@intentius/chant-lexicon-gcp 0.41.20 → 0.44.1

package/dist/okf/rules/WGC102.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC102
+description: allUsers/allAuthenticatedUsers detected in serialized Config Connector YAML
+id: WGC102
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+allUsers/allAuthenticatedUsers detected in serialized Config Connector YAML
+
+## Applies to
+
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC103.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC103
+description: Config Connector resource without cnrm.cloud.google.com/project-id annotation
+id: WGC103
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Config Connector resource without cnrm.cloud.google.com/project-id annotation
+
+## Applies to
+
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC104.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC104
+description: StorageBucket without uniformBucketLevelAccess enabled
+id: WGC104
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+StorageBucket without uniformBucketLevelAccess enabled
+
+## Applies to
+
+- [StorageBucket](/types/StorageBucket.md)

package/dist/okf/rules/WGC105.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC105
+description: Cloud SQL instance with public 0.0.0.0/0 in authorizedNetworks
+id: WGC105
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Cloud SQL instance with public 0.0.0.0/0 in authorizedNetworks
+
+## Applies to
+
+- [SQLInstance](/types/SQLInstance.md)

package/dist/okf/rules/WGC106.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC106
+description: Config Connector resource without cnrm.cloud.google.com/deletion-policy annotation
+id: WGC106
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Config Connector resource without cnrm.cloud.google.com/deletion-policy annotation
+
+## Applies to
+
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC107.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC107
+description: StorageBucket without versioning enabled
+id: WGC107
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+StorageBucket without versioning enabled
+
+## Applies to
+
+- [StorageBucket](/types/StorageBucket.md)

package/dist/okf/rules/WGC108.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC108
+description: SQLInstance without backup configuration enabled
+id: WGC108
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+SQLInstance without backup configuration enabled
+
+## Applies to
+
+- [SQLInstance](/types/SQLInstance.md)

package/dist/okf/rules/WGC109.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGC109
+description: ComputeFirewall with sourceRanges containing 0.0.0.0/0
+id: WGC109
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+ComputeFirewall with sourceRanges containing 0.0.0.0/0

package/dist/okf/rules/WGC110.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC110
+description: KMS CryptoKey without rotation period configured
+id: WGC110
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+KMS CryptoKey without rotation period configured
+
+## Applies to
+
+- [KMSCryptoKey](/types/KMSCryptoKey.md)

package/dist/okf/rules/WGC111.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC111
+description: Resource reference points to a name not defined in the output
+id: WGC111
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Resource reference points to a name not defined in the output
+
+## Applies to
+
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC112.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC112
+description: Config Connector resource has missing or invalid apiVersion
+id: WGC112
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Config Connector resource has missing or invalid apiVersion
+
+## Applies to
+
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC113.md

@@ -0,0 +1,16 @@
+---
+type: post-synth-check
+title: WGC113
+description: Config Connector resource uses an alpha API version
+id: WGC113
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Config Connector resource uses an alpha API version
+
+## Applies to
+
+- [API](/types/API.md)
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC201.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC201
+description: Config Connector resource without app.kubernetes.io/managed-by label
+id: WGC201
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Config Connector resource without app.kubernetes.io/managed-by label
+
+## Applies to
+
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC202.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGC202
+description: ContainerCluster without workload identity configuration
+id: WGC202
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+ContainerCluster without workload identity configuration

package/dist/okf/rules/WGC203.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGC203
+description: ContainerNodePool using overly broad cloud-platform OAuth scope
+id: WGC203
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+ContainerNodePool using overly broad cloud-platform OAuth scope

package/dist/okf/rules/WGC204.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC204
+description: ComputeInstance without shielded VM configuration
+id: WGC204
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+ComputeInstance without shielded VM configuration
+
+## Applies to
+
+- [ComputeInstance](/types/ComputeInstance.md)

package/dist/okf/rules/WGC301.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC301
+description: No IAMAuditConfig resource found in output — audit logging may not be configured
+id: WGC301
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+No IAMAuditConfig resource found in output — audit logging may not be configured
+
+## Applies to
+
+- [IAMAuditConfig](/types/IAMAuditConfig.md)

package/dist/okf/rules/WGC302.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC302
+description: No Service resource found — GCP APIs may not be explicitly enabled
+id: WGC302
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+No Service resource found — GCP APIs may not be explicitly enabled
+
+## Applies to
+
+- [API](/types/API.md)

package/dist/okf/rules/WGC303.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC303
+description: No AccessContextManager ServicePerimeter found — VPC Service Controls not configured
+id: WGC303
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+No AccessContextManager ServicePerimeter found — VPC Service Controls not configured
+
+## Applies to
+
+- [ServicePerimeter](/types/ServicePerimeter.md)

package/dist/okf/rules/WGC401.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC401
+description: Config Connector resource spec contains unknown field
+id: WGC401
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Config Connector resource spec contains unknown field
+
+## Applies to
+
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC402.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC402
+description: Config Connector resource is missing a required spec field
+id: WGC402
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Config Connector resource is missing a required spec field
+
+## Applies to
+
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC403.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC403
+description: Config Connector resource spec field has wrong type or structure
+id: WGC403
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Config Connector resource spec field has wrong type or structure
+
+## Applies to
+
+- [Connector](/types/Connector.md)

package/dist/okf/rules/WGC501.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC501
+description: Org Policy guardrail not enforced — a disabled policy constrains nothing
+id: WGC501
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Org Policy guardrail not enforced — a disabled policy constrains nothing
+
+## Applies to
+
+- [API](/types/API.md)

package/dist/okf/rules/WGC502.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WGC502
+description: Org Policy guardrail defines no rules — it binds its constraint to nothing
+id: WGC502
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+Org Policy guardrail defines no rules — it binds its constraint to nothing

