Auto-Badging (GCP)

Overview of the GCP Auto-Badging Capability

Capability Overview

InsightCloudSec includes auto-badging capabilities to create a 1:1 map of GCP project-level labels to Badges in InsightCloudSec. This allows Clouds to be scoped to a badge that maps to the account tag.

GCP Projects

For GCP Projects that are not part of an Organization and have auto badging of projects enabled InsightCloudSec will automatically create badges from the GPC project-level labels.

Note: If you add a GCP Organization that includes a previously standalone GCP Project at a later point, the Organization will assimilate the project into the Organization configuration.

GCP Organizations

For GCP Organizations that have auto badging of projects enabled, all clouds corresponding with a project that do not have a parent folder will have a cloud_org_path badge with a value of '/' to signify they are at the root.

Selecting the "Auto Badge Projects" option will also provide automatic badging for Organizations that utilize folders through the new gcp_folder badge. This badge can be extremely helpful for managing scope around Insights, Bots, and the Compliance Scorecard views for organizational units and lines of business within your cloud footprint.

Auto Badging Behavior

Auto badging takes place in two stages.

  • Periodically a process retrieves tags/labels from each account/project and compares them with ResourceTags associated with the corresponding cloud in the InsightCloudSec database.

    • If there are any changes detected, the ResourceTags in the database are overwritten with the values from the account/project. This means that Cloud Account tags should not be locally modified since any local changes will be overwritten the next time the process runs. Additionally any local changes that are made to Cloud Account tags are not pushed back up to the cloud provider.
  • Periodically a process retrieves all ResourceTags from the local database that are associated with the accounts managed by an organization. For each cloud the list of tags for that cloud is compared with the current list of Badges and for each Key/Value pair of tags:

    • Existing Badges with a Key prefix of system. are skipped.
    • If the corresponding Badge with the Key/Value pair for that cloud does not already exist, it is created.
    • If a tag Value changes, the Badge with the corresponding Key will be updated to that value.
    • If a Badge no longer has a tag with a corresponding Key, the Badge will be deleted.
    • All Badges that have a corresponding tag will have their autogenerated column set to ‘true’ even if the columns were previously set to ‘false’.

Did this page help you?