager.organizations.get
    - resourcemanager.organizations.getIamPolicy
    - resourcemanager.projects.get
    - resourcemanager.projects.getIamPolicy
    - resourcemanager.projects.list
    - storage.buckets.getIamPolicy
    role_id: organizationAdminViewer
    stage: GA
    title: Custom role organizationAdminViewer
  module.organization[0].google_organization_iam_custom_role.roles["organization_iam_admin"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - resourcemanager.organizations.get
    - resourcemanager.organizations.getIamPolicy
    - resourcemanager.organizations.setIamPolicy
    role_id: organizationIamAdmin
    stage: GA
    title: Custom role organizationIamAdmin
  module.organization[0].google_organization_iam_custom_role.roles["project_iam_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - iam.policybindings.get
    - iam.policybindings.list
    - resourcemanager.projects.get
    - resourcemanager.projects.getIamPolicy
    - resourcemanager.projects.searchPolicyBindings
    role_id: projectIamViewer
    stage: GA
    title: Custom role projectIamViewer
  module.organization[0].google_organization_iam_custom_role.roles["service_account_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - iam.serviceAccounts.get
    - iam.serviceAccounts.getIamPolicy
    - iam.serviceAccounts.list
    role_id: serviceAccountViewer
    stage: GA
    title: Custom role serviceAccountViewer
  module.organization[0].google_organization_iam_custom_role.roles["service_networking_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - servicenetworking.operations.get
    - servicenetworking.operations.list
    - servicenetworking.services.get
    - servicenetworking.services.getConsumerConfig
    - servicenetworking.services.getVpcServiceControls
    - servicenetworking.services.listPeeredDnsDomains
    role_id: serviceNetworkingViewer
    stage: GA
    title: Custom role serviceNetworkingViewer
  module.organization[0].google_organization_iam_custom_role.roles["service_project_network_admin"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - compute.globalOperations.get
    - compute.networks.get
    - compute.networks.updatePeering
    - compute.organizations.disableXpnResource
    - compute.organizations.enableXpnResource
    - compute.projects.get
    - compute.subnetworks.getIamPolicy
    - compute.subnetworks.setIamPolicy
    - dns.networks.bindPrivateDNSZone
    - resourcemanager.projects.get
    role_id: serviceProjectNetworkAdmin
    stage: GA
    title: Custom role serviceProjectNetworkAdmin
  module.organization[0].google_organization_iam_custom_role.roles["storage_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - storage.buckets.get
    - storage.buckets.getIamPolicy
    - storage.buckets.getObjectInsights
    - storage.buckets.list
    - storage.buckets.listEffectiveTags
    - storage.buckets.listTagBindings
    - storage.managedFolders.get
    - storage.managedFolders.getIamPolicy
    - storage.managedFolders.list
    - storage.multipartUploads.list
    - storage.multipartUploads.listParts
    - storage.objects.get
    - storage.objects.getIamPolicy
    - storage.objects.list
    role_id: storageViewer
    stage: GA
    title: Custom role storageViewer
  module.organization[0].google_organization_iam_custom_role.roles["tag_viewer"]:
    description: Terraform-managed.
    org_id: '1234567890'
    permissions:
    - resourcemanager.tagHolds.list
    - resourcemanager.tagKeys.get
    - resourcemanager.tagKeys.getIamPolicy
    - resourcemanager.tagKeys.list
    - resourcemanager.tagValues.get
    - resourcemanager.tagValues.getIamPolicy
    - resourcemanager.tagValues.list
    role_id: tagViewer
    stage: GA
    title: Custom role tagViewer
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["artifactregistryRequireCMEK"]
  : custom_config:
    - custom_output: []
      description: Detect if Artifact Registry repositories are not encrypted using
        CMEK
      predicate:
      - description: null
        expression: (!has(resource.kmsKeyName))
        location: null
        title: null
      recommendation: Ensure the Artifact Registry repositoriesa are encrypted using
        CMEK
      resource_selector:
      - resource_types:
        - artifactregistry.googleapis.com/Repository
      severity: HIGH
    display_name: artifactregistryRequireCMEK
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudfunctionsV1RequireIngressInternalAndLoadBalancer"]
  : custom_config:
    - custom_output: []
      description: Detect if Gen1 Cloud Functions are not configured to allow only
        internal traffic and traffic from load balancer
      predicate:
      - description: null
        expression: (!resource.ingressSettings.matches("ALLOW_INTERNAL_AND_GCLB"))
        location: null
        title: null
      recommendation: Ensure Gen1 Cloud Functions are configured to allow only internal
        traffic and traffic from load balancer
      resource_selector:
      - resource_types:
        - cloudfunctions.googleapis.com/CloudFunction
      severity: MEDIUM
    display_name: cloudfunctionsV1RequireIngressInternalAndLoadBalancer
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudfunctionsV1RequireVPCConnector"]
  : custom_config:
    - custom_output: []
      description: Detect if Gen1 Cloud Functions are configured without any VPC Connector
      predicate:
      - description: null
        expression: (!has(resource.vpcConnector))
        location: null
        title: null
      recommendation: Ensure Gen1 Cloud Functions are configured with VPC Connector
      resource_selector:
      - resource_types:
        - cloudfunctions.googleapis.com/CloudFunction
      severity: MEDIUM
    display_name: cloudfunctionsV1RequireVPCConnector
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudkmsAllowedAlgorithms"]
