Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug] fast/stages-aw/3-security, scripts: fix cross-env KMS admin grant, VPC-SC dry-run status, and script input handling

Aperta
  • Qualcosa non va?
#371 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@LeonxLJX ci sta già lavorando.

Dal 28/10/2026.

  • #377 di @LeonxLJX — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
bash, gcp, shell, terraform
Ambito
cloud, devops, infrastructure, security

Direzione di ricerca

Start with fast/stages-aw/3-security/core-dev.tf and core-prod.tf, comparing KMS grants for the dp, gke, gcve, and pf service accounts, then read vpc-sc.tf and outputs.tf for the dry-run status and file/CMEK handling. The script fixes are spread across sa_lockdown.sh, validation.sh, scripts/destroy.sh, scripts/restore.sh, tools/create_e2e_sandbox.sh, and generate-mocks.sh; inspect each listed line and run the relevant Stage 3 Terraform checks and script validations. Done means all six expected behaviors in the issue hold without changing unrelated permissions or script behavior.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Bug Framework - FedRAMP High Framework - IL5 Level of Effort - Low Priority - High Scope - Fast Security

Bug Description

fast/stages-aw/3-security and the repository automation scripts contain several security and functional defects on main at commit db8271cf.

  1. fast/stages-aw/3-security/core-dev.tf grants var.service_accounts["project-factory-prod"] roles/cloudkms.admin and roles/cloudkms.cryptoKeyEncrypterDecrypter on development KMS keys, while omitting the gke-dev and gcve-dev service accounts. Similarly, core-prod.tf omits gke-prod and gcve-prod.
  2. fast/stages-aw/3-security/vpc-sc.tf sets status = var.vpc_sc.dry_run ? null : local.perimeter_status. Setting status = null when dry_run = true removes any existing enforced VPC Service Controls perimeter configuration instead of preserving the enforced status block alongside spec.
  3. fast/stages-aw/3-security/outputs.tf writes 3-security.auto.tfvars.json with 0644 permissions and uploads it to the automation GCS bucket without kms_key_name.
  4. fast/stages-aw/3-security/sa_lockdown.sh only removes roles for 4 service accounts, missing the -r read-only plan service accounts and Stage 1 branch service accounts, and validation.sh filters only -prod-iac-core-0$.
  5. scripts/destroy.sh uses eval "$var_name="$input"" when reading interactive user input instead of printf -v, scripts/restore.sh contains a broken terraform import "module.organization.google_org_policy_policy.default["{}"]" command, tools/create_e2e_sandbox.sh contains a tocuh typo, and generate-mocks.sh references a non-existent 2-networking-a-fedramp-high directory.

Expected Behavior

  • core-dev.tf and core-prod.tf grant KMS permissions only to matching environment service accounts for dp, gke, gcve, and pf.
  • vpc-sc.tf preserves enforced perimeter status when spec dry-run mode is enabled.
  • outputs.tf restricts local file permissions to 0600 and encrypts the uploaded 3-security.auto.tfvars.json object with CMEK.
  • sa_lockdown.sh, validation.sh, scripts/destroy.sh, scripts/restore.sh, tools/create_e2e_sandbox.sh, and generate-mocks.sh run safely without eval injection or broken paths.

Additional Context

Tracked under #33. Split out from #350 so Stage 3 and script fixes can be reviewed in isolated pull requests.

Lingua principale
HCL
Stelle
61
Fork
28
Merge medio
1g 22h
PR unite (30g)
72

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di google/stellar-engine

Tutte le issue di google/stellar-engine

Issue simili

Altre issue su Cloud

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.