Storage Transfer Service policies by Mohmaed-AA00 · Pull Request #402 · Hardhat-Enterprises/Policy-Deployment-Engine

Mohmaed-AA00 · 2026-05-13T12:31:46Z

No description provided.

github-actions · 2026-05-13T12:32:06Z

🔍 Documentation Check Failed

Status: ❌ CHECKS FAILED

⚠️ Your PR does not include documentation updates:

❌ No documentation changes found - please update docs for your assigned service

Please add or update documentation in the docs/gcp/ folder for your changes before this PR can be reviewed.

github-actions · 2026-05-13T12:41:14Z

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.source_agent_pool_name.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is not using an approved source agent pool.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.role_arn.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job uses an AWS S3 source without an approved IAM role ARN.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.delete_objects_from_source_after_transfer.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job deletes objects from the source after transfer.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.overwrite_when.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is configured to always overwrite objects in the destination.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.Bandwidth_limit.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool is configured with an unsafe bandwidth limit.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.name.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool name does not follow the approved agent pool naming format.', 'Non-Compliant Resources: None - All passed']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc


Summary of policy checks:
Service: Storage_Transfer_Service
  Resource: google_storage_transfer_agent_pool
    Policy: Bandwidth_limit - ❌
    Policy: name - ❌
  Resource: google_storage_transfer_job
    Policy: source_agent_pool_name - ❌
    Policy: role_arn - ❌
    Policy: delete_objects_from_source_after_transfer - ❌
    Policy: overwrite_when - ❌


Failures:
Service: Storage_Transfer_Service | Resource: google_storage_transfer_agent_pool | Policy: Bandwidth_limit
Unmentioned resources other than 'c' found: nc

Service: Storage_Transfer_Service | Resource: google_storage_transfer_agent_pool | Policy: name
Unmentioned resources other than 'c' found: nc

Service: Storage_Transfer_Service | Resource: google_storage_transfer_job | Policy: source_agent_pool_name
Unmentioned resources other than 'c' found: nc

Service: Storage_Transfer_Service | Resource: google_storage_transfer_job | Policy: role_arn
Unmentioned resources other than 'c' found: nc

Service: Storage_Transfer_Service | Resource: google_storage_transfer_job | Policy: delete_objects_from_source_after_transfer
Unmentioned resources other than 'c' found: nc

Service: Storage_Transfer_Service | Resource: google_storage_transfer_job | Policy: overwrite_when
Unmentioned resources other than 'c' found: nc

github-actions · 2026-05-13T15:13:32Z

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.source_agent_pool_name.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is not using an approved source agent pool.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.source_agent_pool_name to an approved agent pool., Use a controlled agent pool for transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.role_arn.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job uses an unapproved AWS IAM role ARN.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.aws_s3_data_source.role_arn to an approved IAM role ARN., Avoid using unapproved AWS IAM roles for Storage Transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.delete_objects_from_source_after_transfer.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job deletes objects from the source after transfer.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.transfer_options.delete_objects_from_source_after_transfer to false., Use a copy-based transfer instead of deleting source data automatically.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.overwrite_when.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is configured to always overwrite objects in the destination.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set overwrite_when to a safer value., Avoid unconditional overwriting of destination objects.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.Bandwidth_limit.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool is configured with an unsafe bandwidth limit.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set bandwidth_limit.limit_mbps to an approved lower value., Avoid excessive bandwidth allocations on transfer agent pools.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.name.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool uses a disallowed name.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use an approved Storage Transfer agent pool name., Do not use disallowed agent pool identifiers.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Storage_Transfer_Service
  Resource: google_storage_transfer_agent_pool
    Policy: Bandwidth_limit - ✅
    Policy: name - ✅
  Resource: google_storage_transfer_job
    Policy: source_agent_pool_name - ✅
    Policy: role_arn - ✅
    Policy: delete_objects_from_source_after_transfer - ✅
    Policy: overwrite_when - ✅

jinglong857

Hi @Mohmaed-AA00, rosource_json is missing in your documentation. Please ensure to include them. Example for reference:

github-actions · 2026-05-21T13:05:52Z

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.Bandwidth_limit.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool is configured with an unsafe bandwidth limit.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set bandwidth_limit.limit_mbps to an approved lower value., Avoid excessive bandwidth allocations on transfer agent pools.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.name.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool uses a disallowed name.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use an approved Storage Transfer agent pool name., Do not use disallowed agent pool identifiers.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.delete_objects_from_source_after_transfer.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job deletes objects from the source after transfer.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.transfer_options.delete_objects_from_source_after_transfer to false., Use a copy-based transfer instead of deleting source data automatically.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.role_arn.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job uses an unapproved AWS IAM role ARN.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.aws_s3_data_source.role_arn to an approved IAM role ARN., Avoid using unapproved AWS IAM roles for Storage Transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.include_prefixes_required.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job does not restrict transfer scope with include_prefixes.', 'Non-Compliant Resources: noncompliant-transfer-job', 'Potential Remedies: Set object_conditions.include_prefixes to limit which objects are transferred.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.source_agent_pool_name.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is not using an approved source agent pool.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.source_agent_pool_name to an approved agent pool., Use a controlled agent pool for transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.overwrite_when.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is configured to always overwrite objects in the destination.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set overwrite_when to a safer value., Avoid unconditional overwriting of destination objects.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Storage_Transfer_Service
  Resource: google_storage_transfer_agent_pool
    Policy: Bandwidth_limit - ✅
    Policy: name - ✅
  Resource: google_storage_transfer_job
    Policy: delete_objects_from_source_after_transfer - ✅
    Policy: role_arn - ✅
    Policy: include_prefixes_required - ❌
    Policy: source_agent_pool_name - ✅
    Policy: overwrite_when - ✅


Failures:
Service: Storage_Transfer_Service | Resource: google_storage_transfer_job | Policy: include_prefixes_required
Unmentioned resources other than 'c' found: nc

This reverts commit 50e85cb.

github-actions · 2026-05-21T13:13:35Z

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.Bandwidth_limit.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool is configured with an unsafe bandwidth limit.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set bandwidth_limit.limit_mbps to an approved lower value., Avoid excessive bandwidth allocations on transfer agent pools.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.name.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool uses a disallowed name.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use an approved Storage Transfer agent pool name., Do not use disallowed agent pool identifiers.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.delete_objects_from_source_after_transfer.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job deletes objects from the source after transfer.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.transfer_options.delete_objects_from_source_after_transfer to false., Use a copy-based transfer instead of deleting source data automatically.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.role_arn.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job uses an unapproved AWS IAM role ARN.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.aws_s3_data_source.role_arn to an approved IAM role ARN., Avoid using unapproved AWS IAM roles for Storage Transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.source_agent_pool_name.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is not using an approved source agent pool.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.source_agent_pool_name to an approved agent pool., Use a controlled agent pool for transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.overwrite_when.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is configured to always overwrite objects in the destination.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set overwrite_when to a safer value., Avoid unconditional overwriting of destination objects.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Storage_Transfer_Service
  Resource: google_storage_transfer_agent_pool
    Policy: Bandwidth_limit - ✅
    Policy: name - ✅
  Resource: google_storage_transfer_job
    Policy: delete_objects_from_source_after_transfer - ✅
    Policy: role_arn - ✅
    Policy: source_agent_pool_name - ✅
    Policy: overwrite_when - ✅

jinglong857

Hi @Mohmaed-AA00, please complete your documentation and include the resource_json file in docs. Even your markdown is incomplete.