  : custom_config:
    - custom_output: []
      description: Detect if the the algorithm for Cloud KMS keys is not configured
        correctly
      predicate:
      - description: null
        expression: resource.algorithm in ["GOOGLE_SYMMETRIC_ENCRYPTION", "EXTERNAL_SYMMETRIC_ENCRYPTION"]
          == false
        location: null
        title: null
      recommendation: Ensure the algorithm for Cloud KMS keys is configured correctly
      resource_selector:
      - resource_types:
        - cloudkms.googleapis.com/CryptoKeyVersion
      severity: MEDIUM
    display_name: cloudkmsAllowedAlgorithms
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudkmsAllowedProtectionLevel"]
  : custom_config:
    - custom_output: []
      description: Detect if the protection level for Cloud KMS keys is not configured
        correctly
      predicate:
      - description: null
        expression: resource.primary.protectionLevel in ["SOFTWARE"] == false
        location: null
        title: null
      recommendation: Ensure the protection level for Cloud KMS keys is configured
        correctly
      resource_selector:
      - resource_types:
        - cloudkms.googleapis.com/CryptoKey
      severity: MEDIUM
    display_name: cloudkmsAllowedProtectionLevel
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudrunDisableJobDefaultServiceAccount"]
  : custom_config:
    - custom_output: []
      description: Detect if default service accounts are used by Cloud Run jobs
      predicate:
      - description: null
        expression: resource.spec.template.spec.template.spec.serviceAccountName.endsWith("@developer.gserviceaccount.com")
        location: null
        title: null
      recommendation: Ensure only authorized non-default service accounts are used
        by Cloud Run jobs
      resource_selector:
      - resource_types:
        - run.googleapis.com/Job
      severity: HIGH
    display_name: cloudrunDisableJobDefaultServiceAccount
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudrunDisableServiceDefaultServiceAccount"]
  : custom_config:
    - custom_output: []
      description: Detect if default service accounts are used by Cloud Run services
      predicate:
      - description: null
        expression: resource.spec.template.spec.serviceAccountName.endsWith("@developer.gserviceaccount.com")
        location: null
        title: null
      recommendation: Ensure only authorized non-default service accounts are used
        by Cloud Run services
      resource_selector:
      - resource_types:
        - run.googleapis.com/Service
      severity: HIGH
    display_name: cloudrunDisableServiceDefaultServiceAccount
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudrunRequireBinaryAuthorization"]
  : custom_config:
    - custom_output: []
      description: Detect if Cloud Run services are configured without Binary Authorization
        enabled
      predicate:
      - description: null
        expression: (!resource.metadata.annotations.exists(data, data == 'run.googleapis.com/binary-authorization'))
        location: null
        title: null
      recommendation: Ensure that Binary Authorization is enabled for all Cloud Run
        services and that the project's default Binary Authorization policy requires
        attestation
      resource_selector:
      - resource_types:
        - run.googleapis.com/Job
        - run.googleapis.com/Service
      severity: HIGH
    display_name: cloudrunRequireBinaryAuthorization
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudrunRequireEgressAllTraffic"]
  : custom_config:
    - custom_output: []
      description: Detect if Cloud Run services and jobs are not configured to route
        all egress traffic through the VPC network
      predicate:
      - description: null
        expression: "(\n  !resource.spec.template.metadata.annotations['run.googleapis.com/vpc-access-egress'].matches('all-traffic')\n\
          )"
        location: null
        title: null
      recommendation: Ensure Cloud Run services and jobs are configured to route all
        egress traffic through the VPC network
      resource_selector:
      - resource_types:
        - run.googleapis.com/Service
        - run.googleapis.com/Job
      severity: HIGH
    display_name: cloudrunRequireEgressAllTraffic
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudrunRequireIngressInternalAndLoadBalancer"]
  : custom_config:
    - custom_output: []
      description: Detect if Cloud Run services are not configured to allow only internal
        traffic and traffic from load balancer
      predicate:
      - description: null
        expression: "(\n  !resource.metadata.annotations['run.googleapis.com/ingress'].matches('internal-and-cloud-load-balancing')\n\
          )"
        location: null
        title: null
      recommendation: Ensure Cloud Run services are configured to allow only internal
        traffic and traffic from load balancer
      resource_selector:
      - resource_types:
        - run.googleapis.com/Service
      severity: HIGH
    display_name: cloudrunRequireIngressInternalAndLoadBalancer
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudsqlRequireHighAvailability"]
  : custom_config:
    - custom_output: []
      description: Detect if the high availability (HA) configuration for Cloud SQL
        instances is not set to regional
      predicate:
      - description: null
        expression: (resource.settings.availabilityType != "REGIONAL")
        location: null
        title: null
      recommendation: Ensure if the HA configuration for all Cloud SQL instances is
        set regional
      resource_selector:
      - resource_types:
        - sqladmin.googleapis.com/Instance
      severity: MEDIUM
    display_name: cloudsqlRequireHighAvailability
