A security engineer needs to author a custom constraint rule using Common Expression Language (CEL) to enforce cryptographic key hygiene across an organization's resource hierarchy. The organization's compliance standard requires that: Every Cloud KMS key (cloudkms.googleapis.com/CryptoKey) must explicitly specify an automated rotation period. The rotation period configured on the key must be strictly less than 60 hours. Which CEL condition should be configured in the custom rule definition to evaluate resource properties and satisfy these requirements?

has(resource.data.rotationPeriod) && resource.data.rotationPeriod < duration('60h'): ### What the Solution Is This expression uses standard **Common Expression Language (CEL)** syntax supported across Google Cloud custom controls and constraints. It uses the `has()` field selection macro to verify presence and the built-in `duration()` function to evaluate time-based protobuf fields against a duration literal. ### How It Meets the Requirements - **Field existence validation**: The `has(resource.data.rotationPeriod)` macro inspects the underlying Google Cloud resource API definition to verify whether the `rotationPeriod` field has been explicitly defined on the `CryptoKey` object before attempting value comparisons. - **Duration type comparison**: The expression `resource.data.rotationPeriod < duration('60h')` converts the string literal `'60h'` into a native CEL duration type, enabling a valid relational comparison against the protobuf duration property defined on the resource. - **Short-circuit logical conjunction**: The logical `&&` operator guarantees that the duration comparison is only evaluated if `rotationPeriod` exists, preventing null pointer or runtime field access errors. ### Key Advantages and Capabilities - **Native protobuf interoperability**: Correctly handles Protocol Buffer v3 fields where unset fields are represented as missing rather than explicit null values. - **Type-safe evaluation**: Avoids runtime type coercion errors by explicitly casting the comparison operand to a CEL `duration` object. - **Standardized time units**: Supports standard duration string suffixes (e.g., `'h'` for hours, `'m'` for minutes, `'s'` for seconds) for clear, maintainable policy authoring. - **Hierarchy-wide enforcement**: Can be deployed at the organization, folder, or project level to evaluate KMS resources across the entire resource tree. ### Why This Is Optimal In Google Cloud policy definitions, CEL does not automatically coerce string representations of time into duration objects, nor does it allow direct access to unset protobuf message fields without checking presence. Combining `has()` with `duration('60h')` provides the exact syntax required for robust, error-free policy evaluation.