workloads

Creates, updates, deletes, gets or lists a workloads resource.

Overview

Name	workloads
Type	Resource
Id	google.assuredworkloads.workloads

Fields

The following fields are returned by SELECT queries:

get

Successful response

Name	Datatype	Description
name	string	Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only.
billingAccount	string	Optional. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form billingAccounts/{billing_account_id}. For example, billingAccounts/012345-567890-ABCDEF.
complianceRegime	string	Required. Immutable. Compliance Regime associated with this workload.
complianceStatus	object	Output only. Count of active Violations in the Workload. (id: GoogleCloudAssuredworkloadsV1WorkloadComplianceStatus)
compliantButDisallowedServices	array	Output only. Urls for services which are compliant for this Assured Workload, but which are currently disallowed by the ResourceUsageRestriction org policy. Invoke RestrictAllowedResources endpoint to allow your project developers to use these services in their environment.
createTime	string (google-datetime)	Output only. Immutable. The Workload creation timestamp.
displayName	string	Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload
ekmProvisioningResponse	object	Output only. Represents the Ekm Provisioning State of the given workload. (id: GoogleCloudAssuredworkloadsV1WorkloadEkmProvisioningResponse)
enableSovereignControls	boolean	Optional. Indicates the sovereignty status of the given workload. Currently meant to be used by Europe/Canada customers.
etag	string	Optional. ETag of the workload, it is calculated on the basis of the Workload contents. It will be used in Update & Delete operations.
kajEnrollmentState	string	Output only. Represents the KAJ enrollment state of the given workload.
kmsSettings	object	Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS CMEK key is provisioned. This field is deprecated as of Feb 28, 2022. In order to create a Keyring, callers should specify, ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field. (id: GoogleCloudAssuredworkloadsV1WorkloadKMSSettings)
labels	object	Optional. Labels applied to the workload.
partner	string	Optional. Partner regime associated with this workload.
partnerPermissions	object	Optional. Permissions granted to the AW Partner SA account for the customer workload (id: GoogleCloudAssuredworkloadsV1WorkloadPartnerPermissions)
partnerServicesBillingAccount	string	Optional. Billing account necessary for purchasing services from Sovereign Partners. This field is required for creating SIA/PSN/CNTXT partner workloads. The caller should have 'billing.resourceAssociations.create' IAM permission on this billing-account. The format of this string is billingAccounts/AAAAAA-BBBBBB-CCCCCC
provisionedResourcesParent	string	Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}
resourceMonitoringEnabled	boolean	Output only. Indicates whether resource monitoring is enabled for workload or not. It is true when Resource feed is subscribed to AWM topic and AWM Service Agent Role is binded to AW Service Account for resource Assured workload.
resourceSettings	array	Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.
resources	array	Output only. The resources associated with this workload. These resources will be created when creating the workload. If any of the projects already exist, the workload creation will fail. Always read only.
saaEnrollmentResponse	object	Output only. Represents the SAA enrollment response of the given workload. SAA enrollment response is queried during GetWorkload call. In failure cases, user friendly error message is shown in SAA details page. (id: GoogleCloudAssuredworkloadsV1WorkloadSaaEnrollmentResponse)
violationNotificationsEnabled	boolean	Optional. Indicates whether the e-mail notification for a violation is enabled for a workload. This value will be by default True, and if not present will be considered as true. This should only be updated via updateWorkload call. Any Changes to this field during the createWorkload call will not be honored. This will always be true while creating the workload.
workloadOptions	object	Optional. Options to be set for the given created workload. (id: GoogleCloudAssuredworkloadsV1WorkloadWorkloadOptions)