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["cloudsqlRequirePointInTimeRecovery"]
  : custom_config:
    - custom_output: []
      description: Detect if the CloudSQL instances have point in time recovery disabled
      predicate:
      - description: null
        expression: "(\n  !resource.settings.backupConfiguration.binaryLogEnabled\
          \ &&\n  !resource.settings.backupConfiguration.pointInTimeRecoveryEnabled\n\
          )"
        location: null
        title: null
      recommendation: Ensure the CloudSQL instances have point in time recovery enabled
      resource_selector:
      - resource_types:
        - sqladmin.googleapis.com/Instance
      severity: HIGH
    display_name: cloudsqlRequirePointInTimeRecovery
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["computeDisableNestedVirtualization"]
  : custom_config:
    - custom_output: []
      description: Detect Compute Instances with nested virtualization enabled
      predicate:
      - description: null
        expression: resource.advancedMachineFeatures.enableNestedVirtualization
        location: null
        title: null
      recommendation: Ensure Compute Instance does not have nested virtualization
        enabled
      resource_selector:
      - resource_types:
        - compute.googleapis.com/Instance
      severity: MEDIUM
    display_name: computeDisableNestedVirtualization
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["gkeDisableClientCertificateAuth"]
  : custom_config:
    - custom_output: []
      description: Detect if any GKE clusters uses client certificate authentication
      predicate:
      - description: null
        expression: resource.masterAuth.clientCertificateConfig.issueClientCertificate
          == true
        location: null
        title: null
      recommendation: Ensure that control plane does not use client certificate authentication
      resource_selector:
      - resource_types:
        - container.googleapis.com/Cluster
      severity: CRITICAL
    display_name: gkeDisableClientCertificateAuth
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["gkeRequireConfidentialNodes"]
  : custom_config:
    - custom_output: []
      description: Detect if any GKE clusters are running without Confidential GKE
        nodes
      predicate:
      - description: null
        expression: (resource.confidentialNodes.enabled == false)
        location: null
        title: null
      recommendation: Ensure GKE clusters are running with Confidential GKE nodes
        enabled
      resource_selector:
      - resource_types:
        - container.googleapis.com/Cluster
      severity: MEDIUM
    display_name: gkeRequireConfidentialNodes
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["gkeRequireDataplaneV2"]
  : custom_config:
    - custom_output: []
      description: Detect if GKE clusters are configured with a version different
        than Dataplane V2
      predicate:
      - description: null
        expression: resource.networkConfig.datapathProvider != 'ADVANCED_DATAPATH'
        location: null
        title: null
      recommendation: Ensure only GKE Dataplane V2 are configured
      resource_selector:
      - resource_types:
        - container.googleapis.com/Cluster
      severity: MEDIUM
    display_name: gkeRequireDataplaneV2
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["gkeRequireRegionalCluster"]
  : custom_config:
    - custom_output: []
      description: Detect if any non regional GKE clusters are used
      predicate:
      - description: null
        expression: (!resource.location.matches("^[a-z]+(-[a-z, 1-9]+)$"))
        location: null
        title: null
      recommendation: Ensure GKE clusters are configured to be regional
      resource_selector:
      - resource_types:
        - container.googleapis.com/Cluster
      severity: MEDIUM
    display_name: gkeRequireRegionalCluster
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  ? module.organization[0].google_scc_management_organization_security_health_analytics_custom_module.scc_organization_custom_module["secretmanagerAllowedRotationPeriod"]
  : custom_config:
    - custom_output: []
      description: Detect if the rotation period for secrets are not configured correctly
      predicate:
      - description: null
        expression: (!has(resource.rotation.rotationPeriod)) || (resource.rotation.rotationPeriod
          > duration("31536000s"))
        location: null
        title: null
      recommendation: Ensure the rotation period for secrets are configured correctly
      resource_selector:
      - resource_types:
        - secretmanager.googleapis.com/Secret
      severity: MEDIUM
    display_name: secretmanagerAllowedRotationPeriod
    enablement_state: ENABLED
    location: global
    organization: '1234567890'
    timeouts: null
  module.organization[0].google_tags_tag_key.default["context"]:
    allowed_values_regex: null
    description: Organization-level contexts.
    parent: organizations/1234567890
    purpose: null
    purpose_data: null
    short_name: context
    timeouts: null
  module.organization[0].google_tags_tag_key.default["environment"]:
    allowed_values_regex: null
    description: Organization-level environments.
    parent: organizations/1234567890
    purpose: null
    purpose_data: null
    short_name: environment
    timeouts: null
  module.organization[0].google_tags_tag_key.default["org-policies"]:
    allowed_values_regex: null
    description: Organization policy condition tags.
    parent: organizations/1234567890
    purpose: null
    purpose_data: null
    short_name: org-policies
    timeouts: null
  module.organization[0].google_tags_tag_value.default["context/project-factory"]:
    description: Project factory.
    short_name: project-factory
    timeouts: null
  module.organization[0].google_tags_tag_value.default["environment/development"]:
