Restrictions and limitations for Sovereign Controls for Kingdom of Saudi Arabia (KSA)
This page describes the restrictions, limitations, and other configuration options when using the Sovereign Controls for Kingdom of Saudi Arabia (KSA) control package.
Overview
The Sovereign Controls for KSA control package enables data access control and data residency features for supported Google Cloud products. Some of these services' features are restricted or limited by Google to be compatible with Sovereign Controls for KSA. Most of these restrictions and limitations are applied when creating a new Assured Workloads folder for Sovereign Controls for KSA. However, some of them can be changed later by modifying organization policies. Additionally, some restrictions and limitations require user responsibility for adherence.
It's important to understand how these restrictions modify the behavior for a given Google Cloud service or affect data access or data residency. For example, some features or capabilities may be automatically disabled to ensure that data access restrictions and data residency are maintained. Additionally, if an organization policy setting is changed, it might have the unintended consequence of copying data from one region to another.
Supported services
Unless otherwise noted, users can access all supported services through the Google Cloud console.
The following services are compatible with Sovereign Controls for Kingdom of Saudi Arabia (KSA):
Supported product | API endpoints | Restrictions or limitations |
---|---|---|
Access Approval |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Artifact Registry |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
BigQuery |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
Bigtable |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
Google Cloud console |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Compute Engine |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
Affected features and organization policy constraints |
Cloud DNS |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Dataflow |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
Dataproc |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
Essential Contacts |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Filestore |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Cloud Storage |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
Affected features |
Google Kubernetes Engine |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
Organization policy constraints |
GKE Hub |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Cloud HSM |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
Identity and Access Management (IAM) |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Identity-Aware Proxy (IAP) |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Cloud Interconnect |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
Affected features |
Cloud Key Management Service (Cloud KMS) |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
Cloud Load Balancing |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Cloud Logging |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
Cloud Monitoring |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
Affected features |
Cloud NAT |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Network Connectivity Center |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Organization Policy Service |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Persistent Disk |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Pub/Sub |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
Resource Manager |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Resource Settings |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Cloud Router |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Cloud Run |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Cloud SQL |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Service Directory |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Spanner |
Regional API endpoints:
Locational API endpoints are not supported. Global API endpoints are not supported. |
None |
Virtual Private Cloud (VPC) |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
VPC Service Controls |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
None |
Cloud VPN |
Regional API endpoints are not supported. Locational API endpoints are not supported. Global API endpoints:
|
Affected features |
Organization policies
This section describes how each service is affected by the default organization policy constraint values when folders or projects are created using Sovereign Controls for KSA. Other applicable constraints—even if not set by default—can provide additional "defense-in-depth" to further protect your organization's Google Cloud resources.
Cloud-wide organization policy constraints
The following organization policy constraints apply across any applicable Google Cloud service.
Organization policy constraint | Description |
---|---|
gcp.resourceLocations |
Set to in:us-locations as the allowedValues
list item.This value restricts creation of any new resources to the me-central2 value group only. When set, no resources can be
created in any other regions, multi-regions, or locations outside of
KSA. See the
Organization policy value groups
documentation for more information.Changing this value by making it less restrictive potentially undermines data residency by allowing data to be created or stored outside the KSA data boundary. |
gcp.restrictServiceUsage |
Set to allow all supported services. Determines which services can be enabled and used. For more information, see Restrict resource usage for workloads. |
Compute Engine organization policy constraints
Organization policy constraint | Description |
---|---|
compute.disableInstanceDataAccessApis |
Set to True. Globally disables the instances.getSerialPortOutput() and
instances.getScreenshot() APIs.Enabling this organization policy prevents you from generating credentials on Windows Server VMs. If you need to manage a username and password on a Windows VM, do the following:
|
compute.enableComplianceMemoryProtection |
Set to True. Disables some internal diagnostic features to provide additional protection of memory contents when an infrastructure fault occurs. Changing this value may affect data residency in your workload; we recommend keeping the set value. |
Google Kubernetes Engine organization policy constraints
Organization policy constraint | Description |
---|---|
container.restrictNoncompliantDiagnosticDataAccess |
Set to True. Used to disable aggregate analysis of kernel issues, which is required to maintain sovereign control of a workload. Changing this value may affect data sovereignty in your workload; we recommend keeping the set value. |
Affected features
This section lists how each service's features or capabilities are affected by Sovereign Controls for KSA, including user requirements when using a feature.
Compute Engine features
Feature | Description |
---|---|
Google Cloud console | The following Compute Engine features are not available in the
Google Cloud console. Use the API or Google Cloud CLI where available:
|
instances.getSerialPortOutput() |
This API is disabled; you will be unable to get serial port output
from the specified instance using this API. Change the compute.disableInstanceDataAccessApis organization
policy constraint value to False to enable this API. You can also
enable and use the interactive serial port.
|
instances.getScreenshot() |
This API is disabled; you will be unable to get a screenshot from the
specified instance using this API. Change the compute.disableInstanceDataAccessApis organization
policy constraint value to False to enable this API. You can also
enable and use the interactive serial port.
|
Cloud Interconnect features
Feature | Description |
---|---|
High-availability (HA) VPN | You must enable high-availability (HA) VPN functionality when using Cloud Interconnect with Cloud VPN. Additionally, you must adhere to the encryption and regionalization requirements listed in this section. |
Cloud Monitoring features
Feature | Description |
---|---|
Synthetic Monitor | This feature is disabled. |
Uptime check | This feature is disabled. |
Log panel widgets in Dashboards | This feature is disabled. You cannot add a log panel to a dashboard. |
Error reporting panel widgets in Dashboards | This feature is disabled. You cannot add an error reporting panel to a dashboard. |
Filter in
EventAnnotation
for Dashboards
|
This feature is disabled. Filter of EventAnnotation
cannot be set in a dashboard.
|
SqlCondition
in alertPolicies
|
This feature is disabled. You cannot add a SqlCondition to an
alertPolicy .
|
Cloud Storage features
Feature | Description |
---|---|
Google Cloud console | It is your responsibility to use the Jurisdictional Google Cloud console for Sovereign Controls for KSA. The Jurisdictional console prevents uploading and downloading Cloud Storage objects. To upload and download Cloud Storage objects, see the following Compliant API endpoints row. |
Compliant API endpoints | It is your responsibility to use one of the locational endpoints with Cloud Storage. See Cloud Storage locations for more information. |
Cloud VPN features
Feature | Description |
---|---|
Google Cloud console | Cloud VPN features are not available in the Google Cloud console. Use the API or Google Cloud CLI instead. |
Footnotes
1. BigQuery is supported, but it isn't automatically enabled when you create a new
Assured Workloads folder due to an internal configuration process. This process normally
finishes in ten minutes, but can take much longer in some circumstances. To check whether the
process is finished and to enable BigQuery, complete following steps:
- In the Google Cloud console, go to the Assured Workloads page.
- Select your new Assured Workloads folder from the list.
- On the Folder Details page in the Allowed services section, click Review Available Updates.
- In the Allowed services pane, review the services to be added to the
Resource Usage Restriction
organization policy for the folder. If BigQuery services are listed, click
Allow Services to add them.
If BigQuery services are not listed, wait for the internal process to complete. If the services are not listed within 12 hours of folder creation, contact Cloud Customer Care.
After the enablement process is completed, you can use BigQuery in your Assured Workloads folder.
Gemini in BigQuery is not supported by Assured Workloads.