Restrictions and limitations for ITAR

This page describes the restrictions, limitations, and other configuration options when using the ITAR compliance program.

Overview

The International Traffic in Arms Regulations (ITAR) compliance program enables data access control and residency features for in-scope Google Cloud services. Some of these services' features are restricted or limited by Google to be compatible with ITAR. Most of these restrictions and limitations are applied when creating a new Assured Workloads folder for ITAR, however some of them can be changed later by modifying organization policies. Additionally, some restrictions and limitations require user responsibility for adherence.

It's important to understand how these restrictions modify the behavior for a given Google Cloud service or affect data access or data residency. For example, some features or capabilities may be automatically disabled to ensure that data access restrictions and data residency are maintained. Additionally, if an organization policy setting is changed, it might have the unintended consequence of copying data from one region to another.

Prerequisites

To remain compliant as a user of the ITAR compliance program, ensure that you satisfy and adhere to the following prerequisites:

  • Create an ITAR folder using Assured Workloads and deploy your ITAR workloads only in that folder.
  • Only enable and use in-scope ITAR services for ITAR workloads.
  • Do not change the default organization policy constraint values unless you understand and are willing to accept the data residency risks that may occur.
  • When connecting to Google Cloud service endpoints, you must use regional endpoints for services that offer them. In addition:
    • When connecting to Google Cloud service endpoints from non-Google Cloud VMs —such as on-premises or other cloud providers' VMs— you must use one of the available private access options that support connections to non-Google Cloud VMs to route the non-Google Cloud traffic into Google Cloud.
    • When connecting to Google Cloud service endpoints from Google Cloud VMs, you may use any of the available private access options.
    • When connecting to Google Cloud VMs that have been exposed with external IP addresses, refer to Access APIs from VMs with external IP addresses.
  • For all services used in an ITAR folder, do not store technical data in the following user-defined or security configuration information types:
    • Error messages
    • Console output
    • Attribute data
    • Service configuration data
    • Network packet headers
    • Resource identifiers
    • Data labels
  • Use only the specified regional or locational endpoints for services that offer them. See in-scope ITAR services for more information.
  • Consider adopting the general security best practices provided in the Google Cloud security best practices center.

In-scope services

The following services are compatible with ITAR:

Organization policies

This section describes how each service is affected by the default organization policy constraint values when folders or projects are created using ITAR. Other applicable constraints —even if not set by default— can provide additional "defense-in-depth" to further protect your organization's Google Cloud resources.

Cloud-wide organization policy constraints

The following organization policy constraints apply across any applicable Google Cloud service.

Organization Policy Constraint Description
gcp.resourceLocations Set to in:us-locations as the allowedValues list item.

This value restricts creation of any new resources to the US value group only. When set, no resources can be created in any other regions, multi-regions, or locations outside of the US. See the Organization policy value groups documentation for more information.

Changing this value by making it less restrictive potentially undermines data residency by allowing data to be created or stored outside the US data boundary. For example: replacing the in:us-locations value group with the in:northamerica-locations value group.
gcp.restrictNonCmekServices Set to a list of all in-scope API service names, including:
  • compute.googleapis.com
  • container.googleapis.com
  • storage.googleapis.com
Some features may be impacted for each of the services listed above. See the Impacted Features section below.

Each listed service requires Customer-managed encryption keys (CMEK). CMEK ensures that at-rest data is encrypted with a key managed by you, not Google's default encryption mechanisms.

Changing this value by removing one or more in-scope services from the list may undermine data data sovereignty, as new at-rest data will be automatically encrypted using Google's own keys instead of yours. Existing at-rest data will remain encrypted by the key you provided.
gcp.restrictCmekCryptoKeyProjects Set to all resources under the ITAR folder you created.

Limits the scope of approved folders or projects that can provide KMS keys for encrypting at-rest data using CMEK. This constraint prevents unapproved folders or projects from providing encryption keys, thus helping to guarantee data sovereignty for in-scope services' at-rest data.
gcp.restrictServiceUsage Set to allow all in-scope services.

Determines which services can be enabled and used. For more information, see Restrict resource usage for workloads.

Compute Engine organization policy constraints

Organization Policy Constraint Description
compute.disableGlobalLoadBalancing Set to True.

Disables creation of global load balancing products.

Changing this value may affect data residency in your workload; we recommend keeping the set value.
compute.disableGlobalSelfManagedSslCertificate Set to True.