    description: Development.
    short_name: development
    timeouts: null
  module.organization[0].google_tags_tag_value.default["environment/production"]:
    description: Production.
    short_name: production
    timeouts: null
  module.organization[0].google_tags_tag_value.default["org-policies/allowed-essential-contacts-domains-all"]:
    description: Allow all domains in essntial contacts org policy.
    short_name: allowed-essential-contacts-domains-all
    timeouts: null
  module.organization[0].google_tags_tag_value.default["org-policies/allowed-policy-member-domains-all"]:
    description: Allow all domains in DRS org policy.
    short_name: allowed-policy-member-domains-all
    timeouts: null
  module.organization[0].google_tags_tag_value.default["org-policies/allowed-sa-impersonation"]:
    description: Allow service account impersonation for tagged principals.
    short_name: allowed-sa-impersonation
    timeouts: null
  module.projects-observability[0].google_logging_metric.metrics["auditConfigChanges"]:
    bucket_options: []
    description: Audit Configuration Changes
    disabled: null
    filter: protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:*
    label_extractors:
      folder_id: EXTRACT(labels.folder_id)
      method_name: EXTRACT(protoPayload.methodName)
      organization_id: EXTRACT(labels.organization_id)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
    - display_name: null
      labels:
      - description: folder_id
        key: folder_id
        value_type: STRING
      - description: method_name
        key: method_name
        value_type: STRING
      - description: organization_id
        key: organization_id
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      - description: project_id
        key: project_id
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: auditConfigChanges
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_logging_metric.metrics["binaryAuthorizationPolicyChanges"]:
    bucket_options: []
    description: Binary Authorization Policy Changes
    disabled: null
    filter: protoPayload.methodName="google.cloud.binaryauthorization.v1.BinauthzManagementServiceV1.UpdatePolicy"
      AND protoPayload.serviceName="binaryauthorization.googleapis.com" AND ("ALWAYS_ALLOW"
      OR "DRYRUN_AUDIT_LOG_ONLY")
    label_extractors:
      method_name: EXTRACT(protoPayload.methodName)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
    - display_name: null
      labels:
      - description: method_name
        key: method_name
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      - description: project_id
        key: project_id
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: binaryAuthorizationPolicyChanges
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_logging_metric.metrics["cloudsqlInstanceChanges"]:
    bucket_options: []
    description: Cloud SQL Instance Configuration Changes
    disabled: null
    filter: protoPayload.methodName="cloudsql.instances.update"
    label_extractors:
      database_id: EXTRACT(labels.database_id)
      method_name: EXTRACT(protoPayload.methodName)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
    - display_name: null
      labels:
      - description: database_id
        key: database_id
        value_type: STRING
      - description: method_name
        key: method_name
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      - description: project_id
        key: project_id
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: cloudsqlInstanceChanges
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_logging_metric.metrics["customRoleChanges"]:
    bucket_options: []
    description: Custom Role Changes
    disabled: null
    filter: "resource.type=\"iam_role\" AND (\n  protoPayload.methodName=\"google.iam.admin.v1.CreateRole\"\
      \ OR\n  protoPayload.methodName=\"google.iam.admin.v1.UpdateRole\" OR\n  protoPayload.methodName=\"\
      google.iam.admin.v1.DeleteRole\"\n)"
    label_extractors:
      method_name: EXTRACT(protoPayload.methodName)
      organization_id: EXTRACT(labels.organization_id)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
      role_name: EXTRACT(labels.role_name)
    metric_descriptor:
    - display_name: null
      labels:
      - description: method_name
        key: method_name
        value_type: STRING
      - description: organization_id
        key: organization_id
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      - description: project_id
        key: project_id
        value_type: STRING
      - description: role_name
        key: role_name
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: customRoleChanges
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_logging_metric.metrics["firewallPolicyRuleChanges"]:
    bucket_options: []
    description: Network Firewall Policy Rule Changes
    disabled: null
    filter: "resource.labels.method:\"compute.networkFirewallPolicies\" AND (\n  protoPayload.methodName:\"\
      compute.networkFirewallPolicies.addRule\" OR\n  protoPayload.methodName:\"compute.networkFirewallPolicies.removeRule\"\
      \ OR\n  protoPayload.methodName:\"compute.networkFirewallPolicies.patchRule\"\
      \n)"
    label_extractors:
      method_name: EXTRACT(protoPayload.methodName)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
    metric_descriptor:
    - display_name: null
      labels:
      - description: method_name
        key: method_name
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: firewallPolicyRuleChanges
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_logging_metric.metrics["firewallRuleChanges"]:
    bucket_options: []
    description: VPC Network Firewall Rule Changes
    disabled: null
    filter: resource.type="gce_firewall_rule" AND (protoPayload.methodName:"compute.firewalls.patch"
