Skip to content

Add Cloud VMware Engine policies and documentation - Gcp/service/cloud vmware engine #420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kisara07 wants to merge 3 commits into from
Closed

Add Cloud VMware Engine policies and documentation - Gcp/service/cloud vmware engine #420

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
278d0fd
Add Cloud VMware Engine policies and inputs
kisara07 May 15, 2026
8130abc
polices, inputs and docs
kisara07 May 19, 2026
977df5e
Fix parent policy remedy outputs
kisara07 May 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 50 additions & 50 deletions docs/gcp/Cloud_VMware_Engine/resource_json/vmwareengine_cluster.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,53 +5,53 @@
"parent": {
"description": "The resource name of the private cloud to create a new cluster in. Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names. For example: projects/my-project/locations/us-west1-a/privateClouds/my-cloud",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "The parent value controls which private cloud the cluster is created under. Using an approved parent helps ensure that the cluster is deployed within a trusted private cloud, approved location, and managed environment.",
"compliant": "projects/599444694846/locations/us-west1-a/privateClouds/c",
"non-compliant": "projects/599444694846/locations/us-west1-a/privateClouds/nc",
"parent": null
},
"name": {
"description": "The ID of the Cluster.",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "Cluster names should follow an approved naming standard so that resources can be clearly identified, audited, and managed consistently",
"compliant": "c, ext-cluster ",
"non-compliant": "c, wrong-cluster",
"parent": null
},
"node_type_configs": {
"description": "The map of cluster node types in this cluster, where the key is canonical identifier of the node type (corresponds to the NodeType). Structure is [documented below](#nested_node_type_configs).",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": true,
"rationale": "Node type configuration affects the cluster capacity, cost, and operational profile. Approved node types and node counts help maintain secure and controlled infrastructure sizing.",
"compliant": null,
"non-compliant": null,
"parent": null,
"arguments": {
"node_type_id": {
"description": "",
"required": null,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"description": "The canonical identifier of the node type used by the cluster.",
"required": true,
"security_impact": true,
"rationale": "Only approved node types should be used to ensure the cluster runs on authorised hardware profiles that meet organisational security, performance, and cost requirements.",
"compliant": "standard-72",
"non-compliant": "wrong-node-type",
"parent": "node_type_configs"
},
"node_count": {
"description": "The number of nodes of this type in the cluster.",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "Node count affects availability, capacity, and cost. Enforcing an approved node count helps prevent under-provisioned or over-provisioned clusters.",
"compliant": 3,
"non-compliant": 1,
"parent": "node_type_configs"
},
"custom_core_count": {
"description": "Customized number of cores available to each node of the type. This number must always be one of `nodeType.availableCustomCoreCounts`. If zero is provided max value from `nodeType.availableCustomCoreCounts` will be used. Once the customer is created then corecount cannot be changed.",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "node_type_configs"
Expand All @@ -61,109 +61,109 @@
"autoscaling_settings": {
"description": "Configuration of the autoscaling applied to this cluster Structure is [documented below](#nested_autoscaling_settings).",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": null,
"arguments": {
"autoscaling_policies": {
"description": "The map with autoscaling policies applied to the cluster. The key is the identifier of the policy. It must meet the following requirements: * Only contains 1-63 alphanumeric characters and hyphens * Begins with an alphabetical character * Ends with a non-hyphen character * Not formatted as a UUID * Complies with [RFC 1034](https://datatracker.ietf.org/doc/html/rfc1034) (section 3.5) Currently the map must contain only one element that describes the autoscaling policy for compute nodes. Structure is [documented below](#nested_autoscaling_settings_autoscaling_policies).",
"required": true,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_settings"
},
"min_cluster_node_count": {
"description": "Minimum number of nodes of any type in a cluster. Mandatory for successful addition of autoscaling settings in cluster.",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_settings"
},
"max_cluster_node_count": {
"description": "Maximum number of nodes of any type in a cluster. Mandatory for successful addition of autoscaling settings in cluster.",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_settings"
},
"cool_down_period": {
"description": "The minimum duration between consecutive autoscale operations. It starts once addition or removal of nodes is fully completed. Minimum cool down period is 30m. Cool down period must be in whole minutes (for example, 30m, 31m, 50m). Mandatory for successful addition of autoscaling settings in cluster.",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_settings"
}
}
},
"autoscaling_policies": {
"description": "",
"required": null,
"security_impact": null,
"rationale": null,
"description": "Autoscaling policy settings that define how compute nodes are added or removed from the cluster.",
"required": false,
"security_impact": false,
"rationale": "Autoscaling policies were not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": null,
"arguments": {
"autoscale_policy_id": {
"description": "",
"required": null,
"security_impact": null,
"rationale": null,
"description": "The identifier of the autoscaling policy.",
"required": false,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_policies"
},
"node_type_id": {
"description": "The canonical identifier of the node type to add or remove.",
