Restrictions and limitations for ITAR
This page describes the restrictions, limitations, and other configuration options when using the ITAR compliance program.
Overview
The International Traffic in Arms Regulations (ITAR) compliance program enables data access control and residency features for in-scope Google Cloud services. Some of these services' features are restricted or limited by Google to be compatible with ITAR. Most of these restrictions and limitations are applied when creating a new Assured Workloads folder for ITAR, however some of them can be changed later by modifying organization policies. Additionally, some restrictions and limitations require user responsibility for adherence.
It's important to understand how these restrictions modify the behavior for a given Google Cloud service or affect data access or data residency. For example, some features or capabilities may be automatically disabled to ensure that data access restrictions and data residency are maintained. Additionally, if an organization policy setting is changed, it might have the unintended consequence of copying data from one region to another.
Prerequisites
To remain compliant as a user of the ITAR compliance program, ensure that you satisfy and adhere to the following prerequisites:
- Create an ITAR folder using Assured Workloads and deploy your ITAR workloads only in that folder.
- Only enable and use in-scope ITAR services for ITAR workloads.
- Do not change the default organization policy constraint values unless you understand and are willing to accept the data residency risks that may occur.
- When connecting to Google Cloud service endpoints, you must use regional
endpoints for services that offer them. In addition:
- When connecting to Google Cloud service endpoints from non-Google Cloud VMs —such as on-premises or other cloud providers' VMs— you must use one of the available private access options that support connections to non-Google Cloud VMs to route the non-Google Cloud traffic into Google Cloud.
- When connecting to Google Cloud service endpoints from Google Cloud VMs, you may use any of the available private access options.
- When connecting to Google Cloud VMs that have been exposed with external IP addresses, refer to Access APIs from VMs with external IP addresses.
- For all services used in an ITAR folder, do not store technical data in the
following user-defined or security configuration information types:
- Error messages
- Console output
- Attribute data
- Service configuration data
- Network packet headers
- Resource identifiers
- Data labels
- Use only the specified regional or locational endpoints for services that offer them. See in-scope ITAR services for more information.
- Consider adopting the general security best practices provided in the Google Cloud security best practices center.
In-scope services
The following services are compatible with ITAR:
- BigQuery
- Google Kubernetes Engine
- Identity and Access Management (IAM)
- Compute Engine
- Cloud Storage
- Persistent Disk
- Cloud Load Balancing
- Cloud VPN
- Virtual Private Cloud (VPC)
- VPC Service Controls
- Cloud Interconnect
- Cloud Router
- Identity-Aware Proxy
- Network Connectivity Center
- Cloud NAT
- Cloud DNS
- Cloud Key Management Service (Cloud KMS)
- Cloud HSM
Organization policies
This section describes how each service is affected by the default organization policy constraint values when folders or projects are created using ITAR. Other applicable constraints —even if not set by default— can provide additional "defense-in-depth" to further protect your organization's Google Cloud resources.
Cloud-wide organization policy constraints
The following organization policy constraints apply across any applicable Google Cloud service.
Organization Policy Constraint | Description |
---|---|
gcp.resourceLocations |
Set to in:us-locations as the allowedValues
list item.This value restricts creation of any new resources to the US value group only. When set, no resources can be created in any other regions, multi-regions, or locations outside of the US. See the Organization policy value groups documentation for more information. Changing this value by making it less restrictive potentially undermines data residency by allowing data to be created or stored outside the US data boundary. For example: replacing the in:us-locations value group with the
in:northamerica-locations value group.