      OR protoPayload.methodName:"compute.firewalls.insert" OR protoPayload.methodName:"compute.firewalls.delete")
    label_extractors:
      firewall_rule_id: EXTRACT(labels.firewall_rule_id)
      method_name: EXTRACT(protoPayload.methodName)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
    - display_name: null
      labels:
      - description: firewall_rule_id
        key: firewall_rule_id
        value_type: STRING
      - description: method_name
        key: method_name
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      - description: project_id
        key: project_id
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: firewallRuleChanges
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_logging_metric.metrics["networkChanges"]:
    bucket_options: []
    description: VPC Network Changes
    disabled: null
    filter: "resource.type=\"gce_network\" AND (\n  protoPayload.methodName:\"compute.networks.insert\"\
      \ OR\n  protoPayload.methodName:\"compute.networks.patch\" OR\n  protoPayload.methodName:\"\
      compute.networks.delete\" OR\n  protoPayload.methodName:\"compute.networks.addPeering\"\
      \ OR\n  protoPayload.methodName:\"compute.networks.updatePeering\" OR\n  protoPayload.methodName:\"\
      compute.networks.removePeering\"\n)"
    label_extractors:
      method_name: EXTRACT(protoPayload.methodName)
      network_id: EXTRACT(labels.network_id)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
    - display_name: null
      labels:
      - description: method_name
        key: method_name
        value_type: STRING
      - description: network_id
        key: network_id
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      - description: project_id
        key: project_id
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: networkChanges
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_logging_metric.metrics["networkRouteChanges"]:
    bucket_options: []
    description: VPC Network Route Changes
    disabled: null
    filter: "resource.type=\"gce_route\" AND (\n  protoPayload.methodName:\"compute.routes.insert\"\
      \ OR\n  protoPayload.methodName:\"compute.routes.delete\"\n)"
    label_extractors:
      method_name: EXTRACT(protoPayload.methodName)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
      route_id: EXTRACT(labels.route_id)
    metric_descriptor:
    - display_name: null
      labels:
      - description: method_name
        key: method_name
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      - description: project_id
        key: project_id
        value_type: STRING
      - description: route_id
        key: route_id
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: networkRouteChanges
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_logging_metric.metrics["projectOwnershipChange"]:
    bucket_options: []
    description: Project Ownership Changes
    disabled: null
    filter: "(protoPayload.serviceName=\"cloudresourcemanager.googleapis.com\") AND\n\
      (ProjectOwnership OR projectOwnerInvitee)\nOR\n(\n  protoPayload.serviceData.policyDelta.bindingDeltas.action=\"\
      REMOVE\" AND\n  protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\"\
      \n)\nOR\n(\n  protoPayload.serviceData.policyDelta.bindingDeltas.action=\"ADD\"\
      \ AND\n  protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\"\
      \n)"
    label_extractors:
      folder_id: EXTRACT(labels.folder_id)
      method_name: EXTRACT(protoPayload.methodName)
      organization_id: EXTRACT(labels.organization_id)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
    - display_name: null
      labels:
      - description: folder_id
        key: folder_id
        value_type: STRING
      - description: method_name
        key: method_name
        value_type: STRING
      - description: organization_id
        key: organization_id
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      - description: project_id
        key: project_id
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: projectOwnershipChange
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_logging_metric.metrics["storageIamChanges"]:
    bucket_options: []
    description: Cloud Storage IAM Permission Changes
    disabled: null
    filter: resource.type="gcs_bucket" AND protoPayload.methodName="storage.setIamPermissions"
    label_extractors:
      bucket_name: EXTRACT(labels.bucket_name)
      location: EXTRACT(labels.location)
      method_name: EXTRACT(protoPayload.methodName)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
    - display_name: null
      labels:
      - description: bucket_name
        key: bucket_name
        value_type: STRING
      - description: location
        key: location
        value_type: STRING
      - description: method_name
        key: method_name
        value_type: STRING
      - description: principal
        key: principal
        value_type: STRING
      - description: project_id
        key: project_id
        value_type: STRING
      metric_kind: DELTA
      unit: '1'
      value_type: INT64
    name: storageIamChanges
    project: ft0-prod-audit-logs-0
    timeouts: null
    value_extractor: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["auditConfigChanges"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          - metric.label.organization_id
          - metric.label.folder_id
          - metric.label.project_id
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/auditConfigChanges"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: 'Log match condition: Audit Configuration Changes'
    display_name: Audit Configuration Changes
    documentation:
    - content: 'Log-based alerting policy in project ${project} detected audit configuration
        changes.