github-actions · 2026-05-24T09:45:20Z

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.Bandwidth_limit.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool is configured with an unsafe bandwidth limit.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set bandwidth_limit.limit_mbps to an approved lower value., Avoid excessive bandwidth allocations on transfer agent pools.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.name.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool uses a disallowed name.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use an approved Storage Transfer agent pool name., Do not use disallowed agent pool identifiers.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.delete_objects_from_source_after_transfer.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job deletes objects from the source after transfer.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.transfer_options.delete_objects_from_source_after_transfer to false., Use a copy-based transfer instead of deleting source data automatically.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.role_arn.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job uses an unapproved AWS IAM role ARN.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.aws_s3_data_source.role_arn to an approved IAM role ARN., Avoid using unapproved AWS IAM roles for Storage Transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.source_agent_pool_name.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is not using an approved source agent pool.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.source_agent_pool_name to an approved agent pool., Use a controlled agent pool for transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.overwrite_when.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is configured to always overwrite objects in the destination.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set overwrite_when to a safer value., Avoid unconditional overwriting of destination objects.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Storage_Transfer_Service
  Resource: google_storage_transfer_agent_pool
    Policy: Bandwidth_limit - ✅
    Policy: name - ✅
  Resource: google_storage_transfer_job
    Policy: delete_objects_from_source_after_transfer - ✅
    Policy: role_arn - ✅
    Policy: source_agent_pool_name - ✅
    Policy: overwrite_when - ✅

github-actions · 2026-05-24T10:12:14Z

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.Bandwidth_limit.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool is configured with an unsafe bandwidth limit.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set bandwidth_limit.limit_mbps to an approved lower value., Avoid excessive bandwidth allocations on transfer agent pools.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.name.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool uses a disallowed name.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use an approved Storage Transfer agent pool name., Do not use disallowed agent pool identifiers.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.delete_objects_from_source_after_transfer.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job deletes objects from the source after transfer.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.transfer_options.delete_objects_from_source_after_transfer to false., Use a copy-based transfer instead of deleting source data automatically.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.role_arn.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job uses an unapproved AWS IAM role ARN.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.aws_s3_data_source.role_arn to an approved IAM role ARN., Avoid using unapproved AWS IAM roles for Storage Transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.source_agent_pool_name.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is not using an approved source agent pool.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.source_agent_pool_name to an approved agent pool., Use a controlled agent pool for transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.overwrite_when.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is configured to always overwrite objects in the destination.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set overwrite_when to a safer value., Avoid unconditional overwriting of destination objects.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Storage_Transfer_Service
  Resource: google_storage_transfer_agent_pool
    Policy: Bandwidth_limit - ✅
    Policy: name - ✅
  Resource: google_storage_transfer_job
    Policy: delete_objects_from_source_after_transfer - ✅
    Policy: role_arn - ✅
    Policy: source_agent_pool_name - ✅
    Policy: overwrite_when - ✅

jinglong857

Hi @Mohmaed-AA00, Thank you for providing the documentation but the json files must document all resource arguments, not just security-relevant ones. For attributes with no security impact, include them with security_impact: false and a rationale explaining why no policy was implemented. Do not delete them. Look at how other resources in the project handle this Please also address feedback mentioned below.

jinglong857 · 2026-05-25T02:59:20Z

+        {
+            "condition": "Storage Transfer agent pool name must not use disallowed values.",
+            "attribute_path": ["name"],
+            "values": ["nc"],


The policy blacklists only the single value "nc". "nc" is the test resource label, not a meaningful unsafe pool name. A real name policy would enforce an approved naming convention, for example a pattern_blacklist for names starting with "goog" (which the Terraform docs explicitly prohibit), or a whitelist of approved name patterns.

jinglong857 · 2026-05-25T03:04:00Z

+       {
+            "condition": "Storage Transfer job must not use an unapproved AWS IAM role ARN.",
+            "attribute_path": ["transfer_spec", 0, "aws_s3_data_source", 0, "role_arn"],
+            "values": ["arn:aws:iam::123456789012:role/unsafe-role"],


The blacklist contains only one specific ARN: "arn:aws:iam::123456789012:role/unsafe-role". Would be better to use a whitelist of approved ARN patterns

jinglong857 · 2026-05-25T03:24:32Z

-      "security_impact": null,
-      "rationale": null,
-      "compliant": null,
+      "security_impact": false,


name.security_impact: false contradicts an implemented policy. A policy was implemented for name, so security_impact should be true.

github-actions · 2026-05-26T06:56:50Z

🔍 Policy Check Results

Status: ❌ CHECKS FAILED

⚠️ Your PR will not be reviewed until you fix all policy check failures below:

Test Output

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.Bandwidth_limit.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool is configured with an unsafe bandwidth limit.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set bandwidth_limit.limit_mbps to an approved lower value., Avoid excessive bandwidth allocations on transfer agent pools.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.name.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool uses an unapproved name.', 'Non-Compliant Resources: goog-agent-pool', 'Potential Remedies: Use an approved Storage Transfer agent pool name., Do not use reserved or unapproved agent pool names such as names starting with goog.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 0
 Missing mentions: c, nc
Check failed: Unmentioned resources other than 'c' found: nc

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.delete_objects_from_source_after_transfer.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job deletes objects from the source after transfer.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.transfer_options.delete_objects_from_source_after_transfer to false., Use a copy-based transfer instead of deleting source data automatically.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.role_arn.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job uses an unapproved AWS IAM role ARN.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use an approved AWS IAM role ARN for Storage Transfer jobs., Use a dedicated approved IAM role instead of an unapproved role.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.source_agent_pool_name.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is not using an approved source agent pool.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.source_agent_pool_name to an approved agent pool., Use a controlled agent pool for transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.overwrite_when.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is configured to always overwrite objects in the destination.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set overwrite_when to a safer value., Avoid unconditional overwriting of destination objects.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Storage_Transfer_Service
  Resource: google_storage_transfer_agent_pool
    Policy: Bandwidth_limit - ✅
    Policy: name - ❌
  Resource: google_storage_transfer_job
    Policy: delete_objects_from_source_after_transfer - ✅
    Policy: role_arn - ✅
    Policy: source_agent_pool_name - ✅
    Policy: overwrite_when - ✅


Failures:
Service: Storage_Transfer_Service | Resource: google_storage_transfer_agent_pool | Policy: name
Unmentioned resources other than 'c' found: nc

jinglong857

Hi @Mohmaed-AA00 , the auto policy check failed. Please address it and address my earlier feedback regarding documentation. Do not delete arguments that are not security relevant, include them with security_impact: false and rationale explaining why no policy was implemented.

github-actions · 2026-05-28T07:26:51Z

🔍 Policy Check Results

Status: ✅ All checks passed

Test Output

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.Bandwidth_limit.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool is configured with an unsafe bandwidth limit.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set bandwidth_limit.limit_mbps to an approved lower value., Avoid excessive bandwidth allocations on transfer agent pools.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_agent_pool.name.message
Total Storage Transfer agent pool detected: 2 
['Situation 1: Storage Transfer agent pool uses an unapproved name.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use an approved Storage Transfer agent pool name., Do not use reserved or unapproved agent pool names such as names starting with goog.']
Unique resource names in plan (google_storage_transfer_agent_pool): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.delete_objects_from_source_after_transfer.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job deletes objects from the source after transfer.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.transfer_options.delete_objects_from_source_after_transfer to false., Use a copy-based transfer instead of deleting source data automatically.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.role_arn.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job uses an unapproved AWS IAM role ARN.', 'Non-Compliant Resources: nc', 'Potential Remedies: Use an approved AWS IAM role ARN for Storage Transfer jobs., Use a dedicated approved IAM role instead of an unapproved role.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.source_agent_pool_name.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is not using an approved source agent pool.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set transfer_spec.source_agent_pool_name to an approved agent pool., Use a controlled agent pool for transfer jobs.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed

OPA check: data.terraform.gcp.security.Storage_Transfer_Service.google_storage_transfer_job.overwrite_when.message
Total Storage Transfer job detected: 2 
['Situation 1: Storage Transfer job is configured to always overwrite objects in the destination.', 'Non-Compliant Resources: nc', 'Potential Remedies: Set overwrite_when to a safer value., Avoid unconditional overwriting of destination objects.']
Unique resource names in plan (google_storage_transfer_job): 2
Names mentioned in output: 1
 Missing mentions: c
Only compliant resources are unmentioned; ignoring
Check passed


Summary of policy checks:
Service: Storage_Transfer_Service
  Resource: google_storage_transfer_agent_pool
    Policy: Bandwidth_limit - ✅
    Policy: name - ✅
  Resource: google_storage_transfer_job
    Policy: delete_objects_from_source_after_transfer - ✅
    Policy: role_arn - ✅
    Policy: source_agent_pool_name - ✅
    Policy: overwrite_when - ✅

jinglong857

Hi @Mohmaed-AA00 , you still haven't addressed my earlier feedback regarding your documentation. Include all arguments in your documentation, if they are not security relevant provide rationale why, do not omit them. Additionally, ensure your documentation matches your terraform configuration and policy implementation. If you're not sure how document is done, please refer to the upskilling guide.

