NIST SP 800-53 - Google Cloud

import * as gcp from "@pulumi/gcp";

// Create a KMS key for endpoint encryption
const keyRing = new gcp.kms.KeyRing("ai-keyring", {
    location: "us-central1",
});

const cryptoKey = new gcp.kms.CryptoKey("ai-endpoint-key", {
    keyRing: keyRing.id,
    rotationPeriod: "7776000s", // 90 days
});

// Create an AI Platform endpoint with CMEK
const endpoint = new gcp.vertex.AiEndpoint("my-endpoint", {
    location: "us-central1",
    displayName: "My Secure Endpoint",
    // Configure customer-managed encryption key
    encryptionSpec: {
        kmsKeyName: cryptoKey.id,
    },
});

import * as gcp from "@pulumi/gcp";

// Create a KMS key for notebook encryption
const keyRing = new gcp.kms.KeyRing("notebook-keyring", {
    location: "us-central1",
});

const cryptoKey = new gcp.kms.CryptoKey("notebook-key", {
    keyRing: keyRing.id,
    rotationPeriod: "7776000s", // 90 days
});

// Option 1: Notebook Instance with CMEK
const notebookInstance = new gcp.notebooks.Instance("my-notebook", {
    location: "us-central1-a",
    machineType: "n1-standard-4",
    // Configure customer-managed encryption key
    kmsKey: cryptoKey.id,
    vmImage: {
        project: "deeplearning-platform-release",
        imageFamily: "tf-latest-cpu",
    },
});

// Option 2: Notebook Runtime with CMEK
const notebookRuntime = new gcp.notebooks.Runtime("my-runtime", {
    location: "us-central1",
    virtualMachine: {
        virtualMachineConfig: {
            machineType: "n1-standard-4",
            dataDisk: {
                initializeParams: {
                    diskSizeGb: 100,
                    diskType: "PD_STANDARD",
                },
            },
            // Configure customer-managed encryption key
            encryptionConfig: {
                kmsKey: cryptoKey.id,
            },
        },
    },
});

import * as gcp from "@pulumi/gcp";

const notebook = new gcp.notebooks.Instance("my-notebook", {
    location: "us-central1-a",
    machineType: "n1-standard-4",
    // Disable public IP to prevent direct internet access
    noPublicIp: true,
    // Deploy in a VPC subnet for network isolation
    network: "projects/my-project/global/networks/my-vpc",
    subnet: "projects/my-project/regions/us-central1/subnetworks/my-subnet",
    // Configure boot disk
    vmImage: {
        project: "deeplearning-platform-release",
        imageFamily: "tf-latest-cpu",
    },
});

import * as gcp from "@pulumi/gcp";

// Step 1: Create service account
const apiGatewaySA = new gcp.serviceaccount.Account("api-gateway-sa", {
    accountId: "api-gateway-sa",
    displayName: "API Gateway Service Account",
});

// Step 2: Grant backend access permissions
const invokerBinding = new gcp.iam.Member("api-gateway-invoker", {
    project: "my-project",
    role: "roles/run.invoker",  // Or roles/cloudfunctions.invoker for Cloud Functions
    member: apiGatewaySA.member,
});

// Step 3: Configure API Gateway with service account
const apiConfig = new gcp.apigateway.ApiConfig("my-api-config", {
    api: api.id,
    apiConfigId: "my-config",
    gatewayConfig: {
        backendConfig: {
            googleServiceAccount: apiGatewaySA.email,  // Critical for logging
        },
    },
    openapiDocuments: [{
        document: {
            path: "openapi.yaml",
            contents: pulumi.asset.StringAsset(openapiSpec),
        },
    }],
});

// Step 4: Enable audit logging
const auditConfig = new gcp.projects.IAMAuditConfig("api-gateway-audit", {
    project: "my-project",
    service: "apigateway.googleapis.com",
    auditLogConfigs: [
        { logType: "ADMIN_READ" },
        { logType: "DATA_READ" },
        { logType: "DATA_WRITE" },
    ],
});

import * as gcp from "@pulumi/gcp";

// COMPLIANT: Standard App Version with automatic scaling
const app = new gcp.appengine.StandardAppVersion("app-auto-scaled", {
  service: "myapp",
  runtime: "nodejs20",
  versionId: "v1",
  entrypoint: { shell: "node ./app.js" },
  deployment: {
    zip: { sourceUrl: "https://storage.googleapis.com/bucket/app.zip" },
  },
  automaticScaling: {
    maxConcurrentRequests: 10,
    minIdleInstances: 1,
    maxIdleInstances: 3,
  },
});