        This alert helps track GCP services audit log configuration changes to ensure
        appropriate.

        audit logs are being collected

        ```

        protoPayload.methodName="SetIamPolicy" AND

        protoPayload.serviceData.policyDelta.auditConfigDeltas:*

        ```'
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["binaryAuthorizationPolicyChanges"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          - metric.label.project_id
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/binaryAuthorizationPolicyChanges"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: 'Log match condition: Binary Authorization policy configuration
        changes'
    display_name: Binary Authorization Policy Changes
    documentation:
    - content: 'Log-based alerting policy in project ${project} detected for a change
        to Binary Authorization

        project-singleton policy, weakening the enforcement or evaluation modes.


        This alert helps ensure security by monitoring configuration changes to Binary
        Authorization policies.

        ```

        protoPayload.methodName="google.cloud.binaryauthorization.v1.BinauthzManagementServiceV1.UpdatePolicy"
        AND

        protoPayload.serviceName="binaryauthorization.googleapis.com" AND

        ("ALWAYS_ALLOW" OR "DRYRUN_AUDIT_LOG_ONLY")

        ```'
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["cloudsqlInstanceChanges"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          - metric.label.project_id
          - metric.label.database_id
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/cloudsqlInstanceChanges"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: 'Log match condition: Cloud SQL instance configuration changes'
    display_name: Cloud SQL Instance Configuration Changes
    documentation:
    - content: 'Log-based alerting policy in project ${project} detected Cloud SQL
        instance configuration changes.


        This alert helps ensure security by monitoring configuration changes to SQL
        instances.

