search

GoogleCloudPlatform / config-validator

Golang library which provides functionality to evaluate GCP resources against Rego-based policies
Apache License 2.0
45 stars 36 forks source link

Handle project ID / project Number disparity #161

Open briantkennedy opened 3 years ago

briantkennedy commented 3 years ago

Terraform validator gets input from terraform plan which uses project ID. Meanwhile, CAI dumps rely on project number for the hierarchy. We need to resolve this discrepancy so that the same constraint target will be portable across TF Validator and Config Validator operating modes.

morgante commented 3 years ago

Related issue: https://github.com/GoogleCloudPlatform/terraform-validator/issues/182

melinath commented 3 years ago

I'm working on giving terraform-validator access to the project number. It will be a little annoying for users to have to set things up in the right order - but it wouldn't be possible to write a config validator constraint against a project number prior to project creation anyway. (And it isn't possible to write a config validator constraint against project id at all.)

morgante commented 3 years ago

And it isn't possible to write a config validator constraint against project id at all.

I think this is the part we need to fix actually, exactly because number can't be determined pre-deployment.

melinath commented 3 years ago

What is/are the use case(s) for writing a validation rule against a specific project pre-deployment? Is this a thing people are currently doing and/or want to be able to do?

morgante commented 3 years ago

The use case is primarily if projects are following a common naming convention so you want to use a glob in it, but I agree that's probably an edge case we don't need to prioritize.