// NON-COMPLIANT: Manual scaling prevents managed updates
// manualScaling: { instances: 3 }  // Don't use this

// NON-COMPLIANT: Basic scaling limits managed updates
// basicScaling: { maxInstances: 5 }  // Don't use this

const repository = new gcp.artifactregistry.Repository("my-repository", {
    repositoryId: "my-repo",
    format: "DOCKER",
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Specify customer-managed KMS key
    // ... other config
});

const repository = new gcp.artifactregistry.Repository("my-repository", {
    repositoryId: "my-repo",
    format: "DOCKER",
    dockerConfig: {
        immutableTags: true,  // Prevent tag overwrites to ensure image integrity
    },
    // ... other config
});

import * as gcp from "@pulumi/gcp";

const bigQueryAuditConfig = new gcp.projects.IAMAuditConfig("bigquery-audit", {
    project: "your-project-id",
    service: "bigquery.googleapis.com",
    auditLogConfigs: [
        { logType: "DATA_READ" },
        { logType: "DATA_WRITE" },
        { logType: "ADMIN_READ" }
    ]
});

const bigQueryLogSink = new gcp.logging.ProjectSink("bigquery-logs", {
    destination: "storage.googleapis.com/my-audit-logs-bucket",
    filter: 'protoPayload.serviceName="bigquery.googleapis.com"',
    uniqueWriterIdentity: true
});

import * as gcp from "@pulumi/gcp";

const dataset = new gcp.bigquery.Dataset("secure-dataset", {
    datasetId: "my_dataset",
    location: "US",
    accesses: [
        {
            role: "READER",
            userByEmail: "analyst@example.com"
        },
        {
            role: "roles/bigquery.dataEditor",
            userByEmail: serviceAccount.email
        }
        // Do NOT include allUsers or allAuthenticatedUsers
    ]
});

// Using IAM binding for specific members only
const datasetViewer = new gcp.bigquery.DatasetIamBinding("dataset-viewer", {
    datasetId: dataset.datasetId,
    role: "roles/bigquery.dataViewer",
    members: [
        "user:jane@example.com",
        "serviceAccount:myapp@project.iam.gserviceaccount.com"
        // Do NOT use allUsers or allAuthenticatedUsers
    ]
});

import * as gcp from "@pulumi/gcp";

const dataset = new gcp.bigquery.Dataset("my-dataset", {
  datasetId: "my_dataset",
  description: "Dataset purpose and maintenance requirements",
  defaultTableExpirationMs: 7776000000, // 90 days
  defaultPartitionExpirationMs: 7776000000,
  labels: {
    environment: "production",
    dataRetention: "90days",
  },
});

const bigtableTable = new gcp.bigtable.Table("my-table", {
    instanceName: "my-bigtable-instance",
    changeStreamRetention: "72h0m0s",  // Enable change streams with 3-day retention
    // ... other config
});

const bucketIamPolicy = new gcp.storage.BucketIAMPolicy("bucket-iam", {
    bucket: bucket.name,
    policyData: JSON.stringify({
        bindings: [
            {
                role: "roles/storage.objectViewer",
                members: [
                    "serviceAccount:service-{project-number}@dlp-api.iam.gserviceaccount.com",  // Grant DLP service account access
                ],
            },
            // ... other bindings
        ],
    }),
});

// Instead of overly broad roles like storage.admin or storage.objectAdmin
// Use specific roles based on actual needs:

// For read-only access
const viewerBinding = new gcp.storage.BucketIAMBinding("viewer-binding", {
    bucket: bucket.name,
    role: "roles/storage.objectViewer",  // Read-only access to objects
    members: ["user:viewer@example.com"],
});

// For write-only access
const creatorBinding = new gcp.storage.BucketIAMBinding("creator-binding", {
    bucket: bucket.name,
    role: "roles/storage.objectCreator",  // Write-only access (no read)
    members: ["serviceAccount:app@project.iam.gserviceaccount.com"],
});

// Avoid these overly broad roles:
// - roles/storage.admin
// - roles/storage.objectAdmin
// - roles/owner
// - roles/editor

const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    lifecycleRules: [
        {
            action: {
                type: "Delete",  // Delete old objects
            },
            condition: {
                age: 365,  // After 365 days
            },
        },
        {
            action: {
                type: "SetStorageClass",
                storageClass: "NEARLINE",  // Archive to cheaper storage
            },
            condition: {
                age: 90,  // After 90 days
            },
        },
    ],
    // ... other config
});

// Option 1: Use multi-region location
const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",  // Multi-region location (US, EU, or ASIA)
    // ... other config
});

