You may have resources within GCP that should always be ignored by Drata's compliance automation tests. Sometimes these are new resource that spin up each day. The exclusion label functionality will allow you to exclude these resources with a label within GCP.
Exclusion labels currently apply to the following resource types. Drata will continue to expand the use of exclusion labels.
Buckets
Virtual machines
Kubernets clusters
CloudSQL DBs
GCP Projects
Exclude GCP Buckets with labels
To exclude GCP Buckets with labels:
Select the bucket you wish to exclude in Cloud Storage.
Select the Configuration tab.
Scroll down to the Labels field under the Configuration tab and select the edit icon.
Enter the following values:
Key:
drataexcludeValue: <Enter the rationale behind excluding this bucket. Ensure that there are no spaces.>
Save your changes.
Exclude VM instances with labels
To exclude VM instances with labels:
Select the Instance you wish to exclude in the Compute Engine workflow.
Select the Edit tab.
Scroll down and select Add label.
Enter the following values:
Key:
drataexcludeValue: <Enter the rationale behind excluding this bucket. Ensure that there are no spaces.>
Save your changes.
Exclude Kubernetes Clusters with labels
⚠️ Limitation: When labeling Kubernetes clusters, the exclude label takes about an hour to propagate to the node level. If Test 118 - Infrastructure Instance CPU Monitored is run before the label propagates to the node level, the test will fail.
To exclude Kubernetes Clusters with labels:
Select the cluster you wish to exclude in the Kubernetes Engine workflow.
Under the Metadata section, scroll down and select the edit icon for Labels.
Select
Add Labeland enter the follow values:Key:
drataexcludeValue: <Enter the rationale behind excluding this bucket. Ensure that there are no spaces.>
Save your changes.
Exclude CloudSQL DBs
To exclude CloudSQL DBs:
Select the SQL button and the DB name you want to exclude.
Select the edit button.
Expand the Labels section and then select Add Label.
Enter the follow values and select done.
Key:
drataexcludeValue: <Enter the rationale behind excluding this bucket. Ensure that there are no spaces.>
Then, ensure to save your changes.
Exclude GCP Projects
⚠️ Limitation: If a change is made to the GCP web page, you may have to wait 3 to 4 minutes between each test run for the changes to be reflected correctly.
To exclude entire projects, follow these steps:
Navigate to the GCP website and select the project you want to exclude.
In the Labels section, select Add Label button.
Enter the follow values and select done.
Key:
drataexcludeValue: <Enter the rationale behind excluding this bucket. Ensure that there are no spaces.>
Save your changes.