Gcp/service/cloud iam

[224774388deakin]

No description provided.

[Sundi202]

You have too many attributes such as id, display name ,description etc marked as security related in your docs when they are not security related. Please correct this and only add c and nc values for security relevant attributes. Location should be australia for this project. Just a friendly reminder please go through your entire work and correct the service where relevant because too much time is spent commenting on mistakes that can be avoided. Further review will be addressed when comments are resolved.

Note: : Comments should be addressed throughout your work, if you fix an error in one area, make sure it's not still appearing in the sections that follow.

[github-actions]

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.location_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: ocation must be restricted to approved Australia regions for IAM folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to an approved Australia region such as australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Folder policy binding must use an approved policy', 'Non-Compliant Resources: c, nc', 'Potential Remedies: Use only approved Principal Access Boundary policies, Ensure policy belongs to your organization']
Check failed: Resources in output other than 'nc' found: c

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_kind_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Only approved policy kinds are allowed for folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PRINCIPAL_ACCESS_BOUNDARY as the policy_kind, Avoid using ACCESS or unspecified policy kinds']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.client_type_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth clients must use approved secure client types', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PUBLIC_CLIENT or CONFIDENTIAL_CLIENT, Do not use CLIENT_TYPE_UNSPECIFIED']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.scope_restriction.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must not request overly broad scopes', 'Non-Compliant Resources: nc', 'Potential Remedies: Avoid using cloud-platform scope, Use least privilege scopes like email or openid']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.location_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.oauth_scope_whitelist.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must only request approved least-privilege scopes to prevent over-permissioned identity access', 'Non-Compliant Resources: nc', 'Potential Remedies: Remove cloud-platform scope if not strictly required, Prefer openid, email, or groups scopes, Follow least privilege OAuth design']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.location_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal access boundary policy location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.organization_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal Access Boundary policies must use only approved organization IDs to ensure proper IAM governance and organizational compliance.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use only approved organization IDs']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_organizations_policy_binding.location_validation.message
Total Cloud_IAM organization policy binding detected: 2 
['Situation 1: Organization policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_organizations_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client_credential.location_validation.message
Total Cloud_IAM OAuth client credential detected: 2 
['Situation 1: OAuth client credential location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client_credential): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.location_validation.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.project_principal_whitelist.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding must only allow approved project-level principals to reduce unauthorized access exposure', 'Non-Compliant Resources: nc', 'Potential Remedies: Restrict bindings to approved project IDs only, Remove wildcard or external project principals, Ensure only enterprise-managed projects are included']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.policy_kind_restriction.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Policy binding must enforce only Principal Access Boundary to prevent privilege escalation via access policies', 'Non-Compliant Resources: nc', 'Potential Remedies: Set policy_kind strictly to PRINCIPAL_ACCESS_BOUNDARY, Avoid using ACCESS or unspecified policy kinds, Standardize IAM boundary enforcement across all projects']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Cloud_IAM
  Resource: google_iam_folders_policy_binding
    Policy: location_validation - ✅
    Policy: policy_validation - ❌
    Policy: policy_kind_validation - ✅
  Resource: google_iam_oauth_client
    Policy: client_type_validation - ✅
    Policy: scope_restriction - ✅
    Policy: location_validation - ✅
    Policy: oauth_scope_whitelist - ✅
  Resource: google_iam_oauth_client_credential
    Policy: location_validation - ✅
  Resource: google_iam_organizations_policy_binding
    Policy: Location_Validation - ✅
  Resource: google_iam_principal_access_boundary_policy
    Policy: location_validation - ✅
    Policy: organization_validation - ✅
  Resource: google_iam_projects_policy_binding
    Policy: location_validation - ✅
    Policy: project_principal_whitelist - ✅
    Policy: policy_kind_restriction - ✅


Failures:
Service: Cloud_IAM | Resource: google_iam_folders_policy_binding | Policy: policy_validation
Resources in output other than 'nc' found: c

[github-actions]

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.location_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: ocation must be restricted to approved Australia regions for IAM folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to an approved Australia region such as australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Folder policy binding must use an approved policy', 'Non-Compliant Resources: c, nc', 'Potential Remedies: Use only approved Principal Access Boundary policies, Ensure policy belongs to your organization']
Check failed: Resources in output other than 'nc' found: c

