The names for some Assured Workloads control packages have changed. For information about the name change, see Control package renaming notice.

Monitor an Assured Workloads folder for violations

Assured Workloads actively monitors your Assured Workloads folders for compliance violations by comparing the requirements of a folder's control package with the following details:

Organization policy: Each Assured Workloads folder is configured with specific organization policy constraint settings that help to ensure compliance. When these settings are changed in a non-compliant manner, a violation occurs. See the Monitored organization policy violations section for more information.
Resources: Depending on your Assured Workloads folder's organization policy settings, the resources beneath the folder may be restricted, such as their type and location. See the Monitored resource violations section for more information. If any resources are non-compliant, a violation occurs.

When a violation occurs, you can resolve them or create exceptions for them where appropriate. A violation can have one of three statuses:

Unresolved: The violation hasn't been addressed, or was previously granted an exception before non-compliant changes were made on the folder or resource.
Resolved: The violation has been addressed by following steps to remediate the issue.
Exception: The violation has been granted an exception, and a business justification has been provided.

Assured Workloads monitoring is automatically enabled when you create an Assured Workloads folder.

Before you begin

Required IAM roles and permissions

To view organization policy violations or resource violations, you must be granted an IAM role on the parent organization of the Assured Workloads folder that contains the following permissions:

assuredworkloads.violations.get
assuredworkloads.violations.list

These permissions are included in the following Assured Workloads IAM roles:

Assured Workloads Administrator (roles/assuredworkloads.admin)
Assured Workloads Editor (roles/assuredworkloads.editor)
Assured Workloads Reader (roles/assuredworkloads.reader)

To enable resource violation monitoring, you must be granted an IAM role on the parent organization of the Assured Workloads folder that contains the following permissions:

assuredworkloads.workload.update: This permission is included in the following roles:
- Assured Workloads Administrator (roles/assuredworkloads.admin)
- Assured Workloads Editor (roles/assuredworkloads.editor)
resourcemanager.folders.setIamPolicy: This permission is included in administrative roles, such as the following:
- Organization Administrator (roles/resourcemanager.organizationAdmin)
- Security Admin (roles/iam.securityAdmin)

To provide exceptions for compliance violations, you must be granted an IAM role on the parent organization of the Assured Workloads folder that contains the following permission:

assuredworkloads.violations.update: This permission is included in the following roles:
- Assured Workloads Administrator (roles/assuredworkloads.admin)
- Assured Workloads Editor (roles/assuredworkloads.editor)

Additionally, to resolve organization policy violations and to view audit logs, the following IAM roles must be granted:

Organization Policy Administrator (roles/orgpolicy.policyAdmin)
Logs Viewer (roles/logging.viewer)

Set up violation email notifications

When an organization compliance violation occurs or is resolved or when an exception is made, members of the Legal category in Essential Contacts are emailed by default. This behavior is necessary because your legal team needs to be kept up to date with any regulatory compliance issues.

Your team who manages the violations, whether that be a security team or otherwise, should also be added to the Legal category as contacts. This ensures that they are sent email notifications as changes occur.

Enable or disable notifications

To enable or disable notifications for a specific Assured Workloads folder:

Go to the Assured Workloads page in the Google Cloud console:

Go to Assured Workloads
In the Name column, click the name of the Assured Workloads folder whose notification settings you want to change.
In the Assured Workloads Monitoring card, clear the Enable notifications checkbox to disable notifications, or select it to enable notifications for the folder.

On the Assured Workloads folders page, folders that have notifications disabled show Monitoring email notifications disabled.

View violations in your organization

You can view violations across your organization in both the Google Cloud console and the gcloud CLI.

Console

You can view how many violations there are across your organization on either the Assured Workloads page in the Compliance section of the Google Cloud console or the Monitoring page in the Compliance section.

Assured Workloads page

Go to the Assured Workloads page to view violations at a glance:

Go to Assured Workloads

At the top of the page, a summary of organization policy violations and resource violations is shown. Click the View link to go to the Monitoring page.

For each Assured Workloads folder in the list, any violations are shown in the Org policy violations and Resource violations columns. Unresolved violations have the icon active, and exceptions have the icon active. You can select a violation or exception to see more details.

If resource violation monitoring is not enabled on a folder, the icon is active in the Updates column with an Enable Resource violation monitoring link. Click the link to enable the feature. You can also enable it by clicking the Enable button on the Assured Workloads folder details page.

Monitoring page

Go to the Monitoring page to view violations in more detail:

Go to Monitoring

Two tabs are shown: Organization Policy Violations and Resource Violations. If more than one unresolved violation exists, the icon is active on the tab.

In either tab, unresolved violations are shown by default. See the View violation details section below for more information.

gcloud CLI

To list the current compliance violations in your organization, run the following command:

gcloud assured workloads violations list --location=LOCATION --organization=ORGANIZATION_ID --workload=WORKLOAD_ID

Where:

LOCATION is the location of the Assured Workloads folder.
ORGANIZATION_ID is the organization ID to query.
WORKLOAD_ID is the parent workload ID, which can be found by listing your workloads.

The response includes the following information for each violation:

An audit log link for the violation.
The first time the violation occurred.
The type of violation.
A description of the violation.
The name of the violation, which can be used to retrieve more details.
The affected organization policy, and the related policy constraint.
The violation's current state. Valid values are unresolved, resolved, or exception.

For optional flags, see the Cloud SDK documentation.

View violation details

To view specific compliance violations and their details, complete the following steps:

Console

In the Google Cloud console, go to the Monitoring page.

Go to Monitoring

On the Monitoring page, the Organization Policy Violations tab is selected by default. This tab displays all unresolved organization policy violations across Assured Workloads folders in the organization.

The Resource Violations tab displays all unresolved violations associated with the resource across all Assured Workloads folders in the organization.
For either tab, use the Quick filters options to filter by violation status, violation type, control package type, violation type, specific folders, specific organization policy constraints, or specific resource types.