list

Successful response

Name	Datatype	Description
name	string	Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only.
billingAccount	string	Optional. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form billingAccounts/{billing_account_id}. For example, billingAccounts/012345-567890-ABCDEF.
complianceRegime	string	Required. Immutable. Compliance Regime associated with this workload.
complianceStatus	object	Output only. Count of active Violations in the Workload. (id: GoogleCloudAssuredworkloadsV1WorkloadComplianceStatus)
compliantButDisallowedServices	array	Output only. Urls for services which are compliant for this Assured Workload, but which are currently disallowed by the ResourceUsageRestriction org policy. Invoke RestrictAllowedResources endpoint to allow your project developers to use these services in their environment.
createTime	string (google-datetime)	Output only. Immutable. The Workload creation timestamp.
displayName	string	Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload
ekmProvisioningResponse	object	Output only. Represents the Ekm Provisioning State of the given workload. (id: GoogleCloudAssuredworkloadsV1WorkloadEkmProvisioningResponse)
enableSovereignControls	boolean	Optional. Indicates the sovereignty status of the given workload. Currently meant to be used by Europe/Canada customers.
etag	string	Optional. ETag of the workload, it is calculated on the basis of the Workload contents. It will be used in Update & Delete operations.
kajEnrollmentState	string	Output only. Represents the KAJ enrollment state of the given workload.
kmsSettings	object	Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS CMEK key is provisioned. This field is deprecated as of Feb 28, 2022. In order to create a Keyring, callers should specify, ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field. (id: GoogleCloudAssuredworkloadsV1WorkloadKMSSettings)
labels	object	Optional. Labels applied to the workload.
partner	string	Optional. Partner regime associated with this workload.
partnerPermissions	object	Optional. Permissions granted to the AW Partner SA account for the customer workload (id: GoogleCloudAssuredworkloadsV1WorkloadPartnerPermissions)
partnerServicesBillingAccount	string	Optional. Billing account necessary for purchasing services from Sovereign Partners. This field is required for creating SIA/PSN/CNTXT partner workloads. The caller should have 'billing.resourceAssociations.create' IAM permission on this billing-account. The format of this string is billingAccounts/AAAAAA-BBBBBB-CCCCCC
provisionedResourcesParent	string	Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}
resourceMonitoringEnabled	boolean	Output only. Indicates whether resource monitoring is enabled for workload or not. It is true when Resource feed is subscribed to AWM topic and AWM Service Agent Role is binded to AW Service Account for resource Assured workload.
resourceSettings	array	Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.
resources	array	Output only. The resources associated with this workload. These resources will be created when creating the workload. If any of the projects already exist, the workload creation will fail. Always read only.
saaEnrollmentResponse	object	Output only. Represents the SAA enrollment response of the given workload. SAA enrollment response is queried during GetWorkload call. In failure cases, user friendly error message is shown in SAA details page. (id: GoogleCloudAssuredworkloadsV1WorkloadSaaEnrollmentResponse)
violationNotificationsEnabled	boolean	Optional. Indicates whether the e-mail notification for a violation is enabled for a workload. This value will be by default True, and if not present will be considered as true. This should only be updated via updateWorkload call. Any Changes to this field during the createWorkload call will not be honored. This will always be true while creating the workload.
workloadOptions	object	Optional. Options to be set for the given created workload. (id: GoogleCloudAssuredworkloadsV1WorkloadWorkloadOptions)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	organizationsId, locationsId, workloadsId		Gets Assured Workload associated with a CRM Node
list	select	organizationsId, locationsId	pageSize, pageToken, filter	Lists Assured Workloads under a CRM Node.
create	insert	organizationsId, locationsId	externalId	Creates Assured Workload.
patch	update	organizationsId, locationsId, workloadsId	updateMask	Updates an existing workload. Currently allows updating of workload display_name and labels. For force updates don't set etag field in the Workload. Only one update operation per workload can be in progress.
delete	delete	organizationsId, locationsId, workloadsId	etag	Deletes the workload. Make sure that workload's direct children are already in a deleted state, otherwise the request will fail with a FAILED_PRECONDITION error. In addition to assuredworkloads.workload.delete permission, the user should also have orgpolicy.policy.set permission on the deleted folder to remove Assured Workloads OrgPolicies.
restrict_allowed_resources	exec	organizationsId, locationsId, workloadsId		Restrict the list of resources allowed in the Workload environment. The current list of allowed products can be found at https://cloud.google.com/assured-workloads/docs/supported-products In addition to assuredworkloads.workload.update permission, the user should also have orgpolicy.policy.set permission on the folder resource to use this functionality.
analyze_workload_move	exec	organizationsId, locationsId, workloadsId	project, pageSize, pageToken, assetTypes	Analyzes a hypothetical move of a source resource to a target workload to surface compliance risks. The analysis is best effort and is not guaranteed to be exhaustive.
mutate_partner_permissions	exec	organizationsId, locationsId, workloadsId		Update the permissions settings for an existing partner workload. For force updates don't set etag field in the Workload. Only one update operation per workload can be in progress.
enable_resource_monitoring	exec	organizationsId, locationsId, workloadsId		Enable resource violation monitoring for a workload.
enable_compliance_updates	exec	organizationsId, locationsId, workloadsId		This endpoint enables Assured Workloads service to offer compliance updates for the folder based assured workload. It sets up an Assured Workloads Service Agent, having permissions to read compliance controls (for example: Org Policies) applied on the workload. The caller must have resourcemanager.folders.getIamPolicy and resourcemanager.folders.setIamPolicy permissions on the assured workload folder.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
locationsId	string
organizationsId	string
workloadsId	string
assetTypes	string
etag	string
externalId	string
filter	string
pageSize	integer (int32)
pageToken	string
project	string
updateMask	string (google-fieldmask)