"required": true,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "Autoscaling policy node type was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_policies"
},
"scale_out_size": {
"description": "Number of nodes to add to a cluster during a scale-out operation. Must be divisible by 2 for stretched clusters.",
"required": true,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_policies"
},
"cpu_thresholds": {
"description": "Utilization thresholds pertaining to CPU utilization. Structure is [documented below](#nested_autoscaling_settings_autoscaling_policies_autoscaling_policy_cpu_thresholds).",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_policies"
},
"consumed_memory_thresholds": {
"description": "Utilization thresholds pertaining to amount of consumed memory. Structure is [documented below](#nested_autoscaling_settings_autoscaling_policies_autoscaling_policy_consumed_memory_thresholds).",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_policies"
},
"storage_thresholds": {
"description": "Utilization thresholds pertaining to amount of consumed storage. Structure is [documented below](#nested_autoscaling_settings_autoscaling_policies_autoscaling_policy_storage_thresholds).",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "This field was not included in the implemented policy checks for this resource.",
"compliant": null,
"non-compliant": null,
"parent": "autoscaling_policies"
Expand Down
80 changes: 40 additions & 40 deletions docs/gcp/Cloud_VMware_Engine/resource_json/vmwareengine_external_access_rule.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,66 +5,66 @@
"priority": {
"description": "External access rule priority, which determines the external access rule to use when multiple rules apply.",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "Priority controls which rule is evaluated first when multiple external access rules apply. Incorrect priority values may cause a less restrictive rule to be applied before a safer rule.",
"compliant": 101,
"non-compliant": 1,
"parent": null
},
"action": {
"description": "The action that the external access rule performs. Possible values are: `ALLOW`, `DENY`.",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "The action determines whether matching traffic is allowed or denied. Incorrect use of ALLOW can expose workloads to unwanted external access.",
"compliant": "DENY",
"non-compliant": "ALLOW",
"parent": null
},
"ip_protocol": {
"description": "The IP protocol to which the external access rule applies.",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "The protocol determines which type of network traffic is affected by the rule. Only approved protocols should be allowed to reduce unnecessary exposure.",
"compliant": "TCP",
"non-compliant": "UDP",
"parent": null
},
"source_ip_ranges": {
"description": "If source ranges are specified, the external access rule applies only to traffic that has a source IP address in these ranges. Structure is [documented below](#nested_source_ip_ranges).",
"required": true,
"security_impact": null,
"rationale": null,
"security_impact": true,
"rationale": "Source IP ranges control where traffic can originate from. Broad ranges such as 0.0.0.0/0 can expose the resource to traffic from any source.",
"compliant": null,
"non-compliant": null,
"parent": null,
"arguments": {
"ip_address": {
"description": "A single IP address.",
"required": false,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "A source IP address should be restricted to approved trusted addresses only.",
"compliant": "100.0.0.1",
"non-compliant": "0.0.0.0",
"parent": "source_ip_ranges"
},
"ip_address_range": {
"description": "An IP address range in the CIDR format.",
"required": false,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "Source CIDR ranges should avoid broad public ranges. Allowing 0.0.0.0/0 permits traffic from any source address.",
"compliant": "100.0.0.0/24",
"non-compliant": "0.0.0.0/0",
"parent": "source_ip_ranges"
}
}
},
"source_ports": {
"description": "A list of source ports to which the external access rule applies.",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "Source ports should be limited to approved ports. Using wildcard ports opens the rule to all source ports.",
"compliant": "80",
"non-compliant": "*",
"parent": null
},
"destination_ip_ranges": {
Expand Down Expand Up @@ -99,35 +99,35 @@
"destination_ports": {
"description": "A list of destination ports to which the external access rule applies.",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "Destination ports should be restricted to approved ports. Using wildcard ports may expose all destination services.",
"compliant": "443",
"non-compliant": "*",
"parent": null
},
"parent": {
"description": "The resource name of the network policy. Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names. For example: projects/my-project/locations/us-west1-a/networkPolicies/my-policy",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "The parent value determines which network policy the external access rule belongs to. Using an approved parent helps ensure that the rule is applied within the correct controlled network policy.",
"compliant": "projects/599444694846/locations/us-west1/networkPolicies/c",
"non-compliant": "projects/599444694846/locations/us-west1/networkPolicies/nc",
"parent": null
},
"name": {
"description": "The ID of the external access rule.",
"required": true,
"security_impact": null,
"rationale": null,
"compliant": null,
"non-compliant": null,
"security_impact": true,
"rationale": "External access rule names should follow an approved naming standard so that rules can be clearly identified, audited, and managed consistently.",
"compliant": "c",
"non-compliant": "nc",
"parent": null
},
"description": {
"description": "User-provided description for the external access rule.",
"required": false,
"security_impact": null,
"rationale": null,
"security_impact": false,
"rationale": "The description is used for documentation and does not directly change the access behaviour of the rule.",
"compliant": null,
"non-compliant": null,
"parent": null
Expand Down
Loading
Loading