Skip to main content
All CollectionsIntegrations
Exclusion labels within GCP
Exclusion labels within GCP

Implementing exclusion labels for specific resources

Ashley Hyman avatar
Written by Ashley Hyman
Updated over a week ago

HERE'S WHY

You may have resources within GCP that should always be ignored by Drata's compliance automation tests. Sometimes these are new resource that spin up each day. The exclusion label functionality will allow you to exclude these resources with a label within GCP.

Exclusion labels currently apply to the following resource types. Drata will continue to expand the use of exclusion labels.

  • Buckets

  • Virtual machines

  • Kubernets clusters

  • CloudSQL DBs

BEFORE DIVING IN

Limitations:

  1. When labeling Kubernetes clusters, the exclude label takes about an hour to propagate to the node level. If Test 118 - Infrastructure Instance CPU Monitored is run before the label propagates to the node level, the test will fail. See the snippet below from GCP documentation.

    User-uploaded Image

HERE'S HOW

  1. Excluding GCP Buckets with labels.

    1. Select the bucket you wish to exclude in Cloud Storage.

User-uploaded Image

b. Open the configuration tab.

User-uploaded Image

c. Look for the Labels field in the configuration panel and click the edit icon.

User-uploaded Image

d. Edit the label and put drataexclude in the key field. You can add the rationale behind excluding this bucket in the value field (no spaces can be included in the rationale). Save your changes.

User-uploaded Image

2. Excluding VM instances with labels.

a. Select the Instance you wish to exclude in the Compute Engine workflow.

User-uploaded Image

b. Select the Edit tab.

User-uploaded Image

c. Scroll down until you see Labels , go ahead and Add Label once found.

User-uploaded Image

d. Edit the label and put drataexclude in the key field. You can add the rationale behind excluding this bucket in the value field (no spaces allowed).

User-uploaded Image

e. scroll down and save your changes.

3. Excluding Kubernetes Clusters with labels.

a. Select the cluster you wish to exclude in the Kubernetes Engine workflow.

User-uploaded Image

b. Scroll down until you see the Labels, under Metadata. Click the Edit icon.

User-uploaded Image

c. Click Add Label and put drataexclude in the key field. You can add the rationale behind excluding this bucket in the value field (no spaces allowed).

User-uploaded Image

d. Save your changes.

4. Excluding CloudSQL DBs

a. Go to SQL and click on the DB name you want to exclude.

b. Click on the "Edit" button.

c. Scroll down to the "Labels" section. Click the arrow to the right to expand this "Labels" section. Click "Add Label."

d. Put drataexclude in the key field. You can add the rationale behind excluding this DB in the value field (no spaces allowed).

e. Click "Done."

f. Click "Save."

Did this answer your question?