SELECT examples

get

Gets Assured Workload associated with a CRM Node

SELECT
name,
billingAccount,
complianceRegime,
complianceStatus,
compliantButDisallowedServices,
createTime,
displayName,
ekmProvisioningResponse,
enableSovereignControls,
etag,
kajEnrollmentState,
kmsSettings,
labels,
partner,
partnerPermissions,
partnerServicesBillingAccount,
provisionedResourcesParent,
resourceMonitoringEnabled,
resourceSettings,
resources,
saaEnrollmentResponse,
violationNotificationsEnabled,
workloadOptions
FROM google.assuredworkloads.workloads
WHERE organizationsId = '{{ organizationsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND workloadsId = '{{ workloadsId }}' -- required;

list

Lists Assured Workloads under a CRM Node.

SELECT
name,
billingAccount,
complianceRegime,
complianceStatus,
compliantButDisallowedServices,
createTime,
displayName,
ekmProvisioningResponse,
enableSovereignControls,
etag,
kajEnrollmentState,
kmsSettings,
labels,
partner,
partnerPermissions,
partnerServicesBillingAccount,
provisionedResourcesParent,
resourceMonitoringEnabled,
resourceSettings,
resources,
saaEnrollmentResponse,
violationNotificationsEnabled,
workloadOptions
FROM google.assuredworkloads.workloads
WHERE organizationsId = '{{ organizationsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND pageSize = '{{ pageSize }}'
AND pageToken = '{{ pageToken }}'
AND filter = '{{ filter }}';

INSERT examples

create

Creates Assured Workload.

INSERT INTO google.assuredworkloads.workloads (
data__name,
data__displayName,
data__complianceRegime,
data__billingAccount,
data__etag,
data__labels,
data__provisionedResourcesParent,
data__kmsSettings,
data__resourceSettings,
data__enableSovereignControls,
data__partner,
data__partnerPermissions,
data__partnerServicesBillingAccount,
data__violationNotificationsEnabled,
data__workloadOptions,
organizationsId,
locationsId,
externalId
)
SELECT 
'{{ name }}',
'{{ displayName }}',
'{{ complianceRegime }}',
'{{ billingAccount }}',
'{{ etag }}',
'{{ labels }}',
'{{ provisionedResourcesParent }}',
'{{ kmsSettings }}',
'{{ resourceSettings }}',
{{ enableSovereignControls }},
'{{ partner }}',
'{{ partnerPermissions }}',
'{{ partnerServicesBillingAccount }}',
{{ violationNotificationsEnabled }},
'{{ workloadOptions }}',
'{{ organizationsId }}',
'{{ locationsId }}',
'{{ externalId }}'
RETURNING
name,
done,
error,
metadata,
response
;