// Option 2: Use dual-region location
const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "NAM4",  // Dual-region location
    // ... other config
});

// Option 3: Use custom placement with multiple data locations
const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    customPlacementConfig: {
        dataLocations: ["US-EAST1", "US-WEST1"],  // Specify at least 2 regions
    },
    // ... other config
});

import * as gcp from "@pulumi/gcp";

// RECOMMENDED: Managed certificate with automatic renewal via DNS
const managedDnsCert = new gcp.certificatemanager.Certificate("managed-dns-cert", {
    name: "managed-dns-cert",
    description: "Auto-renewed certificate via DNS authorization",
    managed: {
        domains: ["example.com", "www.example.com"],
        dnsAuthorizations: [dnsAuthResource.id]
    }
});

// RECOMMENDED: Managed certificate with automatic renewal via Load Balancer
const managedLbCert = new gcp.certificatemanager.Certificate("managed-lb-cert", {
    name: "managed-lb-cert",
    description: "Auto-renewed certificate via Load Balancer",
    managed: {
        domains: ["api.example.com"]
        // No dnsAuthorizations needed for Load Balancer authorization
    }
});

// NOT RECOMMENDED: Self-managed certificate requires manual renewal
const selfManagedCert = new gcp.certificatemanager.Certificate("self-managed-cert", {
    name: "custom-cert",
    selfManaged: {
        pemCertificate: certPem,
        pemPrivateKey: keyPem
    }
});

import * as gcp from "@pulumi/gcp";

// Step 1: Create Cloud Armor security policy
const securityPolicy = new gcp.compute.SecurityPolicy("security-policy", {
    name: "my-security-policy",
    rules: [{
        action: "deny(403)",
        priority: 1000,
        match: {
            versionedExpr: "SRC_IPS_V1",
            config: {
                srcIpRanges: ["192.168.1.0/24"]
            }
        }
    }]
});

// Step 2: CRITICAL - Attach to backend service with logging enabled
const backend = new gcp.compute.BackendService("backend", {
    name: "backend-service",
    securityPolicy: securityPolicy.selfLink,
    logConfig: {
        enable: true,        // REQUIRED for Cloud Armor logging
        sampleRate: 1.0      // 1.0 = 100% logging, 0.5 = 50% sampling
    }
});

import * as gcp from "@pulumi/gcp";

// COMPLIANT: Enable data access logging for all services
const auditConfigAll = new gcp.projects.IAMAuditConfig("audit-all-services", {
    project: "my-project-id",
    service: "allServices",  // Apply to all GCP services
    auditLogConfigs: [
        {
            logType: "ADMIN_READ"  // Administrative read operations
        },
        {
            logType: "DATA_READ",  // Compliant: Data read logging enabled
            exemptedMembers: []  // No exemptions
        },
        {
            logType: "DATA_WRITE"  // Compliant: Data write logging enabled
        }
    ]
});

// COMPLIANT: Enable data access logging for specific services
const auditConfigStorage = new gcp.projects.IAMAuditConfig("audit-storage", {
    project: "my-project-id",
    service: "storage.googleapis.com",
    auditLogConfigs: [
        {
            logType: "DATA_READ",  // Compliant: Monitor bucket/object reads
            exemptedMembers: ["user:admin@example.com"]  // Optional exemptions
        },
        {
            logType: "DATA_WRITE"  // Compliant: Monitor bucket/object writes
        }
    ]
});

const auditConfigBigQuery = new gcp.projects.IAMAuditConfig("audit-bigquery", {
    project: "my-project-id",
    service: "bigquery.googleapis.com",
    auditLogConfigs: [
        {
            logType: "DATA_READ"   // Compliant: Monitor query operations
        },
        {
            logType: "DATA_WRITE"  // Compliant: Monitor data modifications
        }
    ]
});

// NON-COMPLIANT: Only ADMIN_READ enabled, missing data access logging
const auditConfigIncomplete = new gcp.projects.IAMAuditConfig("audit-incomplete", {
    project: "my-project-id",
    service: "allServices",
    auditLogConfigs: [
        {
            logType: "ADMIN_READ"  // Only admin operations logged
            // Missing DATA_READ and DATA_WRITE
        }
    ]
});

// NON-COMPLIANT: No audit configuration at all
// (missing IAMAuditConfig resource)

const trigger = new cloudbuild.Trigger("my-trigger", {
    build: {
        logsBucket: "gs://my-logs-bucket/build-logs",  // Configure centralized logs bucket
        options: {
            logging: "CLOUD_LOGGING_ONLY",  // Use Cloud Logging for audit trails
        },
        // ... other config
    },
    // ... other config
});

import * as gcp from "@pulumi/gcp";