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_kind_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Only approved policy kinds are allowed for folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PRINCIPAL_ACCESS_BOUNDARY as the policy_kind, Avoid using ACCESS or unspecified policy kinds']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.client_type_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth clients must use approved secure client types', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PUBLIC_CLIENT or CONFIDENTIAL_CLIENT, Do not use CLIENT_TYPE_UNSPECIFIED']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.scope_restriction.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must not request overly broad scopes', 'Non-Compliant Resources: nc', 'Potential Remedies: Avoid using cloud-platform scope, Use least privilege scopes like email or openid']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.location_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.oauth_scope_whitelist.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must only request approved least-privilege scopes to prevent over-permissioned identity access', 'Non-Compliant Resources: nc', 'Potential Remedies: Remove cloud-platform scope if not strictly required, Prefer openid, email, or groups scopes, Follow least privilege OAuth design']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.location_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal access boundary policy location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.organization_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal Access Boundary policies must use only approved organization IDs to ensure proper IAM governance and organizational compliance.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use only approved organization IDs']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_organizations_policy_binding.location_validation.message
Total Cloud_IAM organization policy binding detected: 2 
['Situation 1: Organization policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_organizations_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client_credential.location_validation.message
Total Cloud_IAM OAuth client credential detected: 2 
['Situation 1: OAuth client credential location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client_credential): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.location_validation.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.project_principal_whitelist.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding must only allow approved project-level principals to reduce unauthorized access exposure', 'Non-Compliant Resources: nc', 'Potential Remedies: Restrict bindings to approved project IDs only, Remove wildcard or external project principals, Ensure only enterprise-managed projects are included']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.policy_kind_restriction.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Policy binding must enforce only Principal Access Boundary to prevent privilege escalation via access policies', 'Non-Compliant Resources: nc', 'Potential Remedies: Set policy_kind strictly to PRINCIPAL_ACCESS_BOUNDARY, Avoid using ACCESS or unspecified policy kinds, Standardize IAM boundary enforcement across all projects']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Cloud_IAM
  Resource: google_iam_folders_policy_binding
    Policy: location_validation - ✅
    Policy: policy_validation - ❌
    Policy: policy_kind_validation - ✅
  Resource: google_iam_oauth_client
    Policy: client_type_validation - ✅
    Policy: scope_restriction - ✅
    Policy: location_validation - ✅
    Policy: oauth_scope_whitelist - ✅
  Resource: google_iam_oauth_client_credential
    Policy: location_validation - ✅
  Resource: google_iam_organizations_policy_binding
    Policy: Location_Validation - ✅
  Resource: google_iam_principal_access_boundary_policy
    Policy: location_validation - ✅
    Policy: organization_validation - ✅
  Resource: google_iam_projects_policy_binding
    Policy: location_validation - ✅
    Policy: project_principal_whitelist - ✅
    Policy: policy_kind_restriction - ✅


Failures:
Service: Cloud_IAM | Resource: google_iam_folders_policy_binding | Policy: policy_validation
Resources in output other than 'nc' found: c

[github-actions]

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.location_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: ocation must be restricted to approved Australia regions for IAM folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to an approved Australia region such as australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Folder policy binding must use an approved policy', 'Non-Compliant Resources: nc', 'Potential Remedies: Use only approved Principal Access Boundary policies, Ensure policy belongs to your organization']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_kind_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Only approved policy kinds are allowed for folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PRINCIPAL_ACCESS_BOUNDARY as the policy_kind, Avoid using ACCESS or unspecified policy kinds']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.client_type_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth clients must use approved secure client types', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PUBLIC_CLIENT or CONFIDENTIAL_CLIENT, Do not use CLIENT_TYPE_UNSPECIFIED']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.scope_restriction.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must not request overly broad scopes', 'Non-Compliant Resources: nc', 'Potential Remedies: Avoid using cloud-platform scope, Use least privilege scopes like email or openid']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.location_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.oauth_scope_whitelist.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must only request approved least-privilege scopes to prevent over-permissioned identity access', 'Non-Compliant Resources: nc', 'Potential Remedies: Remove cloud-platform scope if not strictly required, Prefer openid, email, or groups scopes, Follow least privilege OAuth design']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.location_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal access boundary policy location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.organization_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal Access Boundary policies must use only approved organization IDs to ensure proper IAM governance and organizational compliance.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use only approved organization IDs']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_organizations_policy_binding.location_validation.message
Total Cloud_IAM organization policy binding detected: 2 
['Situation 1: Organization policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_organizations_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client_credential.location_validation.message
Total Cloud_IAM OAuth client credential detected: 2 
['Situation 1: OAuth client credential location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client_credential): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.location_validation.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.project_principal_whitelist.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding must only allow approved project-level principals to reduce unauthorized access exposure', 'Non-Compliant Resources: nc', 'Potential Remedies: Restrict bindings to approved project IDs only, Remove wildcard or external project principals, Ensure only enterprise-managed projects are included']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.policy_kind_restriction.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Policy binding must enforce only Principal Access Boundary to prevent privilege escalation via access policies', 'Non-Compliant Resources: nc', 'Potential Remedies: Set policy_kind strictly to PRINCIPAL_ACCESS_BOUNDARY, Avoid using ACCESS or unspecified policy kinds, Standardize IAM boundary enforcement across all projects']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Cloud_IAM
  Resource: google_iam_folders_policy_binding
    Policy: location_validation - ✅
    Policy: policy_validation - ✅
    Policy: policy_kind_validation - ✅
  Resource: google_iam_oauth_client
    Policy: client_type_validation - ✅
    Policy: scope_restriction - ✅
    Policy: location_validation - ✅
    Policy: oauth_scope_whitelist - ✅
  Resource: google_iam_oauth_client_credential
    Policy: location_validation - ✅
  Resource: google_iam_organizations_policy_binding
    Policy: Location_Validation - ✅
  Resource: google_iam_principal_access_boundary_policy
    Policy: location_validation - ✅
    Policy: organization_validation - ✅
  Resource: google_iam_projects_policy_binding
    Policy: location_validation - ✅
    Policy: project_principal_whitelist - ✅
    Policy: policy_kind_restriction - ✅

