Repository navigation
fix(gcp): enable the APIs that read through the host project's quota - #119
Draft
tim-thacker-nullify wants to merge 2 commits into
Draft
tim-thacker-nullify wants to merge 2 commits into
tim-thacker-nullify wants to merge 2 commits into
Conversation
KMS, Cloud SQL, Spanner, Dataflow, BigQuery, Org Policy and Access Context Manager count each read against the quota of the service account's own project. The Nullify service account lives in the host project, so every read of these APIs failed with "API has not been used in project <host>". Enable them in apis.tf and install.sh, and list them in the README. Correct docs/permissions.md: Cloud Build trigger and worker pool configuration is read through Cloud Asset Inventory; no Cloud Build permission is granted. Refs FDE-3031, FDE-3030. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move the seven scan APIs into their own `scan_quota` resource that no other resource depends on, behind `enable_scan_quota_apis` (default true). install.sh enables them in a separate call that warns and goes on when it fails. Correct the stale Cloud Build comment in main.tf and leave docs/permissions.md as it was. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nullify cannot read KMS, Cloud SQL, Spanner, Dataflow, BigQuery, Org Policy or Access Context Manager config for connectors whose host project does not enable those APIs (Aura, Wesfarmers): these APIs count each read against the service account's own project, so every call fails with "API has not been used in project ".
apis.tf: newscan_quotaresource enablescloudkms,sqladmin,spanner,dataflow,bigquery,orgpolicyandaccesscontextmanagerin the host project, behindenable_scan_quota_apis(defaulttrue).scan_quota, so an org policy that blocks one of them does not fail the install; only that service goes unread.install.sh: enables the seven in a separate call that warns instead of exiting.terraform/README.md: lists them, says why they belong in the host project, and tells existing installs to re-apply.main.tf: the Cloud Build comment now says trigger and worker pool config is read through Cloud Asset Inventory.Evidence: Loki, 3 days: every host-project failure is one of these seven (plus Cloud Build, which moves to Asset Inventory); the error's
consumeris the host project number.Not verified before un-draft:
serviceusage.services.useon its own project. A live scan against a test host project answers both.Merge after Nullify-Platform/nullify#18346, which moves Cloud Build reads to Cloud Asset Inventory.
Refs FDE-3031, FDE-3030.
🤖 Generated with Claude Code