// COMPLIANT: Using Secret Manager references
const compliantTrigger = new gcp.cloudbuild.Trigger("compliant-trigger", {
    location: "us-central1",
    triggerTemplate: {
        branchName: "main",
        repoName: "my-repo",
    },
    substitutions: {
        _ENV: "production",
        _REGION: "us-central1",
    },
    filename: "cloudbuild.yaml",
});

// NON-COMPLIANT: Storing credentials in substitutions
const badTrigger = new gcp.cloudbuild.Trigger("bad-trigger", {
    location: "us-central1",
    triggerTemplate: {
        branchName: "main",
        repoName: "my-repo",
    },
    substitutions: {
        _GCP_API_KEY: "AIzaSyD...", // Violates policy
        _SERVICE_ACCOUNT_KEY: '{"type":"service_account",...}', // Violates policy
    },
    filename: "cloudbuild.yaml",
});

// NON-COMPLIANT: Storing credentials in build options
const badTriggerWithEnvs = new gcp.cloudbuild.Trigger("bad-trigger-envs", {
    name: "my-trigger",
    build: {
        options: {
            envs: [
                "ENV = production",
                "GCP_CREDENTIALS = {...}", // Violates policy
            ],
        },
        steps: [{
            name: "gcr.io/cloud-builders/gcloud",
            args: ["version"],
        }],
    },
});

import * as gcp from "@pulumi/gcp";

// COMPLIANT: Using HTTPS protocol
const compliantTrigger = new gcp.cloudbuild.Trigger("compliant-trigger", {
    name: "my-trigger",
    location: "us-central1",
    sourceToBuild: {
        uri: "https://github.com/my-org/my-repo", // Secure HTTPS
        ref: "refs/heads/main",
        repoType: "GITHUB",
    },
    filename: "cloudbuild.yaml",
});

// COMPLIANT: Using SSH protocol
const compliantSshTrigger = new gcp.cloudbuild.Trigger("compliant-ssh-trigger", {
    name: "my-ssh-trigger",
    location: "us-central1",
    sourceToBuild: {
        uri: "git@github.com:my-org/my-repo.git", // Secure SSH
        ref: "refs/heads/main",
        repoType: "GITHUB",
    },
    filename: "cloudbuild.yaml",
});

// NON-COMPLIANT: Using insecure HTTP protocol
const badTrigger = new gcp.cloudbuild.Trigger("bad-trigger", {
    name: "bad-trigger",
    location: "us-central1",
    sourceToBuild: {
        uri: "http://github.com/my-org/my-repo", // Violates policy - insecure HTTP
        ref: "refs/heads/main",
        repoType: "GITHUB",
    },
    filename: "cloudbuild.yaml",
});

// NON-COMPLIANT: Using insecure git:// protocol
const badGitTrigger = new gcp.cloudbuild.Trigger("bad-git-trigger", {
    name: "bad-git-trigger",
    location: "us-central1",
    sourceToBuild: {
        uri: "git://github.com/my-org/my-repo.git", // Violates policy - insecure git://
        ref: "refs/heads/main",
        repoType: "GITHUB",
    },
    filename: "cloudbuild.yaml",
});

// Create a Cloud Armor security policy
const securityPolicy = new gcp.compute.SecurityPolicy("cdn-security-policy", {
    rules: [{
        action: "deny(403)",
        priority: 1000,
        match: {
            versionedExpr: "SRC_IPS_V1",
            config: {
                srcIpRanges: ["9.9.9.0/24"],
            },
        },
        description: "Deny access to example IP range",
    }],
});

// For BackendService: attach security policy
const backendService = new gcp.compute.BackendService("cdn-backend", {
    enableCdn: true,
    securityPolicy: securityPolicy.id,  // Attach Cloud Armor policy for DDoS protection
    // ... other config
});

// For BackendBucket: attach edge security policy
const backendBucket = new gcp.compute.BackendBucket("cdn-bucket-backend", {
    enableCdn: true,
    edgeSecurityPolicy: securityPolicy.id,  // Attach Cloud Armor policy for DDoS protection
    // ... other config
});

import * as gcp from "@pulumi/gcp";