        ```

        protoPayload.methodName="cloudsql.instances.update"

        ```'
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["customRoleChanges"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          - metric.label.organization_id
          - metric.label.project_id
          - metric.label.role_name
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/customRoleChanges"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: 'Log match condition: custom role changes'
    display_name: Custom Role Changes
    documentation:
    - content: "Log-based alerting policy in project ${project} detected custom IAM\
        \ role creation,\ndeletion or update activities.\n\nThis alert helps ensure\
        \ security by monitoring changes to Identity and Access Management (IAM) roles.\n\
        ```\nresource.type=\"iam_role\" AND (\n  protoPayload.methodName=\"google.iam.admin.v1.CreateRole\"\
        \ OR\n  protoPayload.methodName=\"google.iam.admin.v1.UpdateRole\" OR\n  protoPayload.methodName=\"\
        google.iam.admin.v1.DeleteRole\"\n)\n```"
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["firewallPolicyRuleChanges"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/firewallPolicyRuleChanges"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: 'Log match condition: Network Firewall Policy Rule Changes'
    display_name: Network Firewall Policy Rule Changes
    documentation:
    - content: "Log-based alerting policy in project ${project} detected Firewall\
        \ Policy rule changes.\n\nThis alert helps ensure security by monitoring creation,\
        \ modification, or deletion of firewall rules.\n```\nresource.labels.method:\"\
        compute.networkFirewallPolicies\" AND (\n  protoPayload.methodName:\"compute.networkFirewallPolicies.addRule\"\
        \ OR\n  protoPayload.methodName:\"compute.networkFirewallPolicies.removeRule\"\
        \ OR\n  protoPayload.methodName:\"compute.networkFirewallPolicies.patchRule\"\
        \n)\n```"
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["firewallRuleChanges"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          - metric.label.project_id
          - metric.label.firewall_rule_id
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/firewallRuleChanges"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: 'Log match condition: VPC Network Firewall Rule Changes'
    display_name: VPC Network Firewall Rule Changes
    documentation:
    - content: "Log-based alerting policy in project ${project} detected VPC Network\
        \ Firewall rule changes.\n\nThis alert helps ensure security by monitoring\
        \ creation, modification, or deletion of firewall rules.\n```\nresource.type=\"\
        gce_firewall_rule\" AND (\n  protoPayload.methodName:\"compute.firewalls.patch\"\
        \ OR\n  protoPayload.methodName:\"compute.firewalls.insert\" OR\n  protoPayload.methodName:\"\
        compute.firewalls.delete\"\n)\n```"
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["networkChanges"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          - metric.label.project_id
          - metric.label.network_id
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/networkChanges"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: 'Log match condition: VPC Network Changes'
    display_name: VPC Network Changes
    documentation:
    - content: "Log-based alerting policy in project ${project} detected VPC Network\
        \ changes.\n\nThis alert helps ensure security by monitoring creation, modification,\
        \ deletion,\nor peering changes to VPC networks.\n```\nresource.type=\"gce_network\"\
        \ AND (\n  protoPayload.methodName:\"compute.networks.insert\" OR\n  protoPayload.methodName:\"\
        compute.networks.patch\" OR\n  protoPayload.methodName:\"compute.networks.delete\"\
        \ OR\n  protoPayload.methodName:\"compute.networks.addPeering\" OR\n  protoPayload.methodName:\"\
        compute.networks.updatePeering\" OR\n  protoPayload.methodName:\"compute.networks.removePeering\"\
        \n)\n```"
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["networkRouteChanges"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          - metric.label.project_id
          - metric.label.route_id
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/networkRouteChanges"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: 'Log match condition: VPC Network Route Changes'
    display_name: VPC Network Route Changes
    documentation:
    - content: "Log-based alerting policy in project ${project} detected VPC Network\
        \ Route changes.\n\nThis alert helps ensure security by monitoring creation\
        \ or deletion of network routes.\n```\nresource.type=\"gce_route\" AND (\n\
        \  protoPayload.methodName:\"compute.routes.insert\" OR\n  protoPayload.methodName:\"\
        compute.routes.delete\"\n)\n```"
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["projectOwnershipChange"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          - metric.label.organization_id
          - metric.label.folder_id
          - metric.label.project_id
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/projectOwnershipChange"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: Project Ownership Changes
    display_name: Project Ownership Changes
    documentation:
    - content: "Log-based alerting policy in project ${project} detected a project\
        \ ownership assignments or changes.\n```\n(protoPayload.serviceName=\"cloudresourcemanager.googleapis.com\"\
        ) AND\n(ProjectOwnership OR projectOwnerInvitee)\nOR\n(\n  protoPayload.serviceData.policyDelta.bindingDeltas.action=\"\
        REMOVE\" AND\n  protoPayload.serviceData.policyDelta.bindingDeltas.role=\"\
        roles/owner\"\n)\nOR\n(\n  protoPayload.serviceData.policyDelta.bindingDeltas.action=\"\
        ADD\" AND\n  protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\"\
        \n)\n```"
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  module.projects-observability[0].google_monitoring_alert_policy.alerts["storageIamChanges"]:
    alert_strategy: []
    combiner: OR
    conditions:
    - condition_absent: []
      condition_matched_log: []
      condition_monitoring_query_language: []
      condition_prometheus_query_language: []
      condition_sql: []
      condition_threshold:
      - aggregations:
        - alignment_period: 60s
          cross_series_reducer: REDUCE_SUM
          group_by_fields:
          - metric.label.principal
          - metric.label.method_name
          - metric.label.project_id
          - metric.label.location
          - metric.label.bucket_name
          per_series_aligner: ALIGN_SUM
        comparison: COMPARISON_GT
        denominator_aggregations: []
        denominator_filter: null
        duration: 0s
        evaluation_missing_data: null
        filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/storageIamChanges"
        forecast_options: []
        threshold_value: 0
        trigger:
        - count: 1
          percent: null
      display_name: Cloud Storage IAM Permission Changes
    display_name: Cloud Storage IAM Permission Changes
    documentation:
    - content: 'Log-based alerting policy in project ${project} detected Cloud Storage
        Bucket IAM changes.


