Skip to content

Gcp/service/cloud endpoint#397

Open
Mohmaed-AA00 wants to merge 15 commits into
devfrom
gcp/service/cloud-endpoint
Open

Gcp/service/cloud endpoint#397
Mohmaed-AA00 wants to merge 15 commits into
devfrom
gcp/service/cloud-endpoint

Conversation

@Mohmaed-AA00
Copy link
Copy Markdown
Contributor

@Mohmaed-AA00 Mohmaed-AA00 commented May 12, 2026

No description provided.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

 No matching policy dir for: inputs/gcp/google_Endpoints/google_endpoints_consumers_iam/members
 No matching policy dir for: inputs/gcp/google_Endpoints/google_endpoints_consumers_iam/role
OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config allows insecure HTTP traffic.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the expected Cloud Endpoints domain format.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions github-actions Bot added the CI-Review-Required PR requires review due to failed CI checks label May 12, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

 No matching policy dir for: inputs/gcp/google_Endpoints/google_endpoints_consumers_iam/members
 No matching policy dir for: inputs/gcp/google_Endpoints/google_endpoints_consumers_iam/role
OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config allows insecure HTTP traffic.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the expected Cloud Endpoints domain format.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

 No matching policy dir for: inputs/gcp/google_Endpoints/google_endpoints_consumers_iam/members
 No matching policy dir for: inputs/gcp/google_Endpoints/google_endpoints_consumers_iam/role
OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config allows insecure HTTP traffic.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the expected Cloud Endpoints domain format.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config allows insecure HTTP traffic.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the expected Cloud Endpoints domain format.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA eval failed: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
{
  "errors": [
    {
      "message": "complete rules must not produce multiple outputs",
      "code": "eval_conflict_error",
      "location": {
        "file": "/home/runner/work/Policy-Deployment-Engine/Policy-Deployment-Engine/policies/gcp/google_Endpoints/google_endpoints_consumers_iam/memebers/policy.rego",
        "row": 6,
        "col": 1
      }
    }
  ]
}


OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ❌
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_consumers_iam | Policy: members
Could not run OPA query!

Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the expected Cloud Endpoints domain format.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA eval failed: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
{
  "errors": [
    {
      "message": "complete rules must not produce multiple outputs",
      "code": "eval_conflict_error",
      "location": {
        "file": "/home/runner/work/Policy-Deployment-Engine/Policy-Deployment-Engine/policies/gcp/google_Endpoints/google_endpoints_consumers_iam/memebers/policy.rego",
        "row": 6,
        "col": 1
      }
    }
  ]
}


OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ❌
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_consumers_iam | Policy: members
Could not run OPA query!

Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the expected Cloud Endpoints domain format.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM members includes a principal outside the approved member types.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ✅
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the approved value.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM members includes a principal outside the approved member types.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ✅
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the approved value.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM members includes a principal outside the approved member types.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ✅
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the approved value.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM members includes a principal outside the approved member types.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ✅
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the approved value.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM members includes a principal outside the approved member types.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ✅
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM members includes a principal outside the approved members list.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
Total Google Cloud Endpoints service detected: 2 
['Situation 1: Google Cloud Endpoints service service_name does not follow the approved value.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM members includes a principal outside the approved member types.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ✅
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ❌
    Policy: service_name - ❌
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service | Policy: openapi_config
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service | Policy: service_name
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Unmentioned resources other than 'c' found: nc

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA eval failed: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
{
  "errors": [
    {
      "message": "complete rules must not produce multiple outputs",
      "code": "eval_conflict_error",
      "location": {
        "file": "/home/runner/work/Policy-Deployment-Engine/Policy-Deployment-Engine/policies/gcp/google_Endpoints/google_endpoints_service_iam/role/policy.rego",
        "row": 24,
        "col": 1
      }
    }
  ]
}


OPA eval failed: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
{
  "errors": [
    {
      "message": "complete rules must not produce multiple outputs",
      "code": "eval_conflict_error",
      "location": {
        "file": "/home/runner/work/Policy-Deployment-Engine/Policy-Deployment-Engine/policies/gcp/google_Endpoints/google_endpoints_service_iam/role/policy.rego",
        "row": 24,
        "col": 1
      }
    }
  ]
}


OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service service_name does not follow the approved value.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM members includes a principal outside the approved member types.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ✅
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ✅
    Policy: service_name - ✅
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ❌
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: allowed_members
Could not run OPA query!

Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Could not run OPA query!

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
["Total Google Cloud Endpoints service IAM binding detected: 2 ", ["Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
Total Google Cloud Endpoints service IAM binding detected: 2 
['Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service service_name does not follow the approved value.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM members includes a principal outside the approved member types.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ✅
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ✅
    Policy: service_name - ✅
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ✅
    Policy: role - ❌


Failures:
Service: google_Endpoints | Resource: google_endpoints_service_iam | Policy: role
Unmentioned resources other than 'c' found: nc

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 12, 2026

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.allowed_members.message
["Total Google Cloud Endpoints service IAM binding detected: 2 ", ["Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service_iam.role.message
["Total Google Cloud Endpoints service IAM binding detected: 2 ", ["Situation 1: Google Cloud Endpoints service IAM role uses a forbidden service agent role.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service_iam_binding): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.grpc_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service grpc_config is set without protoc_output_base64.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.openapi_config.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service openapi_config does not enforce HTTPS.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_service.service_name.message
["Total Google Cloud Endpoints service detected: 2 ", ["Situation 1: Google Cloud Endpoints service service_name does not follow the approved value.", "Non-Compliant Resources: None - All passed"]]
Resources checked: nc
Unique resource names in plan (google_endpoints_service): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.members.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM members includes a principal outside the approved member types.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed

OPA check: data.terraform.gcp.security.google_Endpoints.google_endpoints_consumers_iam.role.message
Total Google Cloud Endpoints consumers IAM binding detected: 0 
['Situation 1: Google Cloud Endpoints consumers IAM role is not set to the approved service consumer role.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_endpoints_consumers_iam_binding): 0
Names mentioned in output: 0
Check passed


Summary of policy checks:
Service: google_Endpoints
  Resource: google_endpoints_consumers_iam
    Policy: members - ✅
    Policy: role - ✅
  Resource: google_endpoints_service
    Policy: grpc_config - ✅
    Policy: openapi_config - ✅
    Policy: service_name - ✅
  Resource: google_endpoints_service_iam
    Policy: allowed_members - ✅
    Policy: role - ✅

@github-actions github-actions Bot added CI-Approved PR approved by CI checks and removed CI-Review-Required PR requires review due to failed CI checks labels May 12, 2026
@Chhunly-TAING Chhunly-TAING self-assigned this May 12, 2026
Chhunly-TAING
Chhunly-TAING requested changes May 12, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@Chhunly-TAING Chhunly-TAING left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Mohamed,

I can see you have covered google_endpoints_service, google_endpoints_service_consumers_iam, and google_endpoints_service_iam.

However, I think there are some issues that need to be addressed:

  1. Please check the service folder naming. The current folder uses google_Endpoints with a capital E.
  2. The documentation is still incomplete. Some markdown files only contain the table header, and the IAM attributes such as member/members and role are marked as having no security impact, even though they are security-related.
  3. The allowed_members policy for google_endpoints_service_iam appears to check the role attribute instead of members. Please remove role if not needed.
  4. Some policies are manually excluding the compliant resource using resource.name != "c", for example like openapi_config, graph_config. Please confirm the policies pass naturally using the helper output.
  5. Please confirm if protoc_output_base64 policy is needed.

Thanks,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Chhunly-TAING Chhunly-TAING Chhunly-TAING requested changes

Requested changes must be addressed to merge this pull request.

Assignees

@Chhunly-TAING Chhunly-TAING

Labels

CI-Approved PR approved by CI checks

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Mohmaed-AA00 @Chhunly-TAING