[224774388deakin]

All the changes you requested done. Thanks.

[Sundi202]

You're missing security impact and rational in some of your attributes in your json documentation. Plus you need to add all json files to your PR. For the resources that you have not worked on just write at the top "will not be completed in one trimester" in caps at the top.

[github-actions]

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.location_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: ocation must be restricted to approved Australia regions for IAM folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to an approved Australia region such as australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Folder policy binding must use an approved policy', 'Non-Compliant Resources: nc', 'Potential Remedies: Use only approved Principal Access Boundary policies, Ensure policy belongs to your organization']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_kind_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Only approved policy kinds are allowed for folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PRINCIPAL_ACCESS_BOUNDARY as the policy_kind, Avoid using ACCESS or unspecified policy kinds']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.client_type_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth clients must use approved secure client types', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PUBLIC_CLIENT or CONFIDENTIAL_CLIENT, Do not use CLIENT_TYPE_UNSPECIFIED']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.scope_restriction.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must not request overly broad scopes', 'Non-Compliant Resources: nc', 'Potential Remedies: Avoid using cloud-platform scope, Use least privilege scopes like email or openid']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.location_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.oauth_scope_whitelist.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must only request approved least-privilege scopes to prevent over-permissioned identity access', 'Non-Compliant Resources: nc', 'Potential Remedies: Remove cloud-platform scope if not strictly required, Prefer openid, email, or groups scopes, Follow least privilege OAuth design']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.location_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal access boundary policy location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.organization_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal Access Boundary policies must use only approved organization IDs to ensure proper IAM governance and organizational compliance.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use only approved organization IDs']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_organizations_policy_binding.location_validation.message
Total Cloud_IAM organization policy binding detected: 2 
['Situation 1: Organization policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_organizations_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client_credential.location_validation.message
Total Cloud_IAM OAuth client credential detected: 2 
['Situation 1: OAuth client credential location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client_credential): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.location_validation.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.project_principal_whitelist.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding must only allow approved project-level principals to reduce unauthorized access exposure', 'Non-Compliant Resources: nc', 'Potential Remedies: Restrict bindings to approved project IDs only, Remove wildcard or external project principals, Ensure only enterprise-managed projects are included']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.policy_kind_restriction.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Policy binding must enforce only Principal Access Boundary to prevent privilege escalation via access policies', 'Non-Compliant Resources: nc', 'Potential Remedies: Set policy_kind strictly to PRINCIPAL_ACCESS_BOUNDARY, Avoid using ACCESS or unspecified policy kinds, Standardize IAM boundary enforcement across all projects']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Cloud_IAM
  Resource: google_iam_folders_policy_binding
    Policy: location_validation - ✅
    Policy: policy_validation - ✅
    Policy: policy_kind_validation - ✅
  Resource: google_iam_oauth_client
    Policy: client_type_validation - ✅
    Policy: scope_restriction - ✅
    Policy: location_validation - ✅
    Policy: oauth_scope_whitelist - ✅
  Resource: google_iam_oauth_client_credential
    Policy: location_validation - ✅
  Resource: google_iam_organizations_policy_binding
    Policy: Location_Validation - ✅
  Resource: google_iam_principal_access_boundary_policy
    Policy: location_validation - ✅
    Policy: organization_validation - ✅
  Resource: google_iam_projects_policy_binding
    Policy: location_validation - ✅
    Policy: project_principal_whitelist - ✅
    Policy: policy_kind_restriction - ✅