// Create a backend service with Cloud CDN enabled and logging configured
const backendService = new gcp.compute.BackendService("my-backend", {
    name: "my-backend-service",
    protocol: "HTTP",
    timeoutSec: 30,
    // Enable Cloud CDN
    enableCdn: true,
    // Configure CDN policy
    cdnPolicy: {
        cacheMode: "CACHE_ALL_STATIC",
        defaultTtl: 3600,
        clientTtl: 7200,
        maxTtl: 86400,
        negativeCaching: true,
    },
    // Enable logging for Cloud CDN
    logConfig: {
        enable: true,
        sampleRate: 1.0, // Log 100% of requests (adjust based on traffic volume)
    },
    backends: [{
        group: instanceGroup.id,
        balancingMode: "UTILIZATION",
        capacityScaler: 1.0,
    }],
    healthChecks: [healthCheck.id],
});

const backendService = new gcp.compute.BackendService("cdn-backend", {
    enableCdn: true,
    protocol: "HTTPS",  // Use HTTPS for secure communication to origin
    // ... other config
});

import * as gcp from "@pulumi/gcp";

// COMPLIANT: Firestore Native mode with OPTIMISTIC concurrency (automatic scaling)
const databaseCompliant = new gcp.firestore.Database("native-optimistic", {
    name: "production-db",
    locationId: "nam5",  // Multi-region for better availability
    type: "FIRESTORE_NATIVE",  // Compliant: has automatic scaling
    concurrencyMode: "OPTIMISTIC",  // Compliant: best for scalability
    appEngineIntegrationMode: "DISABLED",
    deleteProtectionState: "DELETE_PROTECTION_ENABLED",
    pointInTimeRecoveryEnablement: "POINT_IN_TIME_RECOVERY_ENABLED"
});

// NON-COMPLIANT: Firestore Native with PESSIMISTIC concurrency
const databasePessimistic = new gcp.firestore.Database("native-pessimistic", {
    name: "db-pessimistic",
    locationId: "us-central1",
    type: "FIRESTORE_NATIVE",
    concurrencyMode: "PESSIMISTIC",  // Non-compliant: can limit throughput
    appEngineIntegrationMode: "DISABLED"
});

// NON-COMPLIANT: Datastore mode instead of Native mode
const databaseDatastore = new gcp.firestore.Database("datastore-mode", {
    name: "datastore-db",
    locationId: "us-central1",
    type: "DATASTORE_MODE"  // Non-compliant: Native mode recommended for enhanced scaling
});

// NON-COMPLIANT: Single-region without multi-region availability
const databaseSingleRegion = new gcp.firestore.Database("single-region", {
    name: "single-region-db",
    locationId: "us-west1",  // Non-compliant: not multi-region
    type: "FIRESTORE_NATIVE"
});

import * as gcp from "@pulumi/gcp";

// COMPLIANT: Firestore database with PITR and backup schedule
const database = new gcp.firestore.Database("production-db", {
    name: "production-db",
    locationId: "nam5",
    type: "FIRESTORE_NATIVE",
    pointInTimeRecoveryEnablement: "POINT_IN_TIME_RECOVERY_ENABLED",  // Compliant
    deleteProtectionState: "DELETE_PROTECTION_ENABLED"
});

const backupSchedule = new gcp.firestore.BackupSchedule("daily-backup", {
    database: database.name,
    retention: "30d",  // Compliant: adequate retention period
    dailyRecurrence: {}  // Compliant: daily backups configured
});

// NON-COMPLIANT: Database without backup schedule
const databaseNoBackup = new gcp.firestore.Database("no-backup-db", {
    name: "test-db",
    locationId: "us-central1",
    type: "FIRESTORE_NATIVE",
    pointInTimeRecoveryEnablement: "POINT_IN_TIME_RECOVERY_DISABLED"  // Non-compliant
    // Missing backup schedule
});

// NON-COMPLIANT: Backup schedule with insufficient retention
const shortRetentionBackup = new gcp.firestore.BackupSchedule("short-backup", {
    database: database.name,
    retention: "3d",  // Non-compliant: less than 7 days
    dailyRecurrence: {}
});

// NON-COMPLIANT: Backup schedule without recurrence
const noRecurrenceBackup = new gcp.firestore.BackupSchedule("no-recurrence", {
    database: database.name,
    retention: "30d"
    // Missing dailyRecurrence or weeklyRecurrence
});

import * as gcp from "@pulumi/gcp";

// COMPLIANT: 1st gen function with maxInstances configured
const functionV1 = new gcp.cloudfunctions.Function("my-function-v1", {
    name: "example-function",
    runtime: "nodejs20",
    sourceArchiveBucket: bucket.name,
    sourceArchiveObject: archive.name,
    entryPoint: "helloWorld",
    triggerHttp: true,
    maxInstances: 10, // Limits concurrent instances
});

