Soft mandatory is a policy enforcement mode for requirements that may have legitimate exceptions. A failed check routes the change for manual review and approval instead of treating every failure as an automatic prohibition. The reviewer evaluates the justification before the resource or configuration reaches production. section 8.3.4 section 12.1.1
Apply soft mandatory enforcement when a default is desirable but specialized or exceptional cases are valid:
- Review larger-than-default machine types when a workload needs additional vCPUs, memory, or a specialized architecture. section 12.1.1
- Audit persistent testing resources that need an exemption from the normal expiration-tag requirement. section 12.2.5
- Require security review for exceptional firewall rules, such as public access needed by customers. section 8.3.4
Machine-size policy test
A policy test parses server configurations, retrieves the selected machine type's vCPU count from a cloud API, and checks it against a 32-vCPU limit. A larger machine can proceed only after the team reviews and approves the business justification. section 12.1.1
Listing 12.2 Writing a policy test to check that servers do not exceed 32 vCPUs
import pytest
import os
import compute
import json
ENVIRONMENTS = ['testing', 'prod'] #1
CONFIGURATION_FILE = 'main.tf.json' #1
PROJECT = os.environ['CLOUDSDK_CORE_PROJECT'] #1
@pytest.fixture(scope="module") #1
def configuration(): #1
merged = [] #1
for environment in ENVIRONMENTS: #1
with open(f'{environment}/{CONFIGURATION_FILE}', 'r') as f: #1
environment_configuration = json.load(f) #1
merged += environment_configuration['resource'] #1
return merged #1
def resources(configuration, resource_type): #1
resource_list = [] #1
for resource in configuration: #1
if resource_type in resource.keys(): #1
resource_name = list( #1
resource[resource_type].keys())[0] #1
resource_list.append( #1
resource[resource_type] #1
[resource_name]) #1
return resource_list #1
@pytest.fixture #1
def servers(configuration): #1
return resources(configuration,
'google_compute_instance')
def test_cpu_size_less_than_or_equal_to_limit(servers):
CPU_LIMIT = 32 #2
non_compliant_servers = [] #3
for server in servers:
type = compute.get_machine_type( #4
PROJECT, server['zone'], #4
server['machine_type']) #4
if type.cpus > CPU_LIMIT: #5
non_compliant_servers.append(server['name']) #5
assert len(non_compliant_servers) == 0, \ #6
f'Servers found using over {CPU_LIMIT}' + \ #6
f' vCPUs: {non_compliant_servers}' #6
Inspect the policy-test listing to see how environments and infrastructure configuration are gathered before enforcing a resource limit. section 12.1.1
