Restrictions and limitations for Sovereign Controls for Kingdom of Saudi Arabia (KSA)

This page describes the restrictions, limitations, and other configuration options when using the Sovereign Controls for Kingdom of Saudi Arabia (KSA) control package.

Important: The Sovereign Controls for KSA control package should only be used by Assured Workloads customers whose billing address—whether a business, residence, or domicile—is based outside of KSA.

Overview

To access the Google Cloud console when using the Sovereign Controls for KSA control package, you must use one of the following URLs:

• console.sa.cloud.google.com
• console.sa.cloud.google for federated identity users

For more information, see the Jurisdictional Google Cloud console page.

The Sovereign Controls for KSA control package enables data access control and data residency features for supported Google Cloud products. Some of these services' features are restricted or limited by Google to be compatible with Sovereign Controls for KSA. Most of these restrictions and limitations are applied when creating a new Assured Workloads folder for Sovereign Controls for KSA. However, some of them can be changed later by modifying organization policies. Additionally, some restrictions and limitations require user responsibility for adherence.

It's important to understand how these restrictions modify the behavior for a given Google Cloud service or affect data access or data residency. For example, some features or capabilities may be automatically disabled to ensure that data access restrictions and data residency are maintained. Additionally, if an organization policy setting is changed, it might have the unintended consequence of copying data from one region to another.

Supported services

Unless otherwise noted, users can access all supported services through the Google Cloud console.

Important: Services that interact with Customer Data in their API operations provide regional API endpoints. These must be used instead of the service's global API endpoint in Sovereign Controls for KSA. For services whose API operations don't interact with Customer Data, using global API endpoints is allowed. See Data residency for more information about Customer Data and Service Data.

The following services are compatible with Sovereign Controls for Kingdom of Saudi Arabia (KSA):

Supported product	API endpoints	Affected features or organization policies
Access Approval	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: accessapproval.googleapis.com	None
Artifact Registry	Regional API endpoints: artifactregistry.me-central2.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
BigQuery ^[2]	Regional API endpoints: bigquery.me-central2.googleapis.com bigqueryconnection.me-central2.googleapis.com bigqueryreservation.me-central2.googleapis.com bigquerystorage.me-central2.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Bigtable	Regional API endpoints: bigtable.me-central2.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Cloud DNS	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: dns.googleapis.com	None
Cloud HSM	Regional API endpoints: cloudkms.me-central2.rep.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Cloud Interconnect	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: networkconnectivity.googleapis.com	Affected features
Cloud Key Management Service (Cloud KMS)	Regional API endpoints: cloudkms.me-central2.rep.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Cloud Load Balancing	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: compute.googleapis.com	None
Cloud Logging	Regional API endpoints: logging.me-central2.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Cloud Monitoring	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: monitoring.googleapis.com	None
Cloud NAT	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: networkconnectivity.googleapis.com	None
Cloud Router	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: networkconnectivity.googleapis.com	None
Cloud SQL	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: sqladmin.googleapis.com	None
Cloud Storage	Regional API endpoints: storage.me-central2.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Cloud VPN	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: compute.googleapis.com	None
Compute Engine	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: compute.googleapis.com	Affected features and organization policy constraints
Dataflow	Regional API endpoints: dataflow.me-central2.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Dataproc	Regional API endpoints: dataproc.me-central2.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Essential Contacts	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: essentialcontacts.googleapis.com	None
GKE Hub	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: gkehub.googleapis.com	None
Google Cloud console	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: N/A	None
Google Kubernetes Engine	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: container.googleapis.com containersecurity.googleapis.com	Affected features and organization policy constraints
Identity and Access Management (IAM)	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: iam.googleapis.com	None
Identity-Aware Proxy	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: iap.googleapis.com	None
Network Connectivity Center	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: networkconnectivity.googleapis.com	None
Organization Policy Service	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: orgpolicy.googleapis.com	None
Persistent Disk	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: compute.googleapis.com	None
Pub/Sub	Regional API endpoints: pubsub.me-central2.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Resource Manager	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: cloudresourcemanager.googleapis.com	None
Resource Settings	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: resourcesettings.googleapis.com	None
Service Directory	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: servicedirectory.googleapis.com	None
Spanner	Regional API endpoints: spanner.me-central2.googleapis.com Locational API endpoints are not supported. Global API endpoints are not supported.	None
Virtual Private Cloud	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: vpcaccess.googleapis.com	None
VPC Service Controls	Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints: accesscontextmanager.googleapis.com	None

Organization policies

This section describes how each service is affected by the default organization policy constraint values when folders or projects are created using Sovereign Controls for KSA. Other applicable constraints—even if not set by default—can provide additional "defense-in-depth" to further protect your organization's Google Cloud resources.