|
gcp.restrictNonCmekServices |
Set to a list of all in-scope
API service names,
including:
Each listed service requires Customer-managed encryption keys (CMEK). CMEK ensures that at-rest data is encrypted with a key managed by you, not Google's default encryption mechanisms. Changing this value by removing one or more in-scope services from the list may undermine data data sovereignty, as new at-rest data will be automatically encrypted using Google's own keys instead of yours. Existing at-rest data will remain encrypted by the key you provided. |
gcp.restrictCmekCryptoKeyProjects |
Set to all resources under the ITAR folder you created. Limits the scope of approved folders or projects that can provide KMS keys for encrypting at-rest data using CMEK. This constraint prevents unapproved folders or projects from providing encryption keys, thus helping to guarantee data sovereignty for in-scope services' at-rest data. |
gcp.restrictServiceUsage |
Set to allow all in-scope services. Determines which services can be enabled and used. For more information, see Restrict resource usage for workloads. |
Compute Engine organization policy constraints
Organization Policy Constraint | Description |
---|---|
compute.disableGlobalLoadBalancing |
Set to True. Disables creation of global load balancing products. Changing this value may affect data residency in your workload; we recommend keeping the set value. |
compute.disableGlobalSelfManagedSslCertificate |
Set to True. Disables creation of global self-managed SSL certificates. Changing this value may affect data residency in your workload; we recommend keeping the set value. |
compute.disableInstanceDataAccessApis
| Set to True. Globally disables the instances.getSerialPortOutput() and
instances.getScreenshot() APIs.Enabling this organization policy prevents you from generating credentials on Windows Server VMs. If you need to manage a username and password on a Windows VM, do the following:
|
compute.disableNestedVirtualization |
Set to True. Disables hardware-accelerated nested virtualization for all Compute Engine VMs in the ITAR folder. Changing this value may affect data residency in your workload; we recommend keeping the set value. |
compute.enableComplianceMemoryProtection |
Set to True. Disables some internal diagnostic features to provide additional protection of memory contents when an infrastructure fault occurs. Changing this value may affect data residency in your workload; we recommend keeping the set value. |
compute.restrictNonConfidentialComputing |
(Optional) Value is not set. Set this value to provide additional defense-in-depth. See the Confidential VM documentation for more information. |
compute.restrictLoadBalancerCreationForTypes |
Set to allow all values except for
GLOBAL_EXTERNAL_MANAGED_HTTP_HTTPS . See
Choose a load balancer for more information.
|
Google Kubernetes Engine organization policy constraints
Organization Policy Constraint | Description |
---|---|
container.restrictNoncompliantDiagnosticDataAccess |
Set to True. Used to disable aggregate analysis of kernel issues, which is required to maintain sovereign control of a workload. Changing this value may affect data sovereignty in your workload; we recommend keeping the set value. |
Impacted features
This section lists how each service's features or capabilities are impacted by ITAR, including user requirements when using a feature.
BigQuery features
Feature | Description |
---|---|
Unsupported features | The following BigQuery features are not supported for ITAR
compliance and should not be used in the BigQuery CLI. It is the
customer's responsibility to not use them in BigQuery for ITAR
workloads.
|
Unsupported integrations | The following BigQuery integrations are not supported for
ITAR compliance. It is the customer's responsibility to not use them with
BigQuery for ITAR workloads.
|
Compliant BigQuery APIs | The following BigQuery APIs are ITAR-compliant:
|
Regions | BigQuery is ITAR-compliant for all BigQuery US
regions except the US multi-region. ITAR compliance cannot be guaranteed
if a dataset is created in a US multi-region, non-US region, or non-US
multi-region. It is the customer's responsibility to specify an
ITAR-compliant region when creating BigQuery datasets. If a table data list request is sent using one US region but the dataset was created in another US region, BigQuery cannot infer which region the customer intended and the operation will fail with a "dataset not found" error message. |
Google Cloud console | The BigQuery user interface in the Google Cloud console is
ITAR-compliant.
|
BigQuery CLI | The BigQuery CLI is ITAR-compliant.
|
Google Cloud SDK | You must use Google Cloud SDK version 403.0.0 or newer to maintain data
regionalization guarantees for ITAR technical data. To verify your current
Google Cloud SDK version, run gcloud --version , and then
gcloud components update to update to the newest version.