Disables creation of global self-managed SSL certificates.

Changing this value may affect data residency in your workload; we recommend keeping the set value.
compute.disableInstanceDataAccessApis Set to True.

Globally disables the instances.getSerialPortOutput() and instances.getScreenshot() APIs.

Enabling this organization policy prevents you from generating credentials on Windows Server VMs.

If you need to manage a username and password on a Windows VM, do the following:
  1. Enable SSH for Windows VMs.
  2. Run the following command to change the VM's password: 
    gcloud compute ssh
VM_NAME --command "net user USERNAME PASSWORD"
    Replace the following:
    • VM_NAME: The name of the VM you're setting the password for.
    • USERNAME: The username of the user who you're setting the password for.
    • PASSWORD: The new password.
compute.disableNestedVirtualization Set to True.

Disables hardware-accelerated nested virtualization for all Compute Engine VMs in the ITAR folder.

Changing this value may affect data residency in your workload; we recommend keeping the set value.
compute.enableComplianceMemoryProtection Set to True.

Disables some internal diagnostic features to provide additional protection of memory contents when an infrastructure fault occurs.

Changing this value may affect data residency in your workload; we recommend keeping the set value.
compute.restrictNonConfidentialComputing

 (Optional) Value is not set. Set this value to provide additional defense-in-depth. See the Confidential VM documentation for more information.
compute.restrictLoadBalancerCreationForTypes

 Set to allow all values except for GLOBAL_EXTERNAL_MANAGED_HTTP_HTTPS. See Choose a load balancer for more information.

Google Kubernetes Engine organization policy constraints

Organization Policy Constraint Description
container.restrictNoncompliantDiagnosticDataAccess Set to True.

Used to disable aggregate analysis of kernel issues, which is required to maintain sovereign control of a workload.

Changing this value may affect data sovereignty in your workload; we recommend keeping the set value.

Impacted features

This section lists how each service's features or capabilities are impacted by ITAR, including user requirements when using a feature.

Compute Engine features

Feature Description
Bare Metal Solution VMs It is your responsibility not to use Bare Metal Solution VMs (o2 VMs) because Bare Metal Solution VMs are not compliant with ITAR.

Google Cloud VMware Engine VMs It is your responsibility not to use Google Cloud VMware Engine VMs, as Google Cloud VMware Engine VMs are not compliant with ITAR.

Creating a C3 VM instance This feature is disabled.
Using persistent disks or their snapshots without CMEK You cannot use persistent disks or their snapshots unless they have been encrypted using CMEK.
Creating nested VMs or VMs that use nested virtualization You cannot create nested VMs or VMs that use nested virtualization.

This feature is disabled by the compute.disableNestedVirtualization organization policy constraint described in the section above.
Adding an instance group to a global load balancer You cannot add an instance group to a global load balancer.

This feature is disabled by the compute.disableGlobalLoadBalancing org policy constraint described in the section above.
Routing requests to a multi-region external HTTPS load balancer You cannot route requests to a multi-region external HTTPS load balancer.

This feature is disabled by the compute.restrictLoadBalancerCreationForTypes org policy constraint described in the section above.
Sharing an SSD persistent disk in multi-writer mode You cannot share an SSD persistent disk in multi-writer mode between VM instances.
Suspending and resuming a VM instance This feature is disabled.

Suspending and resuming a VM instance requires persistent disk storage, and persistent disk storage used for storing the suspended VM state cannot currently be encrypted using CMEK. See the gcp.restrictNonCmekServices org policy constraint in the section above to understand the data residency implications of enabling this feature.
Local SSDs This feature is disabled.

You will be unable to create an instance with Local SSDs because they currently cannot be encrypted using CMEK. See the gcp.restrictNonCmekServices org policy constraint in the section above to understand the data residency implications of enabling this feature.
Guest environment It is possible for scripts, daemons, and binaries that are included with the guest environment to access unencrypted at-rest and in-use data. Depending on your VM configuration, updates to this software may be installed by default. See Guest environment for specific information about each package's contents, source code, and more.

These components help you meet data residency through internal security controls and processes. However, for users who want additional control, you can also curate your own images or agents and optionally use the compute.trustedImageProjects organization policy constraint.

See the Building a custom image page for more information.
instances.getSerialPortOutput() This API is disabled; you will be unable to get serial port output from the specified instance using this API.

