A security engineer needs to author a custom constraint rule using Common Expression Language (CEL) to enforce cryptographic key hygiene across an organization's resource hierarchy. The organization's compliance standard requires that: Every Cloud KMS key (cloudkms.googleapis.com/CryptoKey) must explicitly specify an automated rotation period. The rotation period configured on the key must be strictly less than 60 hours. Which CEL condition should be configured in the custom rule definition to evaluate resource properties and satisfy these requirements?

has(resource.data.rotationPeriod) && resource.data.rotationPeriod < duration('60h'): What the Solution Is This expression uses standard Common Expression Language (CEL) syntax supported across Google Cloud custom controls and constraints. It uses the has() field selection macro to verify presence and the built-in duration() function to evaluate time-based protobuf fields against a duration literal. How It Meets the Requirements Field existence validation: The has(resource.data.rotationPeriod) macro inspects the underlying Google Cloud resource API definition to verify whether the rotationPeriod field has been explicitly defined on the CryptoKey object before attempting value comparisons. Duration type comparison: The expression resource.data.rotationPeriod < duration('60h') converts the string literal '60h' into a native CEL duration type, enabling a valid relational comparison against the protobuf duration property defined on the resource. Short-circuit logical conjunction: The logical && operator guarantees that the duration comparison is only evaluated if rotationPeriod exists, preventing null pointer or runtime field access errors. Key Advantages and Capabilities Native protobuf interoperability: Correctly handles Protocol Buffer v3 fields where unset fields are represented as missing rather than explicit null values. Type-safe evaluation: Avoids runtime type coercion errors by explicitly casting the comparison operand to a CEL duration object. Standardized time units: Supports standard duration string suffixes (e.g., 'h' for hours, 'm' for minutes, 's' for seconds) for clear, maintainable policy authoring. Hierarchy-wide enforcement: Can be deployed at the organization, folder, or project level to evaluate KMS resources across the entire resource tree. Why This Is Optimal In Google Cloud policy definitions, CEL does not automatically coerce string representations of time into duration objects, nor does it allow direct access to unset protobuf message fields without checking presence. Combining has() with duration('60h') provides the exact syntax required for robust, error-free policy evaluation.

Cel Custom Constraint Kms Key Rotation | Professional Cloud Security Engineer

StudyCerts

Explanations

What the Solution Is

This expression uses standard Common Expression Language (CEL) syntax supported across Google Cloud custom controls and constraints. It uses the has() field selection macro to verify presence and the built-in duration() function to evaluate time-based protobuf fields against a duration literal.

How It Meets the Requirements

Field existence validation: The has(resource.data.rotationPeriod) macro inspects the underlying Google Cloud resource API definition to verify whether the rotationPeriod field has been explicitly defined on the CryptoKey object before attempting value comparisons.
Duration type comparison: The expression resource.data.rotationPeriod < duration('60h') converts the string literal '60h' into a native CEL duration type, enabling a valid relational comparison against the protobuf duration property defined on the resource.
Short-circuit logical conjunction: The logical && operator guarantees that the duration comparison is only evaluated if rotationPeriod exists, preventing null pointer or runtime field access errors.

Key Advantages and Capabilities

Native protobuf interoperability: Correctly handles Protocol Buffer v3 fields where unset fields are represented as missing rather than explicit null values.
Type-safe evaluation: Avoids runtime type coercion errors by explicitly casting the comparison operand to a CEL duration object.
Standardized time units: Supports standard duration string suffixes (e.g., 'h' for hours, 'm' for minutes, 's' for seconds) for clear, maintainable policy authoring.
Hierarchy-wide enforcement: Can be deployed at the organization, folder, or project level to evaluate KMS resources across the entire resource tree.

Why This Is Optimal

In Google Cloud policy definitions, CEL does not automatically coerce string representations of time into duration objects, nor does it allow direct access to unset protobuf message fields without checking presence. Combining has() with duration('60h') provides the exact syntax required for robust, error-free policy evaluation.

View source documentation

Professional Cloud Security Engineer

Cel Custom Constraint Kms Key Rotation