PlatformResourcesSign inSign Up

Ensure GCP resources that support labels have Labels

Error: GCP resources that support labels do not have Labels

Bridgecrew Policy ID: BC_GCP_GENERAL_10
Checkov Check ID: -
Severity: LOW

Suggest Edits

GCP resources that support labels do not have Labels

Description

Many different types of GCP resources support labels. Labels allow you to add metadata to a resource to help identify ownership, perform cost / billing analysis, and to enrich a resource with other valuable information, such as descriptions and environment names. While there are many ways that labels can be used, we recommend you follow a labeling practice.

View Google's recommended labeling best practices here.

google_active_directory_domain
google_bigquery_dataset
google_bigquery_job
google_bigquery_table
google_bigtable_instance
google_cloud_identity_group
google_cloudfunctions_function
google_composer_environment
google_compute_disk
google_compute_image
google_compute_instance
google_compute_instance_from_template
google_compute_instance_template
google_compute_region_disk
google_compute_snapshot
google_dataflow_job
google_dataproc_cluster
google_dataproc_job
google_dns_managed_zone
google_eventarc_trigger
google_filestore_instance
google_game_services_game_server_cluster
google_game_services_game_server_config
google_game_services_game_server_deployment
google_game_services_realm
google_healthcare_consent_store
google_healthcare_dicom_store
google_healthcare_fhir_store
google_healthcare_hl7_v2_store
google_kms_crypto_key
google_ml_engine_model
google_monitoring_notification_channel
google_network_management_connectivity_test
google_notebooks_instance
google_project
google_pubsub_subscription
google_pubsub_topic
google_redis_instance
google_secret_manager_secret
google_spanner_instance
google_storage_bucket
google_tpu_node
google_workflows_workflow'

Fix - Buildtime

Terraform

The example below shows how to label a security group in Terraform. The syntax is generally the same for any label-enabled resource type.

resource "google_storage_bucket" "auto-expire" {
  name          = "auto-expiring-bucket"
  location      = "US"
  force_destroy = true

+  label {
+    type = prod
  }
  
  lifecycle_rule {
    condition {
      age = 3
    }
    action {
      type = "Delete"
    }
  }
}

Updated about 2 years ago