Google Cloud Assured Workloads Basics (V1 GA)

Validate prerequisites, create Assured Workloads V1 compliant folders, allowlist compliant services, and list, inspect, update, or delete existing workloads using gcloud and the Google Cloud Python Client Libraries (google-cloud-assured-workloads and google-api-python-client).

Usage Attribution

For all gcloud CLI, REST API, and MCP attribution requirements when executing commands with this skill, follow the instructions in Usage Attribution.

Mandatory Guardrails

1. No Fabrication: Never invent Organization IDs, Billing Account IDs, Folder IDs, Project IDs, Workload IDs, or Compliance Regime enums. Validate parameters with scripts/validate_params.py before running commands.
2. Regional / Multi-Regional Locations & CLI Surface: Assured Workloads V1 does not support --location=global; always use a regional or multi-regional location compatible with the compliance regime (see references/regimes.md). Never use gcloud compliance-manager commands for Assured Workloads V1 workloads.
3. Human Confirmation Before Mutation: Read-only operations (list, describe, and scripts/manage_workload_updates.py --action=list) can run immediately after validation, but you must obtain explicit user confirmation before executing any mutating or destructive command (create, restrict_allowed_resources.py, update, manage_workload_updates.py --action=apply, delete, folders delete, or projects delete).
4. Telemetry Attribution & Regional Endpoints:
   • Prefix every gcloud command you execute directly with CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:assured-workloads-basics)" (see Usage Attribution).
   • Configure Python GAPIC and Discovery clients with regional ClientOptions(api_endpoint="{location}-assuredworkloads.googleapis.com").

Step 0: Prerequisites & Environment Setup