Sovereign Controls by T-Systems

gcp.resourceLocations

Set to the following locations in the allowedValues list:

• europe-west3

This value restricts creation of new resources to the selected value group only. When set, no resources can be created in any other regions, multi-regions, or locations outside of the selection. See Resource locations supported services for a list of resources that can be restricted by the Resource Locations organization policy constraint, as some resources may be out of scope and unrestrictable.

Changing this value by making it less restrictive potentially undermines data residency by allowing data to be created or stored outside of a compliant data boundary.

gcp.restrictNonCmekServices

Set to a list of all in-scope API service names , including:

• compute.googleapis.com
• container.googleapis.com
• pubsub.googleapis.com
• storage.googleapis.com
• sqladmin.googleapis.com
• logging.googleapis.com
• bigquery.googleapis.com
• artifactregistry.googleapis.com
• bigtable.googleapis.com
• composer.googleapis.com
• dataflow.googleapis.com
• dataproc.googleapis.com
• spanner.googleapis.com
• secretmanager.googleapis.com
• run.googleapis.com
• notebooks.googleapis.com
• integrations.googleapis.com
• documentai.googleapis.com
• cloudfunctions.googleapis.com
• aiplatform.googleapis.com
• workstations.googleapis.com

Some features may be impacted for each of the services listed above.

Each listed service requires Customer-managed encryption keys (CMEK) . CMEK allows that at-rest data is encrypted with a key managed by you, not Google's default encryption mechanisms.

Changing this value by removing one or more in-scope services from the list may undermine data sovereignty, because new at-rest data will be automatically encrypted using Google's own keys instead of yours. Existing at-rest data will remain encrypted by the key you provided.

gcp.restrictTLSVersion

Set to deny the following TLS versions:

• TLS_1_0
• TLS_1_1

See the Restrict TLS versions page for more information.

gcp.restrictCmekCryptoKeyProjects

Set to under:organizations/your-organization-name , which is your Sovereign Controls by Partners organization. You can further restrict this value by specifying a project or folder.

Limits the scope of approved folders or projects that can provide Cloud KMS keys for encrypting at-rest data using CMEK. This constraint prevents unapproved folders or projects from providing encryption keys, thus helping to guarantee data sovereignty for in-scope services' at-rest data.

gcp.restrictServiceUsage

Set to allow all supported products and API endpoints .

Determines which services can be used by restricting runtime access to their resources. For more information, see Restricting resource usage .

Enabling BigQuery on a new folder

BigQuery is supported, but it isn't automatically enabled when you create a new Assured Workloads folder due to an internal configuration process. This process normally finishes in ten minutes, but can take much longer in some circumstances. To check whether the process is finished and to enable BigQuery, complete following steps:

1. In the Google Cloud console, go to the Assured Workloads page.

   Go to Assured Workloads

2. Select your new Assured Workloads folder from the list.
3. On the Folder Details page in the Allowed services section, click Review Available Updates .
4. In the Allowed services pane, review the services to be added to the Resource Usage Restriction organization policy for the folder. If BigQuery services are listed, click Allow Services to add them.
   
   If BigQuery services are not listed, wait for the internal process to complete. If the services are not listed within 12 hours of folder creation, contact Cloud Customer Care .

After the enablement process is completed, you can use BigQuery in your Assured Workloads folder.

Gemini in BigQuery is not supported by Assured Workloads.

Unsupported features

The following BigQuery features are not supported and should not be used in the BigQuery CLI. It is your responsibility not to use them in BigQuery for Sovereign Controls by Partners.

• Interaction with remote data sources
• Externally-trained BQML models are not supported. Internally-trained BQML models are supported.
• Scheduled and federated queries
• Dynamic data masking
• GDrive export
• Remote functions
• Saved queries
• Workflow scheduling
• For BigQuery Studio, notebooks are unsupported.
• Gemini in BigQuery is not supported.

Unsupported integrations

The following BigQuery integrations are not supported. It is your responsibility not to use them with BigQuery for Sovereign Controls by Partners.

• The CreateTag , SearchCatalog , Bulk tagging , and Business Glossary API methods of the Data Catalog API can process and store technical data in a way that is not supported. It is your responsibility not to use those methods for Sovereign Controls by Partners.

Supported BigQuery APIs

The following BigQuery APIs are supported:

• Datasets
• Jobs
• Models
• Projects
• Reservations
• Routines
• Row Access Policies
• Storage Read
• Storage Write
• Tables
• Table Data

Regions

BigQuery CLI

Google Cloud SDK

You must use Google Cloud SDK version 403.0.0 or newer to maintain data regionalization guarantees for technical data. To verify your current Google Cloud SDK version, run gcloud --version and then gcloud components update to update to the newest version.