// COMPLIANT: 2nd gen function with concurrency settings
const functionV2 = new gcp.cloudfunctionsv2.Function("my-function-v2", {
    name: "example-function-v2",
    location: "us-central1",
    buildConfig: {
        runtime: "nodejs20",
        entryPoint: "helloWorld",
        source: {
            storageSource: {
                bucket: bucket.name,
                object: archive.name,
            },
        },
    },
    serviceConfig: {
        maxInstanceCount: 10,
        maxInstanceRequestConcurrency: 80, // For I/O-bound functions
    },
});

// NON-COMPLIANT: Missing maxInstances
const badFunction = new gcp.cloudfunctions.Function("bad-function", {
    name: "bad-example",
    runtime: "nodejs20",
    triggerHttp: true,
    // maxInstances not configured - violates policy
});

// Cloud Functions v1
new gcp.cloudfunctions.Function("my-function", {
  vpcConnector: "projects/my-project/locations/us-central1/connectors/my-connector",
  vpcConnectorEgressSettings: "ALL_TRAFFIC", // or "PRIVATE_RANGES_ONLY"
});

// Cloud Functions v2
new gcp.cloudfunctionsv2.Function("my-function-v2", {
  serviceConfig: {
    vpcConnector: "projects/my-project/locations/us-central1/connectors/my-connector",
    vpcConnectorEgressSettings: "ALL_TRAFFIC",
  },
});

import * as gcp from "@pulumi/gcp";

// COMPLIANT: Service with restricted ingress
const compliantService = new gcp.cloudrun.Service("compliant-service", {
    name: "secure-service",
    location: "us-central1",
    metadata: {
        annotations: {
            "run.googleapis.com/ingress": "internal-and-cloud-load-balancing",
        },
    },
    template: {
        spec: {
            containers: [{
                image: "gcr.io/my-project/my-image:latest",
            }],
        },
    },
});

// COMPLIANT: Grant access to specific user
const specificAccess = new gcp.cloudrun.IamMember("specific-access", {
    service: compliantService.name,
    location: compliantService.location,
    role: "roles/run.invoker",
    member: "user:jane@example.com",
});

// NON-COMPLIANT: Public access via IAM
const publicAccess = new gcp.cloudrun.IamMember("public-access", {
    service: compliantService.name,
    location: compliantService.location,
    role: "roles/run.invoker",
    member: "allUsers", // Violates policy
});

// NON-COMPLIANT: Service without ingress restrictions
const badService = new gcp.cloudrun.Service("bad-service", {
    name: "public-service",
    location: "us-central1",
    metadata: {
        annotations: {
            "run.googleapis.com/ingress": "all", // Violates policy
        },
    },
    template: {
        spec: {
            containers: [{
                image: "gcr.io/my-project/my-image:latest",
            }],
        },
    },
});

import * as gcp from "@pulumi/gcp";

// COMPLIANT: Enable Web Security Scanner API and configure scan
const scannerService = new gcp.projects.Service("scanner-api", {
    service: "websecurityscanner.googleapis.com"  // Compliant: API enabled
});

const scanConfig = new gcp.securityscanner.ScanConfig("web-scan", {
    displayName: "Production Web App Scan",
    startingUrls: ["https://myapp.example.com"],  // Compliant: URLs configured
    schedule: {
        scheduleTime: "0 2 * * *",  // Compliant: daily at 2 AM
        intervalDurationDays: 1
    },
    maxQps: 5,
    targetPlatforms: ["APP_ENGINE", "COMPUTE"]
}, { dependsOn: [scannerService] });

// NON-COMPLIANT: Web Security Scanner API not enabled
// (no gcp.projects.Service resource for websecurityscanner.googleapis.com)

// NON-COMPLIANT: Scanner API enabled but no scan configurations
const scannerServiceOnly = new gcp.projects.Service("scanner-only", {
    service: "websecurityscanner.googleapis.com"
    // Missing ScanConfig resources
});

// NON-COMPLIANT: Scan config without schedule
const scanConfigNoSchedule = new gcp.securityscanner.ScanConfig("no-schedule-scan", {
    displayName: "Manual Scan Only",
    startingUrls: ["https://app.example.com"]
    // Missing schedule - won't run automatically
});