Change the compute.disableInstanceDataAccessApis organization policy constraint value to False to enable this API. You can also enable and use the interactive serial port by following the instructions on this page.
instances.getScreenshot() This API is disabled; you will be unable to get a screenshot from the specified instance using this API.

Change the compute.disableInstanceDataAccessApis organization policy constraint value to False to enable this API. You can also enable and use the interactive serial port by following the instructions on this page.

Cloud Storage features

Feature Description
Google Cloud console To maintain ITAR compliance, it is your responsibility not to perform the following operations using the Google Cloud console:
Compliant API endpoints You must use one of the ITAR-compliant locational endpoints with Cloud Storage. Locational endpoints are available for all US regions, the US multiregion, and the NAM4 predefined dual-region. Locational endpoints are not available for dual-regions other than the NAM4 dual-region. See this page for more information about locations in Cloud Storage.
Noncompliant operations The following operations are not ITAR-compliant:
gsutil CLI For using locational endpoints with gsutil, you need gsutil 4.0 or newer. Ensure that the boto config file meets the following requirements:
  • Headers (gs_host and gs_json_host) in your boto file are set to the locational endpoints.
  • The other 2 headers (gs_host_header and gs_json_host_header) are either empty (default) or explicitly set to the locational endpoints.
    • The following changes could be made to the config: 
    [Credentials]
gs_host = LOCATION-storage.googleapis.com
gs_host_header // this should be empty or set to
LOCATION-storage.googleapis.com gs_json_host =
LOCATION-storage.googleapis.com
gs_json_host_header // this should be empty or set to LOCATION-storage.googleapis.com
    These changes could also be provided using a configuration override: 
    gsutil -o'Credentials:gs_host=LOCATION-storage.googleapis.com' mb
gs://new-bucket gsutil -o'Credentials:gs_json_host=LOCATION-storage.googleapis.com' mb
gs://new-bucket
Object operations The following operations are ITAR-compliant:
  • Intra-location operations, which include:
    • compose
    • delete
    • get
    • insert
    • list
    • patch
    • update
    • watchAll
    These operations are compliant on the locational endpoint when the bucket exists in the same location as specified in the endpoint. copy and rewrite operations are supported only when the source bucket and destination bucket are within the same location as specified in the endpoint.
Bucket operations The following operations are ITAR-compliant:
  • Insert (create bucket) operations will be supported on the locational endpoint only when creating buckets in that location:
    • A user can create a new bucket only in the region specified by the regional endpoint. For example, a create bucket request to us-central1-storage.googleapis.com can only be used to create a bucket in us-central1.
    • If a user tries to specify a bucket region that is different from the one in the regional endpoint, the create bucket operation will return an error: INVALID_ARGUMENT.
    • If a user does not set a location when creating a bucket on the locational endpoint, the default location for the bucket will be the location specified by the regional endpoint.
    • Delete (delete bucket) operations will be supported on locational endpoints when deleting a bucket in that location:
    • The delete bucket operation will only work if the bucket specified in the request exists in the location specified in the endpoint name.
      • If a user tries to specify a bucket that doesn't exist in the same region as the endpoint, the operation will return an error NOT FOUND. Global endpoints can also be used to delete buckets in a different location.
  • Other bucket operations are also supported, provided the bucket exists in the location specified in the endpoint:
    • get
    • getIamPolicy
    • list
    • lockRetentionPolicy
    • patch
    • setIamPolicy
    • testIamPermissions
    • update

Cloud Interconnect features

Feature Description
High-availability (HA) VPN You must enable high-availability (HA) VPN functionality when using Cloud Interconnect with Cloud VPN. Additionally, you must adhere to the encryption and regionalization requirements listed in this section.

Cloud Load Balancing features

Feature Description
Regional load balancers You must use only regional load balancers with ITAR. See the following pages for more information about configuring regional load balancers:

VPC features

Feature Description
Subnets You must assign subnets to US regions only.

Cloud VPN features

Feature Description
Encryption You must use only FIPS 140-2 compliant ciphers when creating certificates and configuring your IP security. See this page for more information about supported ciphers in Cloud VPN. For guidance about selecting a cipher that conforms to FIPS 140-2 standards, see this page.

There is currently no way to change an existing cipher in Google Cloud. Ensure that you configure your cipher on your third-party appliance that's used with Cloud VPN.
VPN endpoints You must use only Cloud VPN endpoints that are located in the US. Ensure that your VPN gateway is configured for use in a US region only.

What's next