Manifest

# Description fields are for documentation purposes
- name: workloads
  props:
    - name: organizationsId
      value: string
      description: Required parameter for the workloads resource.
    - name: locationsId
      value: string
      description: Required parameter for the workloads resource.
    - name: name
      value: string
      description: >
        Optional. The resource name of the workload. Format: organizations/{organization}/locations/{location}/workloads/{workload} Read-only.
        
    - name: displayName
      value: string
      description: >
        Required. The user-assigned display name of the Workload. When present it must be between 4 to 30 characters. Allowed characters are: lowercase and uppercase letters, numbers, hyphen, and spaces. Example: My Workload
        
    - name: complianceRegime
      value: string
      description: >
        Required. Immutable. Compliance Regime associated with this workload.
        
      valid_values: ['COMPLIANCE_REGIME_UNSPECIFIED', 'IL4', 'CJIS', 'FEDRAMP_HIGH', 'FEDRAMP_MODERATE', 'US_REGIONAL_ACCESS', 'HIPAA', 'HITRUST', 'EU_REGIONS_AND_SUPPORT', 'CA_REGIONS_AND_SUPPORT', 'ITAR', 'AU_REGIONS_AND_US_SUPPORT', 'ASSURED_WORKLOADS_FOR_PARTNERS', 'ISR_REGIONS', 'ISR_REGIONS_AND_SUPPORT', 'CA_PROTECTED_B', 'IL5', 'IL2', 'JP_REGIONS_AND_SUPPORT', 'KSA_REGIONS_AND_SUPPORT_WITH_SOVEREIGNTY_CONTROLS', 'REGIONAL_CONTROLS', 'HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS', 'HEALTHCARE_AND_LIFE_SCIENCES_CONTROLS_US_SUPPORT', 'IRS_1075', 'CANADA_CONTROLLED_GOODS', 'AUSTRALIA_DATA_BOUNDARY_AND_SUPPORT', 'CANADA_DATA_BOUNDARY_AND_SUPPORT', 'DATA_BOUNDARY_FOR_CANADA_CONTROLLED_GOODS', 'DATA_BOUNDARY_FOR_CANADA_PROTECTED_B', 'DATA_BOUNDARY_FOR_CJIS', 'DATA_BOUNDARY_FOR_FEDRAMP_HIGH', 'DATA_BOUNDARY_FOR_FEDRAMP_MODERATE', 'DATA_BOUNDARY_FOR_IL2', 'DATA_BOUNDARY_FOR_IL4', 'DATA_BOUNDARY_FOR_IL5', 'DATA_BOUNDARY_FOR_IRS_PUBLICATION_1075', 'DATA_BOUNDARY_FOR_ITAR', 'EU_DATA_BOUNDARY_AND_SUPPORT', 'ISRAEL_DATA_BOUNDARY_AND_SUPPORT', 'US_DATA_BOUNDARY_AND_SUPPORT', 'US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES', 'US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES_WITH_SUPPORT', 'KSA_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS', 'REGIONAL_DATA_BOUNDARY', 'JAPAN_DATA_BOUNDARY']
    - name: billingAccount
      value: string
      description: >
        Optional. The billing account used for the resources which are direct children of workload. This billing account is initially associated with the resources created as part of Workload creation. After the initial creation of these resources, the customer can change the assigned billing account. The resource name has the form `billingAccounts/{billing_account_id}`. For example, `billingAccounts/012345-567890-ABCDEF`.
        
