tools/custom-organization-policy-library/build/custom-constraints/cloudkms/cloudkmsAllowedProtectionLevel.yaml

#@ load("/constraints.lib.star", "build_constraint")
#@ constraint = build_constraint("cloudkmsAllowedProtectionLevel")

#@ def condition(protection_levels):
#@   return 'resource.versionTemplate.protectionLevel in ' +  str(protection_levels) + " == false"
#@ end

#@ if constraint.to_generate():
name: #@ constraint.constraint_name()
resourceTypes:
- cloudkms.googleapis.com/CryptoKey
methodTypes:
- CREATE
- UPDATE
condition: #@  condition(constraint.params().protection_levels)
actionType: DENY
displayName: Require Cloud KMS keys protection level to be configured correctly
description: Ensure the protection level for Cloud KMS keys is configured correctly
#@ end