|
Administrator controls | BigQuery will disable non-compliant APIs but customer administrators with sufficient permissions to create an Assured Workloads folder can enable a non-compliant API. Should this occur, the customer will be notified of potential non-compliance through the Assured Workloads monitoring dashboard. |
Loading data | BigQuery Data Transfer Service connectors for Google Software as a Service (SaaS) apps, external cloud storage providers, and data warehouses are not ITAR-compliant. It is the customer's responsibility to not use BigQuery Data Transfer Service connectors for ITAR workloads. |
Third-party transfers | BigQuery does not verify ITAR compliance for third-party transfers for the BigQuery Data Transfer Service. It is the customer's responsibility to verify ITAR compliance when using any third-party transfer for the BigQuery Data Transfer Service. |
Non-compliant BQML models | Externally-trained BQML models are not ITAR-compliant. |
Query jobs | Query jobs with ITAR technical data should be created only within ITAR projects. |
Queries on ITAR datasets from non-ITAR projects | BigQuery does not prevent ITAR datasets from being queried from
non-ITAR projects. Customers should ensure that any query that has a read
or a join on ITAR technical data be placed in an ITAR-compliant folder.
Customers can specify a
fully-qualified
table name for their query result using projectname.dataset.table
in the BigQuery CLI. |
Cloud Logging | BigQuery utilizes Cloud Logging for some customer log data.
Customers should disable their _default logging buckets or
restrict _default buckets to US regions to
maintain ITAR compliance using the following command:gcloud alpha logging settings update --organization=ORGANIZATION_ID --disable-default-sink See this page for more information. |
Compute Engine features
Feature | Description |
---|---|
Google Cloud console | The following Compute Engine features are not available in the
Google Cloud console. Use the API or Google Cloud CLI instead:
|
Bare Metal Solution VMs | It is your responsibility not to use Bare Metal Solution VMs (o2 VMs) because
Bare Metal Solution VMs are not compliant with ITAR.
|
Google Cloud VMware Engine VMs | It is your responsibility not to use Google Cloud VMware Engine VMs, as
Google Cloud VMware Engine VMs are not compliant with ITAR.
|
Creating a C3 VM instance | This feature is disabled. |
Using persistent disks or their snapshots without CMEK | You cannot use persistent disks or their snapshots unless they have
been encrypted using CMEK. |
Creating nested VMs or VMs that use nested virtualization | You cannot create nested VMs or VMs that use nested virtualization. This feature is disabled by the compute.disableNestedVirtualization organization policy
constraint described in the section above.
|
Adding an instance group to a global load balancer | You cannot add an instance group to a global load balancer. This feature is disabled by the compute.disableGlobalLoadBalancing org policy constraint
described in the section above.
|
Routing requests to a multi-region external HTTPS load balancer | You cannot route requests to a multi-region external HTTPS load
balancer. This feature is disabled by the compute.restrictLoadBalancerCreationForTypes org policy
constraint described in the section above.
|
Sharing an SSD persistent disk in multi-writer mode | You cannot share an SSD persistent disk in multi-writer mode between VM instances. |
Suspending and resuming a VM instance | This feature is disabled. Suspending and resuming a VM instance requires persistent disk storage, and persistent disk storage used for storing the suspended VM state cannot currently be encrypted using CMEK. See the gcp.restrictNonCmekServices org
policy constraint in the section above to understand the data residency
implications of enabling this feature.
|
Local SSDs | This feature is disabled. You will be unable to create an instance with Local SSDs because they currently cannot be encrypted using CMEK. See the gcp.restrictNonCmekServices org
policy constraint in the section above to understand the data residency
implications of enabling this feature.
|
Guest environment |
It is possible for scripts, daemons, and binaries that are included with
the guest environment to access unencrypted at-rest and in-use data.
Depending on your VM configuration, updates to this software may be
installed by default. See
Guest environment for specific information about
each package's contents, source code, and more. These components help you meet data residency through internal security controls and processes. However, for users who want additional control, you can also curate your own images or agents and optionally use the compute.trustedImageProjects organization policy
constraint.
