Setting up automatic policy assignment

You can set up automatic assignment of policies to SaaS applications, Google Kubernetes Engine (GKE) applications, instances, or buckets.

Prerequisites

All relevant prerequisites that apply also for manual policy assignment must be fulfilled. For details, see Backing up SaaS applications, Backing up Google Kubernetes Engine applications, Backing up instances, or Backing up buckets.
For Google Kubernetes Engine applications: The resource objects for which you want to set up automatic policy assignment must be deployed as applications (the resource object of kind: Application must be defined in the application deployment).

Considerations

Assigning policies automatically takes precedence over assigning policies manually or setting a default policy. This means that the auto-assignment conditions that are defined for the custom policy or the hycu-policy tag that is added to the preferred entity define which policy gets assigned, even if the entity already has a manually assigned policy.
If you want to assign a new policy to a SaaS application, a GKE application, an instance, or a bucket for which automatic policy assignment has been set up, define new tags, labels, or metadata as described in this topic.
An automatically assigned policy is not automatically unassigned, even if the auto-assignment conditions no longer apply (when you update the auto-assignment conditions for a policy, or when the tags, labels, or metadata of an entity change).
For methods 2 and 3: The exclude policy has the highest priority. If an entity matches the conditions for multiple policies and the exclude policy is one of them, the exclude policy is used, leaving the entity unprotected.

Methods

Method 1: Setting up policy auto-assignment for entities by using the hycu-policy tag

Entities	Instructions
SaaS applications^a	This method requires no actions in R‑Cloud. Add the `hycu-policy` tag to SaaS applications, applications in Google Kubernetes Engine, instances in Amazon EC2, Azure, or Google Compute Engine, or buckets in Amazon S3, Azure, or Google Cloud Storage. Use the following key/value pair: Key: `hycu-policy` Value: `<PolicyName>` In this case, `<PolicyName>` is the name of an R‑Cloud policy (for example, gold).
GKE applications
Instances
Buckets

^aSetting up automatic policy assignment is not supported for all SaaS applications. For more information, see Protecting SaaS applications.

Method 2: Setting up automatic policy assignment separately for entities by using labels, tags, or metadata

Entities	Instructions
SaaS applications^a	Add labels or tags to SaaS applications, and then specify the corresponding conditions for automatic policy assignment in R‑Cloud. For details, see Creating custom policies.
GKE applications	Add metadata labels to applications in Google Kubernetes Engine, and then specify the corresponding conditions for automatic policy assignment in R‑Cloud. For details, see Creating custom policies.
Instances	Add the following: Tags to instances in Amazon EC2 or Azure Labels (preferred) or custom metadata to instances in Google Compute Engine When done, specify the corresponding conditions for automatic policy assignment in R‑Cloud. For details, see Creating custom policies.  Note Keep in mind that Azure virtual machines are referred to as Azure instances in R‑Cloud.
Buckets	Add the following: Tags to buckets in Amazon S3 and Azure Labels to buckets in Google Cloud Storage When done, specify the corresponding conditions for automatic policy assignment in R‑Cloud. For details, see Creating custom policies.  Note Keep in mind that Azure storage accounts are referred to as Azure buckets in R‑Cloud.

^aSetting up automatic policy assignment is not supported for all SaaS applications. For more information, see the dedicated topic for your SaaS application in Protecting SaaS applications.

Method 3: Setting up automatic policy assignment for all the entities that belong to a source by using the hycu-source-policy label

Entities	Instructions
SaaS applications^a	This method requires no actions in your cloud provider management console. Create a custom policy and enable automatic policy assignment as described in Creating custom policies. When specifying the conditions in R‑Cloud, use the following key/value pair: Key: `hycu-source-policy` Value: `<SourceUUID>` In this case, `<SourceUUID>` is the UUID of the source that includes the entities to which the policy will be assigned. You can find the source UUID in the Summary section of any entity’s Detail view.
GKE applications
Instances
Buckets

^aSetting up automatic policy assignment is not supported for all SaaS applications. For more information, see Protecting SaaS applications.

The corresponding policies are automatically assigned to entities during the next entity synchronization in R‑Cloud.