[PDE] Automated Policy Tracker - GCP

[Shani1116]

Assignee

@Shani1116

Start Date

2026-03-23

End Date (Target)

2026-04-30

Description

Develop a script to automatically track policies covered across a given cloud service provider (CSP)

• Currently, this process is done manually at the start of each trimester, requiring teams to review all completed services and update an Excel sheet

• The new solution will scan the PDE repository structure and automatically extract -
  Services and resources covered
  Policies implemented by students

• The extracted data will be used to generate a centralized summary of policy coverage

• This data will be visualized through a Google Looker Studio dashboard to provide a clear overview of project progress

Objectives / Expected Outcome

• Eliminates repetitive manual tracking effort each trimester
• Improves accuracy and consistency of project data
• Provides real-time visibility of policy coverage for students and leadership
• Supports better planning, allocation, and decision-making across the project

Steps / Action Items

No response

Dependencies

No response

Related Links

No response

Status

In progress

[Shani1116]

Progress update

Update as of 27/04

• The python script will run on the dev branch to get the overall status of the project on merged branches
• It will first check the /docs to extract attributes and security metadata status and check if the corresponding TF config and policy file exists
• Creates a CSV with service, resource, attributes, Security_relevant, Docs_complete, c.tf, nc.tf, config.tf, policy.rego, vars.rego, Status

Requirements for automation check (Feedback from Yotam)

• Passes Linter (naming, all expected files, no extra files)
• Branch Name (and from local - must not come from a forked repo)
• Policy Test - all policies pass
• No incomplete rtype if you started it, you must finish it or drop it, meaning
  *Docs for all args of that rtype are complete (security_impact - yes/no + rationale)
  *c, nc, policy are all there and passing (Make sure to get result from policy test before, Don't rerun tests again)
• Scans/leaves a comment every time they commit again on the PR - summary off issues, neat, organized, clear to student what they need to fix

[Shani1116]

Progress Update

Update as of 19/05

• Requirements stated in the previous progress update was developed as a new feature - Branch Inspector
• Branch name - feature/automated-policy-tracker
• completion_checker.py script runs on the dev branch to get an overview of the services. Currently focused on GCP.
• It generates a CSV script with the following - service name, resource_count, resource names, attribute count per resource
• A HTML dashboard is created and hosted using GitHub pages using the CSV script to provide an overview of the services. Tracked in New auto policy tracker #409

TO DO

• Scale and change the dashboard to show coverage on all CSPs
• Get the completion status from Branch Inspector and integrate to the dashboard