See the Building a custom image page for more information. |
instances.getSerialPortOutput() |
This API is disabled; you will be unable to get serial port output
from the specified instance using this API. Change the compute.disableInstanceDataAccessApis organization
policy constraint value to False to enable this API. You can also
enable and use the interactive serial port by following the instructions on
this page.
|
instances.getScreenshot() |
This API is disabled; you will be unable to get a screenshot from the
specified instance using this API. Change the compute.disableInstanceDataAccessApis organization
policy constraint value to False to enable this API. You can also
enable and use the interactive serial port by following the instructions on
this page.
|
Cloud DNS features
Feature | Description |
---|---|
Google Cloud console | Cloud DNS features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead. |
Cloud Interconnect features
Feature | Description |
---|---|
Google Cloud console | Cloud Interconnect features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead. |
High-availability (HA) VPN | You must enable high-availability (HA) VPN functionality when using Cloud Interconnect with Cloud VPN. Additionally, you must adhere to the encryption and regionalization requirements listed in this section. |
Cloud Load Balancing features
Feature | Description |
---|---|
Google Cloud console | Cloud Load Balancing features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead. |
Regional load balancers | You must use only regional load balancers with ITAR. See the following
pages for more information about configuring regional load balancers: |
Network Connectivity Center features
Feature | Description |
---|---|
Google Cloud console | Network Connectivity Center features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead. |
Cloud NAT features
Feature | Description |
---|---|
Google Cloud console | Cloud NAT features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead. |
Cloud Router features
Feature | Description |
---|---|
Google Cloud console | Cloud Router features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead. |
Cloud Storage features
Feature | Description |
---|---|
Google Cloud console | To maintain ITAR compliance, it is your responsibility to use the Jurisdictional Google Cloud console. The Jurisdictional console prevents uploading and downloading Cloud Storage objects. To upload and download Cloud Storage objects, see the Compliant API endpoints row below. |
Compliant API endpoints | You must use one of the ITAR-compliant locational endpoints with
Cloud Storage. Locational endpoints are available for all US regions,
the US multiregion, and the NAM4 predefined dual-region.
Locational endpoints are not available for dual-regions other than the
NAM4 dual-region. See
this page for more information
about locations in Cloud Storage.
|
Restrictions | You must use Cloud Storage locational endpoints to be
ITAR-compliant. For more information about Cloud Storage locational
endpoints for ITAR, see
Locational endpoints for
ITAR compliance. The following operations are not supported by locational endpoints. However, these operations do not carry customer data as defined in the data residency service terms. Therefore, you can use global endpoints for these operations as necessary without violating ITAR compliance: |
Copy and rewrite for objects | Copy and rewrite operations for objects are supported by locational endpoints if both the source and destination buckets are located in the region specified in the endpoint. However, you cannot use locational endpoints to copy or rewrite an object from one bucket to another if the buckets exist in different locations. It is possible to use global endpoints to copy or rewrite across locations, but we don't recommend it as it and may violate ITAR compliance. |
GKE features
Feature | Description |
---|---|
Cluster resource restrictions | Ensure that your cluster configuration does not use resources for
services that are unsupported in the ITAR compliance program. For example,
the following configuration is invalid because it requires enabling or
using an unsupported service:
set `binaryAuthorization.evaluationMode` to `enabled`
|
VPC features
Feature | Description |
---|---|
Google Cloud console | VPC networking features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead. |
Cloud VPN features
Feature | Description |
---|---|
Google Cloud console | Cloud VPN features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead. |
Encryption | You must use only FIPS 140-2 compliant ciphers when creating
certificates and configuring your IP security. See
this page
for more information about supported ciphers in Cloud VPN. For
guidance about selecting a cipher that conforms to FIPS 140-2 standards,
see this page. There is currently no way to change an existing cipher in Google Cloud. Ensure that you configure your cipher on your third-party appliance that's used with Cloud VPN. |
VPN endpoints | You must use only Cloud VPN endpoints that are located in the US. Ensure that your VPN gateway is configured for use in a US region only. |
What's next
- Learn about the ITAR compliance program.
- Learn which products are supported for each compliance program.