Gcp/service/cloud tpu

[SOoONB52]

Add security policies for Cloud TPU V2 (google_tpu_v2_vm)

Policies implemented:

• enable_secure_boot
• no_external_ips
• service_account_configured

Includes compliant and non-compliant Terraform test cases.
Documentation added for Cloud TPU V2 VM.

[github-actions]

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.no_external_ips.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: The Cloud TPU V2 VM has external IP addresses enabled, increasing the attack surface and exposing the TPU worker to the public internet.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `network_config.enable_external_ips` to false and enable Private Google Access on the subnetwork instead.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.enable_secure_boot.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: Secure Boot is not enabled on the Cloud TPU V2 VM, leaving it vulnerable to boot-level malware and rootkits.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `shielded_instance_config.enable_secure_boot` to true to enable Secure Boot on the TPU VM.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.service_account_configured.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: No dedicated service account is configured for the Cloud TPU V2 VM. Using the default compute service account violates the principle of least privilege.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `service_account.email` to a dedicated service account with only the required IAM permissions.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: cloud_tpu
  Resource: google_tpu_v2_vm
    Policy: no_external_ips - ✅
    Policy: enable_secure_boot - ✅
    Policy: service_account_configured - ✅

[github-actions]

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.no_external_ips.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: The Cloud TPU V2 VM has external IP addresses enabled, increasing the attack surface and exposing the TPU worker to the public internet.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `network_config.enable_external_ips` to false and enable Private Google Access on the subnetwork instead.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.enable_secure_boot.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: Secure Boot is not enabled on the Cloud TPU V2 VM, leaving it vulnerable to boot-level malware and rootkits.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `shielded_instance_config.enable_secure_boot` to true to enable Secure Boot on the TPU VM.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.service_account_configured.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: No dedicated service account is configured for the Cloud TPU V2 VM. Using the default compute service account violates the principle of least privilege.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `service_account.email` to a dedicated service account with only the required IAM permissions.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: cloud_tpu
  Resource: google_tpu_v2_vm
    Policy: no_external_ips - ✅
    Policy: enable_secure_boot - ✅
    Policy: service_account_configured - ✅

[github-actions]

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.no_external_ips.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: The Cloud TPU V2 VM has external IP addresses enabled, increasing the attack surface and exposing the TPU worker to the public internet.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `network_config.enable_external_ips` to false and enable Private Google Access on the subnetwork instead.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.enable_secure_boot.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: Secure Boot is not enabled on the Cloud TPU V2 VM, leaving it vulnerable to boot-level malware and rootkits.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `shielded_instance_config.enable_secure_boot` to true to enable Secure Boot on the TPU VM.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.service_account_configured.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: No dedicated service account is configured for the Cloud TPU V2 VM. Using the default compute service account violates the principle of least privilege.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `service_account.email` to a dedicated service account with only the required IAM permissions.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: cloud_tpu
  Resource: google_tpu_v2_vm
    Policy: no_external_ips - ✅
    Policy: enable_secure_boot - ✅
    Policy: service_account_configured - ✅

[github-actions]

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.no_external_ips.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: The Cloud TPU V2 VM has external IP addresses enabled, increasing the attack surface and exposing the TPU worker to the public internet.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `network_config.enable_external_ips` to false and enable Private Google Access on the subnetwork instead.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.enable_secure_boot.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: Secure Boot is not enabled on the Cloud TPU V2 VM, leaving it vulnerable to boot-level malware and rootkits.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `shielded_instance_config.enable_secure_boot` to true to enable Secure Boot on the TPU VM.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.service_account_configured.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: No dedicated service account is configured for the Cloud TPU V2 VM. Using the default compute service account violates the principle of least privilege.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `service_account.email` to a dedicated service account with only the required IAM permissions.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: cloud_tpu
  Resource: google_tpu_v2_vm
    Policy: no_external_ips - ✅
    Policy: enable_secure_boot - ✅
    Policy: service_account_configured - ✅

[github-actions]

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.no_external_ips.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: The Cloud TPU V2 VM has external IP addresses enabled, increasing the attack surface and exposing the TPU worker to the public internet.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `network_config.enable_external_ips` to false and enable Private Google Access on the subnetwork instead.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.enable_secure_boot.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: Secure Boot is not enabled on the Cloud TPU V2 VM, leaving it vulnerable to boot-level malware and rootkits.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `shielded_instance_config.enable_secure_boot` to true to enable Secure Boot on the TPU VM.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.cloud_tpu.google_tpu_v2_vm.service_account_configured.message
Total Cloud TPU V2 VM detected: 2 
['Situation 1: No dedicated service account is configured for the Cloud TPU V2 VM. Using the default compute service account violates the principle of least privilege.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set `service_account.email` to a dedicated service account with only the required IAM permissions.']
Unique resource names in plan (google_tpu_v2_vm): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: cloud_tpu
  Resource: google_tpu_v2_vm
    Policy: no_external_ips - ✅
    Policy: enable_secure_boot - ✅
    Policy: service_account_configured - ✅