[Bug] modules/access-context-manager, beyondcorp: evaluate all access level conditions and enforce endpoint verification

未关闭
  • 哪里不对？
#372 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@LeonxLJX 已经在做这个了。

开始于 2026年10月28日。

  • #376 来自 @LeonxLJX —— 未关闭

评估

难度
3/5
预计耗时
1-2 天
新手友好度
68/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
gcp, terraform
领域
infrastructure, security

调研方向

Start in modules/access-context-manager/main.tf: replace the direct conditions[0] indexing with a dynamic "conditions" block over each.value.basic.conditions, then make the unused project_id and region inputs optional in variables.tf. Next read modules/beyondcorp/main.tf and its variables.tf: adjust the encryption status list, bind the endpoint-verified access level to google_project_iam_member.iap_user, mark oauth_client_secret sensitive, and output .name. Done when both modules match the expected behavior and validation passes.

由索引模型根据 Issue 内容生成。

描述

Bug Framework - FedRAMP High Framework - IL5 Level of Effort - Low Priority - Medium Scope - Module Security

Bug Description

modules/access-context-manager and modules/beyondcorp have functional and security gaps on main at commit db8271cf.

  1. modules/access-context-manager/main.tf indexes each.value.basic.conditions[0] directly instead of using a dynamic "conditions" block over each.value.basic.conditions, ignoring any additional conditions passed by callers, and variables.tf requires unused project_id and region inputs.
  2. modules/beyondcorp/main.tf includes ENCRYPTION_UNSUPPORTED in encryption_statuses, creates google_access_context_manager_access_level.endpoint_verified without attaching it as an IAM condition on google_project_iam_member.iap_user, leaves var.iap_config.oauth_client_secret non-sensitive in variables.tf, and returns the full google_access_context_manager_access_level.endpoint_verified resource object instead of .name in the endpoint_name output.

Expected Behavior

  • modules/access-context-manager iterates over all elements of each.value.basic.conditions and makes unused legacy variables optional.
  • modules/beyondcorp requires ENCRYPTED device status by default, binds the endpoint_verified access level condition to google_project_iam_member.iap_user, marks oauth_client_secret sensitive, and outputs google_access_context_manager_access_level.endpoint_verified.name.

Additional Context

Tracked under #33. Split out from #348.

主要语言
HCL
星标
61
派生
28
平均合并
1 天 22 小时
30 天内合并 PR
72

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

google/stellar-engine 的其他 Issue

查看 google/stellar-engine 的全部 Issue

相似的 Issue

更多 DevOps Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。