    - name: etag
      value: string
      description: >
        Optional. ETag of the workload, it is calculated on the basis of the Workload contents. It will be used in Update & Delete operations.
        
    - name: labels
      value: object
      description: >
        Optional. Labels applied to the workload.
        
    - name: provisionedResourcesParent
      value: string
      description: >
        Input only. The parent resource for the resources managed by this Assured Workload. May be either empty or a folder resource which is a child of the Workload parent. If not specified all resources are created under the parent organization. Format: folders/{folder_id}
        
    - name: kmsSettings
      value: object
      description: >
        Input only. Settings used to create a CMEK crypto key. When set, a project with a KMS CMEK key is provisioned. This field is deprecated as of Feb 28, 2022. In order to create a Keyring, callers should specify, ENCRYPTION_KEYS_PROJECT or KEYRING in ResourceSettings.resource_type field.
        
    - name: resourceSettings
      value: array
      description: >
        Input only. Resource properties that are used to customize workload resources. These properties (such as custom project id) will be used to create workload resources if possible. This field is optional.
        
    - name: enableSovereignControls
      value: boolean
      description: >
        Optional. Indicates the sovereignty status of the given workload. Currently meant to be used by Europe/Canada customers.
        
    - name: partner
      value: string
      description: >
        Optional. Partner regime associated with this workload.
        
      valid_values: ['PARTNER_UNSPECIFIED', 'LOCAL_CONTROLS_BY_S3NS', 'SOVEREIGN_CONTROLS_BY_T_SYSTEMS', 'SOVEREIGN_CONTROLS_BY_SIA_MINSAIT', 'SOVEREIGN_CONTROLS_BY_PSN', 'SOVEREIGN_CONTROLS_BY_CNTXT', 'SOVEREIGN_CONTROLS_BY_CNTXT_NO_EKM']
    - name: partnerPermissions
      value: object
      description: >
        Optional. Permissions granted to the AW Partner SA account for the customer workload
        
    - name: partnerServicesBillingAccount
      value: string
      description: >
        Optional. Billing account necessary for purchasing services from Sovereign Partners. This field is required for creating SIA/PSN/CNTXT partner workloads. The caller should have 'billing.resourceAssociations.create' IAM permission on this billing-account. The format of this string is billingAccounts/AAAAAA-BBBBBB-CCCCCC
        
    - name: violationNotificationsEnabled
      value: boolean
      description: >
        Optional. Indicates whether the e-mail notification for a violation is enabled for a workload. This value will be by default True, and if not present will be considered as true. This should only be updated via updateWorkload call. Any Changes to this field during the createWorkload call will not be honored. This will always be true while creating the workload.
        
    - name: workloadOptions
      value: object
      description: >
        Optional. Options to be set for the given created workload.
        
    - name: externalId
      value: string

UPDATE examples

patch

Updates an existing workload. Currently allows updating of workload display_name and labels. For force updates don't set etag field in the Workload. Only one update operation per workload can be in progress.

UPDATE google.assuredworkloads.workloads
SET 
data__name = '{{ name }}',
data__displayName = '{{ displayName }}',
data__complianceRegime = '{{ complianceRegime }}',
data__billingAccount = '{{ billingAccount }}',
data__etag = '{{ etag }}',
data__labels = '{{ labels }}',
data__provisionedResourcesParent = '{{ provisionedResourcesParent }}',
data__kmsSettings = '{{ kmsSettings }}',
data__resourceSettings = '{{ resourceSettings }}',
data__enableSovereignControls = {{ enableSovereignControls }},
data__partner = '{{ partner }}',
data__partnerPermissions = '{{ partnerPermissions }}',
data__partnerServicesBillingAccount = '{{ partnerServicesBillingAccount }}',
data__violationNotificationsEnabled = {{ violationNotificationsEnabled }},
data__workloadOptions = '{{ workloadOptions }}'
WHERE 
organizationsId = '{{ organizationsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND workloadsId = '{{ workloadsId }}' --required
AND updateMask = '{{ updateMask}}'
RETURNING
name,
billingAccount,
complianceRegime,
complianceStatus,
compliantButDisallowedServices,
createTime,
displayName,
ekmProvisioningResponse,
enableSovereignControls,
etag,
kajEnrollmentState,
kmsSettings,
labels,
partner,
partnerPermissions,
partnerServicesBillingAccount,
provisionedResourcesParent,
resourceMonitoringEnabled,
resourceSettings,
resources,
saaEnrollmentResponse,
violationNotificationsEnabled,
workloadOptions;

