Update yaml org policies

blueprints/data-solutions/shielded-folder/data/org-policies/compute.yaml

@@ -3,71 +3,90 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 compute.disableGuestAttributesAccess:
-  enforce: true
+  rules:
+  - enforce: true
 
 compute.requireOsLogin:
-  enforce: true
+  rules:
+  - enforce: true
 
 compute.restrictLoadBalancerCreationForTypes:
-  allow:
+  rules:
-    values:
+  - allow:
-    - in:INTERNAL
+      values:
+      - in:INTERNAL
 
 compute.skipDefaultNetworkCreation:
-  enforce: true
+  rules:
+  - enforce: true
 
 compute.vmExternalIpAccess:
-  deny:
+  rules:
-    all: true
+  - deny:
+      all: true
 
 
 # compute.disableInternetNetworkEndpointGroup:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.disableNestedVirtualization:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.disableSerialPortAccess:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.restrictCloudNATUsage:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictDedicatedInterconnectUsage:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictPartnerInterconnectUsage:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictProtocolForwardingCreationForTypes:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictSharedVpcHostProjects:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictSharedVpcSubnetworks:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictVpcPeering:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictVpnPeerIPs:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictXpnProjectLienRemoval:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.setNewProjectDefaultToZonalDNSOnly:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.vmCanIpForward:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true

blueprints/data-solutions/shielded-folder/data/org-policies/iam.yaml

@@ -3,10 +3,13 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 iam.automaticIamGrantsForDefaultServiceAccounts:
-  enforce: true
+  rules:
+  - enforce: true
 
 iam.disableServiceAccountKeyCreation:
-  enforce: true
+  rules:
+  - enforce: true
 
 iam.disableServiceAccountKeyUpload:
-  enforce: true
+  rules:
+  - enforce: true

blueprints/data-solutions/shielded-folder/data/org-policies/serverless.yaml

@@ -3,24 +3,29 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 run.allowedIngress:
-  allow:
+  rules:
-    values:
+  - allow:
-    - is:internal
+      values:
+      - is:internal
 
 # run.allowedVPCEgress:
-#   allow:
+#   rules:
-#     values:
+#   - allow:
+#       values:
 #       - is:private-ranges-only
 
 # cloudfunctions.allowedIngressSettings:
-#   allow:
+#   rules:
-#     values:
+#   - allow:
-#     - is:ALLOW_INTERNAL_ONLY
+#       values:
+#       - is:ALLOW_INTERNAL_ONLY
 
 # cloudfunctions.allowedVpcConnectorEgressSettings:
-#   allow:
+#   rules:
-#     values:
+#   - allow:
-#     - is:PRIVATE_RANGES_ONLY
+#       values:
+#       - is:PRIVATE_RANGES_ONLY
 
 # cloudfunctions.requireVPCConnector:
-#   enforce: true
+#   rules:
+#   - enforce: true

blueprints/data-solutions/shielded-folder/data/org-policies/sql.yaml

@@ -3,7 +3,9 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 sql.restrictAuthorizedNetworks:
-  enforce: true
+  rules:
+  - enforce: true
 
 sql.restrictPublicIp:
-  enforce: true
+  rules:
+  - enforce: true

blueprints/data-solutions/shielded-folder/data/org-policies/storage.yaml

@@ -3,4 +3,5 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 storage.uniformBucketLevelAccess:
-  enforce: true
+  rules:
+  - enforce: true

fast/stages-multitenant/1-resman-tenant/data/org-policies/compute.yaml

@@ -3,71 +3,90 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 compute.disableGuestAttributesAccess:
-  enforce: true
+  rules:
+  - enforce: true
 
 compute.requireOsLogin:
-  enforce: true
+  rules:
+  - enforce: true
 
 compute.restrictLoadBalancerCreationForTypes:
-  allow:
+  rules:
-    values:
+  - allow:
-    - in:INTERNAL
+      values:
+      - in:INTERNAL
 
 compute.skipDefaultNetworkCreation:
-  enforce: true
+  rules:
+  - enforce: true
 
 compute.vmExternalIpAccess:
-  deny:
+  rules:
-    all: true
+  - deny:
+      all: true
 
 
 # compute.disableInternetNetworkEndpointGroup:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.disableNestedVirtualization:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.disableSerialPortAccess:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.restrictCloudNATUsage:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictDedicatedInterconnectUsage:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictPartnerInterconnectUsage:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictProtocolForwardingCreationForTypes:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictSharedVpcHostProjects:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictSharedVpcSubnetworks:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictVpcPeering:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictVpnPeerIPs:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictXpnProjectLienRemoval:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.setNewProjectDefaultToZonalDNSOnly:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.vmCanIpForward:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true

fast/stages-multitenant/1-resman-tenant/data/org-policies/iam.yaml

@@ -3,10 +3,13 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 iam.automaticIamGrantsForDefaultServiceAccounts:
-  enforce: true
+  rules:
+  - enforce: true
 
 iam.disableServiceAccountKeyCreation:
-  enforce: true
+  rules:
+  - enforce: true
 
 iam.disableServiceAccountKeyUpload:
-  enforce: true
+  rules:
+  - enforce: true

fast/stages-multitenant/1-resman-tenant/data/org-policies/serverless.yaml

@@ -3,24 +3,29 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 run.allowedIngress:
-  allow:
+  rules:
-    values:
+  - allow:
-    - is:internal
+      values:
+      - is:internal
 