// NON-COMPLIANT: Scan config without starting URLs
const scanConfigNoUrls = new gcp.securityscanner.ScanConfig("no-urls-scan", {
    displayName: "Incomplete Scan",
    schedule: {
        scheduleTime: "0 2 * * *"
    }
    // Missing startingUrls - scanner can't run
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        availabilityType: "REGIONAL",
    },
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    deletionProtection: true,
    settings: {
        tier: "db-f1-micro",
        backupConfiguration: {
            enabled: true,
            pointInTimeRecoveryEnabled: true,
        },
    },
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        ipConfiguration: {
            ipv4Enabled: false,
            privateNetwork: "projects/my-project/global/networks/my-vpc",
        },
    },
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("db-with-logging", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        databaseFlags: [
            { name: "log_connections", value: "on" },
            { name: "log_disconnections", value: "on" },
            { name: "log_checkpoints", value: "on" },
        ],
    },
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    encryptionKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",
    settings: {
        tier: "db-f1-micro",
    },
});

import * as gcp from "@pulumi/gcp";

const bucket = new gcp.storage.Bucket("secure-bucket", {
    location: "US",
    uniformBucketLevelAccess: true,
    publicAccessPrevention: "enforced",
});

// Do NOT add IAM bindings like this:
// new gcp.storage.BucketIAMMember("bad-binding", {
//     bucket: bucket.name,
//     role: "roles/storage.objectCreator",
//     member: "allUsers",  // NEVER use allUsers/allAuthenticatedUsers
// });

import * as gcp from "@pulumi/gcp";

const bucket = new gcp.storage.Bucket("versioned-bucket", {
    location: "US",
    versioning: {
        enabled: true,
    },
});

import * as gcp from "@pulumi/gcp";

const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    versioning: {
        enabled: true,
    },
});

const queue = new gcp.cloudtasks.Queue("my-queue", {
    retryConfig: {
        maxAttempts: 10,  // Set reasonable max retry attempts
        maxRetryDuration: "3600s",  // Set max retry duration (1 hour)
        minBackoff: "0.1s",
        maxBackoff: "3600s",
    },
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    description: "Processes customer orders from Pub/Sub and stores results in BigQuery",  // Add descriptive documentation
    labels: {
        purpose: "order-processing",  // Document function purpose
        team: "backend-team",  // Document ownership
        // ... other labels
    },
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    timeout: 60,  // Set reasonable timeout in seconds (max 540)
    // ... other config
});

// For Cloud Functions v2
const funcV2 = new gcp.cloudfunctionsv2.Function("my-function-v2", {
    serviceConfig: {
        timeoutSeconds: 60,  // Set reasonable timeout in seconds (max 540)
    },
    // ... other config
});

const iamMember = new gcp.cloudfunctions.FunctionIamMember("my-function-invoker", {
    cloudFunction: myFunction.name,
    role: "roles/cloudfunctions.invoker",
    member: "serviceAccount:my-service@project.iam.gserviceaccount.com",
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    environmentVariables: {
        API_KEY: "sensitive-value",
        DATABASE_URL: "postgres://...",
    },
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Add KMS key for encryption
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    environmentVariables: {
        LOG_FORMAT: "json",  // Enable structured logging
        LOG_LEVEL: "INFO",  // Set appropriate log level
    },
    labels: {
        "log-sink": "cloud-logging",  // Configure log sink
    },
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    runtime: "nodejs20",  // Use current supported runtime (e.g., nodejs20, python311, go121)
    // ... other config
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        backupConfiguration: {
            enabled: true,
            startTime: "03:00",
            pointInTimeRecoveryEnabled: true,
            backupRetentionSettings: {
                retainedBackups: 7,
                retentionUnit: "COUNT",
            },
        },
    },
});

const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        maintenanceWindow: {
            updateTrack: "stable",  // Use stable update track for patching
            day: 7,  // Saturday (1=Sunday, 7=Saturday)
            hour: 3,  // 3 AM
        },
        // ... other config
    },
});

// For Cloud SQL instance: Enable IAM authentication
const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        databaseFlags: [
            {
                name: "cloudsql_iam_authentication",
                value: "on",  // Enable IAM authentication
            },
        ],
        passwordValidationPolicy: {
            enablePasswordPolicy: true,  // Enable password validation
        },
        // ... other config
    },
    // Do not set rootPassword - use auto-generated or Secret Manager
});