DELETE examples

delete

Deletes the workload. Make sure that workload's direct children are already in a deleted state, otherwise the request will fail with a FAILED_PRECONDITION error. In addition to assuredworkloads.workload.delete permission, the user should also have orgpolicy.policy.set permission on the deleted folder to remove Assured Workloads OrgPolicies.

DELETE FROM google.assuredworkloads.workloads
WHERE organizationsId = '{{ organizationsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND workloadsId = '{{ workloadsId }}' --required
AND etag = '{{ etag }}';

Lifecycle Methods

restrict_allowed_resources

Restrict the list of resources allowed in the Workload environment. The current list of allowed products can be found at https://cloud.google.com/assured-workloads/docs/supported-products In addition to assuredworkloads.workload.update permission, the user should also have orgpolicy.policy.set permission on the folder resource to use this functionality.

EXEC google.assuredworkloads.workloads.restrict_allowed_resources 
@organizationsId='{{ organizationsId }}' --required, 
@locationsId='{{ locationsId }}' --required, 
@workloadsId='{{ workloadsId }}' --required 
@@json=
'{
"restrictionType": "{{ restrictionType }}"
}';

analyze_workload_move

Analyzes a hypothetical move of a source resource to a target workload to surface compliance risks. The analysis is best effort and is not guaranteed to be exhaustive.

EXEC google.assuredworkloads.workloads.analyze_workload_move 
@organizationsId='{{ organizationsId }}' --required, 
@locationsId='{{ locationsId }}' --required, 
@workloadsId='{{ workloadsId }}' --required, 
@project='{{ project }}', 
@pageSize='{{ pageSize }}', 
@pageToken='{{ pageToken }}', 
@assetTypes='{{ assetTypes }}';

mutate_partner_permissions

Update the permissions settings for an existing partner workload. For force updates don't set etag field in the Workload. Only one update operation per workload can be in progress.

EXEC google.assuredworkloads.workloads.mutate_partner_permissions 
@organizationsId='{{ organizationsId }}' --required, 
@locationsId='{{ locationsId }}' --required, 
@workloadsId='{{ workloadsId }}' --required 
@@json=
'{
"partnerPermissions": "{{ partnerPermissions }}", 
"updateMask": "{{ updateMask }}", 
"etag": "{{ etag }}"
}';

enable_resource_monitoring

Enable resource violation monitoring for a workload.

EXEC google.assuredworkloads.workloads.enable_resource_monitoring 
@organizationsId='{{ organizationsId }}' --required, 
@locationsId='{{ locationsId }}' --required, 
@workloadsId='{{ workloadsId }}' --required;

enable_compliance_updates

This endpoint enables Assured Workloads service to offer compliance updates for the folder based assured workload. It sets up an Assured Workloads Service Agent, having permissions to read compliance controls (for example: Org Policies) applied on the workload. The caller must have resourcemanager.folders.getIamPolicy and resourcemanager.folders.setIamPolicy permissions on the assured workload folder.

EXEC google.assuredworkloads.workloads.enable_compliance_updates 
@organizationsId='{{ organizationsId }}' --required, 
@locationsId='{{ locationsId }}' --required, 
@workloadsId='{{ workloadsId }}' --required;