        This alert helps ensure security by monitoring IAM permission changes to Cloud
        Storage buckets.

        ```

        resource.type="gcs_bucket" AND protoPayload.methodName="storage.setIamPermissions"

        ```'
      links: []
      mime_type: text/markdown
      subject: null
    enabled: true
    notification_channels: []
    project: ft0-prod-audit-logs-0
    severity: null
    timeouts: null
    user_labels: null
  terraform_data.precondition:
    input: null
    output: null
    triggers_replace: null
  terraform_data.precondition_cicd:
    input: null
    output: null
    triggers_replace: null

counts:
  google_bigquery_dataset: 1
  google_bigquery_default_service_account: 2
  google_billing_account_iam_member: 6
  google_essential_contacts_contact: 1
  google_folder: 7
  google_folder_iam_binding: 70
  google_kms_crypto_key: 3
  google_kms_crypto_key_iam_member: 3
  google_kms_key_ring: 3
  google_logging_metric: 10
  google_logging_organization_settings: 1
  google_logging_organization_sink: 3
  google_logging_project_bucket_config: 6
  google_logging_project_settings: 3
  google_monitoring_alert_policy: 10
  google_org_policy_custom_constraint: 89
  google_org_policy_policy: 167
  google_organization_iam_audit_config: 1
  google_organization_iam_binding: 40
  google_organization_iam_custom_role: 14
  google_project: 3
  google_project_iam_binding: 64
  google_project_iam_member: 17
  google_project_service: 37
  google_project_service_identity: 11
  google_scc_management_organization_security_health_analytics_custom_module: 18
  google_service_account: 12
  google_service_account_iam_binding: 2
  google_service_account_iam_member: 4
  google_storage_bucket: 3
  google_storage_bucket_iam_binding: 4
  google_storage_bucket_object: 10
  google_storage_managed_folder: 4
  google_storage_managed_folder_iam_binding: 8
  google_storage_project_service_account: 3
  google_tags_tag_binding: 5
  google_tags_tag_key: 3
  google_tags_tag_value: 6
  google_tags_tag_value_iam_binding: 4
  local_file: 9
  modules: 54
  resources: 671
  terraform_data: 4

outputs:
  iam_principals:
    domain: domain:example.org
    gcp-billing-admins: group:gcp-billing-admins@example.org
    gcp-devops: group:gcp-devops@example.org
    gcp-network-admins: group:gcp-network-admins@example.org
    gcp-organization-admins: group:fabric-fast-owners@google.com
    gcp-secops-admins: group:gcp-secops-admins@example.org
    gcp-security-admins: group:gcp-security-admins@example.org
    gcp-support: group:gcp-support@example.org
  projects: __missing__
  subnet_ips: {}
  subnet_self_links: {}
  tfvars: __missing__
  vpc_self_links: {}