// For Cloud SQL users: Use IAM-based authentication
const sqlUser = new gcp.sql.User("my-sql-user", {
    instance: sqlInstance.name,
    name: "user@example.com",
    type: "CLOUD_IAM_USER",  // Use IAM user type instead of built-in
    // Do not set password field for IAM users
});

const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        ipConfiguration: {
            sslMode: "ENCRYPTED_ONLY",  // Require SSL/TLS for all connections
            // ... other config
        },
    },
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.compute.Instance("monitored-instance", {
    machineType: "e2-medium",
    zone: "us-central1-a",
    shieldedInstanceConfig: {
        enableIntegrityMonitoring: true,
        enableVtpm: true,
    },
    metadata: {
        "enable-guest-attributes": "TRUE",
        "enable-oslogin": "TRUE",
    },
    bootDisk: { /* ... */ },
    networkInterfaces: [{ /* ... */ }],
});

new gcp.compute.Instance("my-instance", {
  networkInterfaces: [{
    network: customVpc.id,
    subnetwork: customSubnet.id,
    // Specify explicit VPC and subnet
  }],
  // ... other config
});

new gcp.compute.Instance("my-instance", {
  networkInterfaces: [{
    network: "my-vpc",
    subnetwork: "my-subnet",
    // accessConfigs: [], // Remove or set to empty array
  }],
  canIpForward: false,
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.compute.Instance("managed-instance", {
    machineType: "e2-medium",
    zone: "us-central1-a",
    metadata: {
        "enable-osconfig": "TRUE",  // REQUIRED: Enable OS Config management
    },
    bootDisk: {
        initializeParams: {
            image: "debian-cloud/debian-11",
        },
    },
    networkInterfaces: [{
        network: "default",
        accessConfigs: [{}],
    }],
});

import * as gcp from "@pulumi/gcp";

const productionInstance = new gcp.compute.Instance("prod-instance", {
    machineType: "e2-medium",
    zone: "us-central1-a",
    scheduling: {
        automaticRestart: true,         // Ensure high availability
        onHostMaintenance: "MIGRATE",   // Migrate during maintenance
        preemptible: false,             // Use standard instances for production
    },
    deletionProtection: true,           // Protect production resources
    bootDisk: {
        initializeParams: {
            image: "debian-cloud/debian-11",
            size: 100,
            type: "pd-ssd",             // Use SSD for production
        },
        autoDelete: false,              // Preserve data on instance deletion
    },
    networkInterfaces: [{
        network: "default",
        accessConfigs: [{}],
    }],
});

const tempInstance = new gcp.compute.Instance("temp-instance", {
    machineType: "e2-medium",
    zone: "us-central1-a",
    scheduling: {
        preemptible: true,              // Use preemptible for cost savings
        automaticRestart: false,        // Don't restart when preempted
        onHostMaintenance: "TERMINATE", // Terminate on maintenance
    },
    deletionProtection: false,         // Allow easy cleanup
    bootDisk: {
        initializeParams: {
            image: "debian-cloud/debian-11",
            size: 20,
            type: "pd-standard",        // Use standard disk for dev
        },
        autoDelete: true,               // Clean up disk with instance
    },
    networkInterfaces: [{
        network: "default",
        accessConfigs: [{}],
    }],
});

new gcp.compute.Instance("my-instance", {
  serviceAccount: {
    email: customServiceAccount.email,
    scopes: [
      "https://www.googleapis.com/auth/cloud-platform",
    ],
  },
  // ... other config
});

new gcp.compute.Instance("my-instance", {
  metadata: {
    "enable-oslogin": "TRUE",
    "block-project-ssh-keys": "TRUE",
    "enable-oslogin-2fa": "TRUE", // For production instances
  },
  // ... other config
});

new gcp.compute.Instance("my-instance", {
  deletionProtection: true,
  bootDisk: {
    autoDelete: false,
    initializeParams: {
      type: "pd-ssd", // Use persistent disk type
    },
  },
  labels: {
    "backup": "enabled",
    "critical": "true",
  },
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.compute.Instance("compliant-instance", {
    machineType: "e2-medium",
    zone: "us-central1-a",
    metadata: {
        "enable-osconfig": "TRUE",
    },
    labels: {
        "patch-group": "production",
        "compliance-policy": "cis-benchmark",
    },
    bootDisk: { /* ... */ },
    networkInterfaces: [{ /* ... */ }],
});

import * as gcp from "@pulumi/gcp";

const patchDeployment = new gcp.osconfig.PatchDeployment("weekly-patch", {
    patchDeploymentId: "weekly-patches",
    instanceFilter: {
        all: true,
    },
    recurringSchedule: {
        timeZone: { id: "UTC" },
        weekly: { dayOfWeek: "SUNDAY" },
    },
    patchConfig: {
        rebootConfig: "DEFAULT",
    },
});

const instance = new compute.Instance("my-instance", {
    attachedDisks: [{
        source: myDisk.selfLink,
        kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use CMEK for attached disk encryption
    }],
    // ... other config
});