Important: We strongly recommend not changing the values of the required organization policy constraints listed in the following sections. Doing so may undermine data residency. When such a change has been made, the effects of such change are difficult or impossible to reverse. Ensure that you understand the ramifications of changing an organization policy constraint's value before proceeding.

Additionally, ensure that any automated mechanisms your organization uses to manage organization policies are updated to prevent these values from being changed unintentionally.

Cloud-wide organization policy constraints

The following organization policy constraints apply across any applicable Google Cloud service.

Organization policy constraint	Description
gcp.resourceLocations	Set to in:us-locations as the allowedValues list item. This value restricts creation of any new resources to the me-central2 value group only. When set, no resources can be created in any other regions, multi-regions, or locations outside of KSA. See the Organization policy value groups documentation for more information. Changing this value by making it less restrictive potentially undermines data residency by allowing data to be created or stored outside the KSA data boundary.
gcp.restrictServiceUsage	Set to allow all supported services. Determines which services can be enabled and used. For more information, see Restrict resource usage for workloads.

Compute Engine organization policy constraints

Organization policy constraint	Description
compute.disableInstanceDataAccessApis	Set to True. Globally disables the instances.getSerialPortOutput() and instances.getScreenshot() APIs. Enabling this organization policy prevents you from generating credentials on Windows Server VMs. If you need to manage a username and password on a Windows VM, do the following: Enable SSH for Windows VMs. Run the following command to change the VM's password: gcloud compute ssh VM_NAME --command "net user USERNAME PASSWORD" Replace the following: VM_NAME: The name of the VM you're setting the password for. USERNAME: The username of the user who you're setting the password for. PASSWORD: The new password.
compute.enableComplianceMemoryProtection	Set to True. Disables some internal diagnostic features to provide additional protection of memory contents when an infrastructure fault occurs. Changing this value may affect data residency in your workload; we recommend keeping the set value.

Google Kubernetes Engine organization policy constraints

Organization policy constraint	Description
container.restrictNoncompliantDiagnosticDataAccess	Set to True. Used to disable aggregate analysis of kernel issues, which is required to maintain sovereign control of a workload. Changing this value may affect data sovereignty in your workload; we recommend keeping the set value.

Affected features

This section lists how each service's features or capabilities are affected by Sovereign Controls for KSA, including user requirements when using a feature.

Compute Engine features

Feature	Description
Google Cloud console	The following Compute Engine features are not available in the Google Cloud console. Use the API or Google Cloud CLI where available: Health checks Network endpoint groups Browser-based SSH is disabled
instances.getSerialPortOutput()	This API is disabled; you will be unable to get serial port output from the specified instance using this API. Change the compute.disableInstanceDataAccessApis organization policy constraint value to False to enable this API. You can also enable and use the interactive serial port.
instances.getScreenshot()	This API is disabled; you will be unable to get a screenshot from the specified instance using this API. Change the compute.disableInstanceDataAccessApis organization policy constraint value to False to enable this API. You can also enable and use the interactive serial port.

Cloud Interconnect features

Feature	Description
High-availability (HA) VPN	You must enable high-availability (HA) VPN functionality when using Cloud Interconnect with Cloud VPN. Additionally, you must adhere to the encryption and regionalization requirements listed in this section.

Cloud Storage features

Feature	Description
Google Cloud console	It is your responsibility to use the Jurisdictional Google Cloud console for Sovereign Controls for KSA. The Jurisdictional console prevents uploading and downloading Cloud Storage objects. To upload and download Cloud Storage objects, see the following Compliant API endpoints row.
Compliant API endpoints	It is your responsibility to use one of the locational endpoints with Cloud Storage. See Cloud Storage locations for more information.

Cloud VPN features

Feature	Description
Google Cloud console	Cloud VPN features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead.

Footnotes

1. BigQuery is supported, but it isn't automatically enabled when you create a new Assured Workloads folder due to an internal configuration process. This process normally finishes in ten minutes, but can take much longer in some circumstances. To check whether the process is finished and to enable BigQuery, complete following steps:

1. In the Google Cloud console, go to the Assured Workloads page.

   Go to Assured Workloads

2. Select your new Assured Workloads folder from the list.
3. On the Folder Details page in the Allowed services section, click Review Available Updates.
4. In the Allowed services pane, review the services to be added to the Resource Usage Restriction organization policy for the folder. If BigQuery services are listed, click Allow Services to add them.
   
   If BigQuery services are not listed, wait for the internal process to complete. If the services are not listed within 12 hours of folder creation, contact Cloud Customer Care.

After the enablement process is completed, you can use BigQuery in your Assured Workloads folder.