Administrator controls

BigQuery will disable unsupported APIs but administrators with sufficient permissions to create an Assured Workloads folder can enable an unsupported API. If this occurs, you will be notified of potential non-compliance through the Assured Workloads monitoring dashboard .

Loading data

BigQuery Data Transfer Service connectors for Google Software as a Service (SaaS) apps, external cloud storage providers, and data warehouses are not supported. It is your responsibility not to use BigQuery Data Transfer Service connectors for Sovereign Controls by Partners workloads.

Third-party transfers

BigQuery does not verify support for third-party transfers for the BigQuery Data Transfer Service. It is your responsibility to verify support when using any third-party transfer for the BigQuery Data Transfer Service.

Non-compliant BQML models

Externally-trained BQML models are not supported.

Query jobs

Query jobs should only be created within Sovereign Controls by Partners folders.

Queries on datasets in other projects

BigQuery does not prevent Sovereign Controls by Partners datasets from being queried from non-Sovereign Controls by Partners projects. You should ensure that any query that has a read or a join on Sovereign Controls by Partners data be placed in a Sovereign Controls by Partners folder. You can specify a fully-qualified table name for their query result using projectname.dataset.table in the BigQuery CLI.

Cloud Logging

BigQuery utilizes Cloud Logging for some of your log data. You should disable your _default logging buckets or restrict _default buckets to in-scope regions to maintain compliance using the following command:

gcloud alpha logging settings update --organization=ORGANIZATION_ID --disable-default-sink

See Regionalize your logs for more information.

cloudkms.allowedProtectionLevels

Set to allow creating only Cloud KMS keys with one of the following ProtectionLevel types:

• EXTERNAL
• EXTERNAL_VPC

Regional load balancers

You must use only regional load balancers with Sovereign Controls by T-Systems. See the following pages for more information about configuring regional load balancers:

• Internal Application Load Balancer
• Regional external Application Load Balancer
• Internal passthrough Network Load Balancer
• External passthrough Network Load Balancer

storage.uniformBucketLevelAccess

Set to True .

Access to new buckets is managed using IAM policies instead of Cloud Storage Access control lists (ACLs) . This constraint provides fine-grained permissions for buckets and their contents.

If a bucket is created while this constraint is enabled, access to it can never be managed by using ACLs. In other words, the access control method for a bucket is permanently set to using IAM policies instead of Cloud Storage ACLs.

storage.restrictAuthTypes

Set to prevent authentication using hash-based message authentication code (HMAC). The following two HMAC types are specified in this constraint value:

1. USER_ACCOUNT_HMAC_SIGNED_REQUESTS
2. SERVICE_ACCOUNT_HMAC_SIGNED_REQUESTS

By default, HMAC keys are prevented from authenticating to Cloud Storage resources for workloads in Sovereign Controls by Partners. HMAC keys affect data sovereignty because they can be used to access customer data without customer knowledge. See HMAC keys in the Cloud Storage docs.

Changing this value may affect data sovereignty in your workload; we highly recommend keeping the set value.

compute.enableComplianceMemoryProtection

Set to True .

Disables some internal diagnostic features to provide additional protection of memory contents when an infrastructure fault occurs.

Changing this value may affect your data residency or data sovereignty.

compute.disableInstanceDataAccessApis

Set to True .

Globally disables the instances.getSerialPortOutput() and instances.getScreenshot() APIs.

Enabling this constraint prevents you from generating credentials on Windows Server VMs .

If you need to manage a username and password on a Windows VM, do the following:

1. Enable SSH for Windows VMs .
2. Run the following command to change the VM's password:

     
   gcloud  
   compute  
   ssh  
    VM_NAME 
     
   --command  
    "net user USERNAME 
    PASSWORD 
   " 
     
   

   Replace the following:
   • VM_NAME : The name of the VM you're setting the password for.
   • USERNAME : The username of the user who you're setting the password for.
   • PASSWORD : The new password.

compute.disableGlobalCloudArmorPolicy

Set to True .

Disables the creation of new global Google Cloud Armor security policies , and the addition or modification of rules to existing global Google Cloud Armor security policies. This constraint doesn't restrict the removal of rules or the ability to remove or change the description and listing of global Google Cloud Armor security policies. Regional Google Cloud Armor security policies are unaffected by this constraint. All global and regional security policies that exist prior to the enforcement of this constraint remain in effect.

compute.disableSshInBrowser

Set to True .

Disables the SSH-in-browser tool in the Google Cloud console for VMs that use OS Login and App Engine flexible environment environment VMs.

Changing this value may affect your data residency or data sovereignty.

compute.restrictNonConfidentialComputing

(Optional) Value is not set. Set this value to provide additional defense-in-depth. See the Confidential VM documentation for more information.

compute.trustedImageProjects

Unsupported features

The following Cloud Run features aren't supported:

• Cloud Trace integration
• Cloud Run functions
• Eventarc triggers