 # run.allowedVPCEgress:
-#   allow:
+#   rules:
-#     values:
+#   - allow:
+#       values:
 #       - is:private-ranges-only
 
 # cloudfunctions.allowedIngressSettings:
-#   allow:
+#   rules:
-#     values:
+#   - allow:
-#     - is:ALLOW_INTERNAL_ONLY
+#       values:
+#       - is:ALLOW_INTERNAL_ONLY
 
 # cloudfunctions.allowedVpcConnectorEgressSettings:
-#   allow:
+#   rules:
-#     values:
+#   - allow:
-#     - is:PRIVATE_RANGES_ONLY
+#       values:
+#       - is:PRIVATE_RANGES_ONLY
 
 # cloudfunctions.requireVPCConnector:
-#   enforce: true
+#   rules:
+#   - enforce: true

fast/stages-multitenant/1-resman-tenant/data/org-policies/storage.yaml

@@ -3,4 +3,5 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 storage.uniformBucketLevelAccess:
-  enforce: true
+  rules:
+  - enforce: true

fast/stages/1-resman/data/org-policies/compute.yaml

@@ -3,71 +3,90 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 compute.disableGuestAttributesAccess:
-  enforce: true
+  rules:
+  - enforce: true
 
 compute.requireOsLogin:
-  enforce: true
+  rules:
+  - enforce: true
 
 compute.restrictLoadBalancerCreationForTypes:
-  allow:
+  rules:
-    values:
+  - allow:
-    - in:INTERNAL
+      values:
+      - in:INTERNAL
 
 compute.skipDefaultNetworkCreation:
-  enforce: true
+  rules:
+  - enforce: true
 
 compute.vmExternalIpAccess:
-  deny:
+  rules:
-    all: true
+  - deny:
+      all: true
 
 
 # compute.disableInternetNetworkEndpointGroup:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.disableNestedVirtualization:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.disableSerialPortAccess:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.restrictCloudNATUsage:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictDedicatedInterconnectUsage:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictPartnerInterconnectUsage:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictProtocolForwardingCreationForTypes:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictSharedVpcHostProjects:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictSharedVpcSubnetworks:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictVpcPeering:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictVpnPeerIPs:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true
 
 # compute.restrictXpnProjectLienRemoval:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.setNewProjectDefaultToZonalDNSOnly:
-#   enforce: true
+#   rules:
+#   - enforce: true
 
 # compute.vmCanIpForward:
-#   deny:
+#   rules:
-#     all: true
+#   - deny:
+#       all: true

fast/stages/1-resman/data/org-policies/iam.yaml

@@ -3,10 +3,13 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 iam.automaticIamGrantsForDefaultServiceAccounts:
-  enforce: true
+  rules:
+  - enforce: true
 
 iam.disableServiceAccountKeyCreation:
-  enforce: true
+  rules:
+  - enforce: true
 
 iam.disableServiceAccountKeyUpload:
-  enforce: true
+  rules:
+  - enforce: true

fast/stages/1-resman/data/org-policies/serverless.yaml

@@ -3,24 +3,29 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 run.allowedIngress:
-  allow:
+  rules:
-    values:
+  - allow:
-    - is:internal
+      values:
+      - is:internal
 
 # run.allowedVPCEgress:
-#   allow:
+#   rules:
-#     values:
+#   - allow:
+#       values:
 #       - is:private-ranges-only
 
 # cloudfunctions.allowedIngressSettings:
-#   allow:
+#   rules:
-#     values:
+#   - allow:
-#     - is:ALLOW_INTERNAL_ONLY
+#       values:
+#       - is:ALLOW_INTERNAL_ONLY
 
 # cloudfunctions.allowedVpcConnectorEgressSettings:
-#   allow:
+#   rules:
-#     values:
+#   - allow:
-#     - is:PRIVATE_RANGES_ONLY
+#       values:
+#       - is:PRIVATE_RANGES_ONLY
 
 # cloudfunctions.requireVPCConnector:
-#   enforce: true
+#   rules:
+#   - enforce: true

fast/stages/1-resman/data/org-policies/sql.yaml

@@ -3,7 +3,9 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 sql.restrictAuthorizedNetworks:
-  enforce: true
+  rules:
+  - enforce: true
 
 sql.restrictPublicIp:
-  enforce: true
+  rules:
+  - enforce: true

fast/stages/1-resman/data/org-policies/storage.yaml

@@ -3,4 +3,5 @@
 # sample subset of useful organization policies, edit to suit requirements
 
 storage.uniformBucketLevelAccess:
-  enforce: true
+  rules:
+  - enforce: true

tests/modules/project/org_policies_list.tfvars

@@ -11,7 +11,6 @@ org_policies = {
     }]
   }
   "compute.restrictLoadBalancerCreationForTypes" = {
-
     rules = [
       {
         condition = {