[224774388deakin]

add all json files to pr. I filled the rationale and security_impact fields for all attributes in the resource types I worked on. add "WILL NOT BE COMPLETED IN ONE TRIMESTER" at the top of the JSON files that unworked. Thanks

[github-actions]

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.location_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: ocation must be restricted to approved Australia regions for IAM folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to an approved Australia region such as australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Folder policy binding must use an approved policy', 'Non-Compliant Resources: nc', 'Potential Remedies: Use only approved Principal Access Boundary policies, Ensure policy belongs to your organization']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_folders_policy_binding.policy_kind_validation.message
Total Cloud_IAM folder policy binding detected: 2 
['Situation 1: Only approved policy kinds are allowed for folder policy bindings', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PRINCIPAL_ACCESS_BOUNDARY as the policy_kind, Avoid using ACCESS or unspecified policy kinds']
Unique resource names in plan (google_iam_folders_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.client_type_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth clients must use approved secure client types', 'Non-Compliant Resources: nc', 'Potential Remedies: Use PUBLIC_CLIENT or CONFIDENTIAL_CLIENT, Do not use CLIENT_TYPE_UNSPECIFIED']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.scope_restriction.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must not request overly broad scopes', 'Non-Compliant Resources: nc', 'Potential Remedies: Avoid using cloud-platform scope, Use least privilege scopes like email or openid']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.location_validation.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client.oauth_scope_whitelist.message
Total Cloud_IAM OAuth client detected: 2 
['Situation 1: OAuth client must only request approved least-privilege scopes to prevent over-permissioned identity access', 'Non-Compliant Resources: nc', 'Potential Remedies: Remove cloud-platform scope if not strictly required, Prefer openid, email, or groups scopes, Follow least privilege OAuth design']
Unique resource names in plan (google_iam_oauth_client): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.location_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal access boundary policy location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_principal_access_boundary_policy.organization_validation.message
Total Cloud_IAM principal access boundary policy detected: 2 
['Situation 1: Principal Access Boundary policies must use only approved organization IDs to ensure proper IAM governance and organizational compliance.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use only approved organization IDs']
Unique resource names in plan (google_iam_principal_access_boundary_policy): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_organizations_policy_binding.location_validation.message
Total Cloud_IAM organization policy binding detected: 2 
['Situation 1: Organization policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_organizations_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_oauth_client_credential.location_validation.message
Total Cloud_IAM OAuth client credential detected: 2 
['Situation 1: OAuth client credential location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_oauth_client_credential): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.location_validation.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding location must be restricted to approved Australia regions', 'Non-Compliant Resources: nc', 'Potential Remedies: Set location to australia-southeast1 or australia-southeast2']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.project_principal_whitelist.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Project policy binding must only allow approved project-level principals to reduce unauthorized access exposure', 'Non-Compliant Resources: nc', 'Potential Remedies: Restrict bindings to approved project IDs only, Remove wildcard or external project principals, Ensure only enterprise-managed projects are included']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Cloud_IAM.google_iam_projects_policy_binding.policy_kind_restriction.message
Total Cloud_IAM project policy binding detected: 2 
['Situation 1: Policy binding must enforce only Principal Access Boundary to prevent privilege escalation via access policies', 'Non-Compliant Resources: nc', 'Potential Remedies: Set policy_kind strictly to PRINCIPAL_ACCESS_BOUNDARY, Avoid using ACCESS or unspecified policy kinds, Standardize IAM boundary enforcement across all projects']
Unique resource names in plan (google_iam_projects_policy_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Cloud_IAM
  Resource: google_iam_folders_policy_binding
    Policy: location_validation - ✅
    Policy: policy_validation - ✅
    Policy: policy_kind_validation - ✅
  Resource: google_iam_oauth_client
    Policy: client_type_validation - ✅
    Policy: scope_restriction - ✅
    Policy: location_validation - ✅
    Policy: oauth_scope_whitelist - ✅
  Resource: google_iam_oauth_client_credential
    Policy: location_validation - ✅
  Resource: google_iam_organizations_policy_binding
    Policy: Location_Validation - ✅
  Resource: google_iam_principal_access_boundary_policy
    Policy: location_validation - ✅
    Policy: organization_validation - ✅
  Resource: google_iam_projects_policy_binding
    Policy: location_validation - ✅
    Policy: project_principal_whitelist - ✅
    Policy: policy_kind_restriction - ✅

[JBarazani]

Hi Thanuka
At present I will not approve this PR as I still see some issues with it.
Given we are in week 12, and this PR has gone though 5+ rounds of review, I would like us to leave it as is.

I have no concerns about you passing the unit even without the merge, as you have made quite a few good policies as well, there are just other things that require fixing before this can be merged, and will likely give it other a Snr next trimester to pick up and fix based on my feedback.