package/dist/okf/rules/WGC503.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: WGC503
+description: IAMAuditConfig captures nothing or exempts members — the audit sink is scoped down
+id: WGC503
+severity: error
+category: post-synth
+lexicon: gcp
+docs: https://intentius.io/chant/lexicons/gcp/rules/
+---
+IAMAuditConfig captures nothing or exempts members — the audit sink is scoped down
+
+## Applies to
+
+- [IAMAuditConfig](/types/IAMAuditConfig.md)

package/dist/okf/types/API.md

@@ -0,0 +1,21 @@
+---
+type: resource-type
+title: API
+description: gcp resource type GCP::Apigateway::API
+name: API
+lexicon: gcp
+resource_type: GCP::Apigateway::API
+---
+`GCP::Apigateway::API`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`
+
+## Governed by
+
+- [WGC113](/rules/WGC113.md): Config Connector resource uses an alpha API version
+- [WGC302](/rules/WGC302.md): No Service resource found — GCP APIs may not be explicitly enabled
+- [WGC501](/rules/WGC501.md): Org Policy guardrail not enforced — a disabled policy constrains nothing

package/dist/okf/types/APIConfig.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: APIConfig
+description: gcp resource type GCP::Apigateway::APIConfig
+name: APIConfig
+lexicon: gcp
+resource_type: GCP::Apigateway::APIConfig
+---
+`GCP::Apigateway::APIConfig`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/APIQuotaAdjusterSettings.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: APIQuotaAdjusterSettings
+description: gcp resource type GCP::Cloudquota::APIQuotaAdjusterSettings
+name: APIQuotaAdjusterSettings
+lexicon: gcp
+resource_type: GCP::Cloudquota::APIQuotaAdjusterSettings
+---
+`GCP::Cloudquota::APIQuotaAdjusterSettings`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/APIQuotaPreference.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: APIQuotaPreference
+description: gcp resource type GCP::Cloudquota::APIQuotaPreference
+name: APIQuotaPreference
+lexicon: gcp
+resource_type: GCP::Cloudquota::APIQuotaPreference
+---
+`GCP::Cloudquota::APIQuotaPreference`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AccessBoundaryPolicy.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AccessBoundaryPolicy
+description: gcp resource type GCP::Iam::AccessBoundaryPolicy
+name: AccessBoundaryPolicy
+lexicon: gcp
+resource_type: GCP::Iam::AccessBoundaryPolicy
+---
+`GCP::Iam::AccessBoundaryPolicy`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AccessLevel.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AccessLevel
+description: gcp resource type GCP::Accesscontextmanager::AccessLevel
+name: AccessLevel
+lexicon: gcp
+resource_type: GCP::Accesscontextmanager::AccessLevel
+---
+`GCP::Accesscontextmanager::AccessLevel`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AccessLevelCondition.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AccessLevelCondition
+description: gcp resource type GCP::Accesscontextmanager::AccessLevelCondition
+name: AccessLevelCondition
+lexicon: gcp
+resource_type: GCP::Accesscontextmanager::AccessLevelCondition
+---
+`GCP::Accesscontextmanager::AccessLevelCondition`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AccessPolicy.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AccessPolicy
+description: gcp resource type GCP::Accesscontextmanager::AccessPolicy
+name: AccessPolicy
+lexicon: gcp
+resource_type: GCP::Accesscontextmanager::AccessPolicy
+---
+`GCP::Accesscontextmanager::AccessPolicy`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AddonsConfig.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AddonsConfig
+description: gcp resource type GCP::Apigee::AddonsConfig
+name: AddonsConfig
+lexicon: gcp
+resource_type: GCP::Apigee::AddonsConfig
+---
+`GCP::Apigee::AddonsConfig`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AgentPool.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AgentPool
+description: gcp resource type GCP::Storagetransfer::AgentPool
+name: AgentPool
+lexicon: gcp
+resource_type: GCP::Storagetransfer::AgentPool
+---
+`GCP::Storagetransfer::AgentPool`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AiplatformModel.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AiplatformModel
+description: gcp resource type GCP::Aiplatform::Model
+name: AiplatformModel
+lexicon: gcp
+resource_type: GCP::Aiplatform::Model
+---
+`GCP::Aiplatform::Model`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AistreamsCluster.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AistreamsCluster
+description: gcp resource type GCP::Aistreams::Cluster
+name: AistreamsCluster
+lexicon: gcp
+resource_type: GCP::Aistreams::Cluster
+---
+`GCP::Aistreams::Cluster`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AlertPolicy.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AlertPolicy
+description: gcp resource type GCP::Monitoring::AlertPolicy
+name: AlertPolicy
+lexicon: gcp
+resource_type: GCP::Monitoring::AlertPolicy
+---
+`GCP::Monitoring::AlertPolicy`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AlloydbBackup.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AlloydbBackup
+description: gcp resource type GCP::Alloydb::Backup
+name: AlloydbBackup
+lexicon: gcp
+resource_type: GCP::Alloydb::Backup
+---
+`GCP::Alloydb::Backup`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AlloydbCluster.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AlloydbCluster
+description: gcp resource type GCP::Alloydb::Cluster
+name: AlloydbCluster
+lexicon: gcp
+resource_type: GCP::Alloydb::Cluster
+---
+`GCP::Alloydb::Cluster`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/AlloydbInstance.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: AlloydbInstance
+description: gcp resource type GCP::Alloydb::Instance
+name: AlloydbInstance
+lexicon: gcp
+resource_type: GCP::Alloydb::Instance
+---
+`GCP::Alloydb::Instance`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`