Monitor Assured Workloads frameworks

Assured Workloads actively monitors your framework deployments for compliance violations by comparing a deployed data boundary's requirements to the folder or project to which it's assigned. When your folder or project drifts from one or more of the data boundary's cloud control requirements, a violation occurs. Violation types include the following:

  • Location: When a child resource in an assigned folder or project is deployed to a non-compliant location, a violation occurs. This violation can occur by modifying a default value for the Restrict Resource Locations cloud control for a given framework, which is mapped to the gcp.resourceLocations organization policy constraint.
  • Service usage: When a non-compliant service endpoint (such as compute.googleapis.com) is enabled on an assigned folder or project, a violation will occur. This violation can occur if you modify the default value for the Restrict Service Usage cloud control for a given framework, which is mapped to the gcp.restrictServiceUsage organization policy constraint.
  • Encryption: Some data boundaries require Customer-managed encryption keys set to a specific set of service endpoints. To enforce this requirement, the Enforce CMEK for Supported Services cloud control is applied. If you add non-compliant services or remove existing or required services from this cloud control, a violation will occur. This violation is mapped to the gcp.restrictNonCmekServices organization policy constraint.
  • Access: Some data boundaries require Access Approval or Access Transparency, which together help you authorize requests from Google personnel to access Customer Data and determine when and why such data was accessed. When you modify these cloud controls, for example, by changing the default values for the Enable Access Transparency cloud control, you can cause a violation to occur.
  • Configuration: Changing a cloud control value to a non-compliant value can cause a violation to occur.

When a violation occurs, you can resolve it or create exceptions for it where appropriate. A violation can have one of three statuses:

  • Unresolved: The violation hasn't been addressed, or was previously granted an exception before non-compliant changes were made on the folder or resource.
  • Resolved: The violation has been addressed by following steps to remediate the issue.
  • Exception: The violation has been granted an exception, and a business justification has been provided.

Monitoring is automatically enabled when you apply an Assured Workloads framework to a resource.

View violations in your organization

To view specific compliance violations and their details, complete the following steps:

  1. In the Google Cloud console, go to the Monitoring page.

    Go to Monitoring

  2. If prompted, select your organization.

  3. Click the