Gcp/service/contact center ai insights#361
Open
RoshMohotti wants to merge 16 commits into
Open
Conversation
🔍 Policy Check ResultsStatus: ✅ All checks passed Test Output |
🔍 Policy Check ResultsStatus: ✅ All checks passed Test Output |
This PR introduces security policies for Google Cloud IDS Endpoint to enforce secure configuration and prevent misconfigurations. Implemented Policies: 1. Location Policy Ensures that all Cloud IDS endpoints are deployed only in the approved region (australia-southeast1) to meet compliance and data residency requirements. 2. Severity Policy Prevents the use of weak severity levels (LOW, MEDIUM, INFORMATIONAL) and enforces strong threat detection using HIGH or CRITICAL severity. 3. Network Policy Restricts the use of insecure default or public networks and ensures endpoints are deployed within secure private VPC networks. 4. Description Policy Enforces proper resource labeling by requiring endpoints to be marked as production resources. 5. Name Policy Prevents the use of non-production naming conventions such as "test" to ensure clarity and avoid misconfiguration risks. 6. Threat Exceptions Policy Blocks the use of wildcard or overly broad threat exceptions, ensuring only specific and controlled exclusions are allowed. 7. Combined Policy Implements advanced validation by combining multiple conditions. A resource is flagged as non-compliant only when it uses weak severity and an insecure network simultaneously, reducing false positives and improving accuracy. Testing: - Created compliant (c.tf) and non-compliant (nc.tf) Terraform configurations for each policy - Generated Terraform plan.json files - Evaluated policies using OPA commands - Verified that all non-compliant resources are correctly detected and reported All policies follow PDE helper templates and produce accurate outputs aligned with security <img width="2270" height="456" alt="11 04 2026_23 00 16_REC" src="https://github.com/user-attachments/assets/1ea510ba-29a6-4915-84af-d0b64916a065" /> <img width="3156" height="1008" alt="11 04 2026_23 03 36_REC" src="https://github.com/user-attachments/assets/85a96b53-2ac1-45a6-856a-fd7e240128ce" /> <img width="3188" height="470" alt="11 04 2026_23 28 23_REC" src="https://github.com/user-attachments/assets/3c8c7e51-beb0-41dc-975c-5321953c3762" /> <img width="3117" height="364" alt="12 04 2026_00 01 49_REC" src="https://github.com/user-attachments/assets/8acac7b3-807a-45c9-957f-57b739da2095" /> <img width="3157" height="374" alt="12 04 2026_00 11 47_REC" src="https://github.com/user-attachments/assets/631f46f3-bb8f-48f5-8069-c2067aa69ab2" /> <img width="3200" height="384" alt="12 04 2026_00 23 42_REC" src="https://github.com/user-attachments/assets/81484d6e-4bfa-423e-bdef-82929dbe192c" /> <img width="3192" height="378" alt="12 04 2026_00 31 54_REC" src="https://github.com/user-attachments/assets/e30fd43a-0fa7-4381-b0a0-d30ea1589312" /> <img width="3189" height="368" alt="12 04 2026_00 36 20_REC" src="https://github.com/user-attachments/assets/d6c4c3e1-3daf-48fb-bef0-9f24fbc3c26d" /> --------- Co-authored-by: Aditya Singh Juneja <fresnoadi@gmail.com> Co-authored-by: Shanika Perera <0.perera.hishi@gmail.com> Co-authored-by: Jinglong <jinglong.857@gmail.com>
🔍 Policy Check ResultsStatus: ✅ All checks passed Test Output |
🔍 Policy Check ResultsStatus: ✅ All checks passed Test Output |
RoshMohotti
assigned
SnehithJothiShiju and
RoshMohotti and unassigned
RoshMohotti and
SnehithJothiShiju
🔍 Policy Check ResultsStatus: ✅ All checks passed Test Output |
jinglong857
requested changes
May 10, 2026
Contributor
jinglong857
left a comment
jinglong857
left a comment
There was a problem hiding this comment.
@RoshMohotti please ensure your document is completed: all value for security impact needs to be set for all arguments and rationales provided (why it has security impact or why not). These needs to be done for further review.
jinglong857
reviewed
May 10, 2026
Contributor
jinglong857
left a comment
jinglong857
left a comment
There was a problem hiding this comment.
Please ensure your document is completed.
🔍 Policy Check ResultsStatus: ✅ All checks passed Test Output |
🔍 Policy Check ResultsStatus: ✅ All checks passed Test Output |
🔍 Policy Check ResultsStatus: ✅ All checks passed Test Output |
Contributor
Author
|
Hi, I have updated the documentation and resolved the review comments. Could you please re-review when available? Thanks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
• Analysis Rule
• Assessment Rule
• Auto Labeling Rule
All policies tested and passing pre-commit hooks.