Add Storage Transfer Service policies

1c1dcc1

github-actions Bot added the CI-Review-Required PR requires review due to failed CI checks label May 13, 2026

Add Storage Transfer Service documentation

75821af

Fix Storage Transfer Service policy checks

3063c3b

github-actions Bot added CI-Approved PR approved by CI checks and removed CI-Review-Required PR requires review due to failed CI checks labels May 13, 2026

jinglong857 reviewed May 16, 2026

View reviewed changes

jinglong857 self-assigned this May 16, 2026

Add include_prefixes_required policy for Storage Transfer job

50e85cb

github-actions Bot added CI-Review-Required PR requires review due to failed CI checks and removed CI-Approved PR approved by CI checks labels May 21, 2026

Revert "Add include_prefixes_required policy for Storage Transfer job"

4d64f53

This reverts commit 50e85cb.

github-actions Bot added CI-Approved PR approved by CI checks and removed CI-Review-Required PR requires review due to failed CI checks labels May 21, 2026

Mohmaed-AA00 requested a review from jinglong857 May 21, 2026 13:13

jinglong857 requested changes May 22, 2026

View reviewed changes

Add include_prefixes_required policy for Storage Transfer job

b854463

Fix Storage Transfer Service documentation

5c71425

Mohmaed-AA00 requested a review from jinglong857 May 24, 2026 18:16

jinglong857 requested changes May 25, 2026

View reviewed changes

jinglong857 added the 1st review label May 26, 2026

Address Storage Transfer Service review feedback

d0a25a4

github-actions Bot added CI-Review-Required PR requires review due to failed CI checks and removed CI-Approved PR approved by CI checks labels May 26, 2026

Fix agent pool name policy check output

bf46184

github-actions Bot added CI-Approved PR approved by CI checks and removed CI-Review-Required PR requires review due to failed CI checks labels May 26, 2026

Mohmaed-AA00 requested a review from jinglong857 May 26, 2026 08:37

jinglong857 requested changes May 26, 2026

View reviewed changes

Rerun Storage Transfer Service checks

7a782e2

Mohmaed-AA00 requested a review from jinglong857 May 28, 2026 07:27

jinglong857 added the 2nd review label May 28, 2026

jinglong857 requested changes May 28, 2026

View reviewed changes

jinglong857 added the 3rd review label May 28, 2026

Conversation

Mohmaed-AA00 commented May 13, 2026

Uh oh!

github-actions Bot commented May 13, 2026

🔍 Documentation Check Failed

Uh oh!

github-actions Bot commented May 13, 2026

🔍 Policy Check Results

Test Output

Uh oh!

github-actions Bot commented May 13, 2026

🔍 Policy Check Results

Test Output

Uh oh!

jinglong857 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 21, 2026

🔍 Policy Check Results

Test Output

Uh oh!

github-actions Bot commented May 21, 2026

🔍 Policy Check Results

Test Output

Uh oh!

jinglong857 left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 24, 2026

🔍 Policy Check Results

Test Output

Uh oh!

github-actions Bot commented May 24, 2026

🔍 Policy Check Results

Test Output

Uh oh!

jinglong857 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jinglong857 May 25, 2026

Choose a reason for hiding this comment

Uh oh!

jinglong857 May 25, 2026

Choose a reason for hiding this comment

Uh oh!

jinglong857 May 25, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 26, 2026

🔍 Policy Check Results

Test Output

Uh oh!

jinglong857 left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 28, 2026

🔍 Policy Check Results

Test Output

Uh oh!

jinglong857 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jinglong857 left a comment •

edited

Loading