fix(lwpreflight): require storage.objects.list for GCP Agentless - #1853
Closed
lokesh-vadlamudi wants to merge 1 commit into
Closed
fix(lwpreflight): require storage.objects.list for GCP Agentless#1853lokesh-vadlamudi wants to merge 1 commit into
lokesh-vadlamudi wants to merge 1 commit into
Conversation
lokesh-vadlamudi
force-pushed
the
lvadlamudi/cad-2295-gcp-agentless-objects-list
branch
from
August 12, 2026 23:49
e226d54 to
8d51f77
Compare
Terraform force-destroys the Agentless scanning bucket, which enumerates the objects before deleting them. The Agentless permission lists granted storage.objects.delete but not storage.objects.list, so the destroy died partway through with "Permission 'storage.objects.list' denied". That partial destroy is what orphans resources: the Lacework integration is itself a Terraform-managed resource that depends on the GCP ones, so it is destroyed first and the account disappears from Cloud Accounts while the GCP resources it was meant to clean up survive. The AWS Agentless lists already pair s3:ListBucket with s3:DeleteObject for this same force-destroy path. GCP was missing the equivalent. CAD-2294 CAD-2295
lokesh-vadlamudi
force-pushed
the
lvadlamudi/cad-2295-gcp-agentless-objects-list
branch
from
August 13, 2026 00:20
8d51f77 to
46e1805
Compare
Collaborator
Author
|
Superseded by #1852, which now carries this change along with the other permission-list corrections. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Deleting a GCP Agentless Workload Scanning integration that was onboarded with the provided custom IAM role fails during
terraform destroy:The integration still disappears from Cloud Accounts, and the GCP resources it was supposed to clean up survive as orphans the customer has to remove by hand.
Root cause
The Agentless permission lists granted
storage.objects.deletebut notstorage.objects.list. Terraform force-destroys the scanning bucket, and that enumerates the objects before deleting them, so delete without list cannot complete. The AWS Agentless lists already pairs3:ListBucket/s3:ListBucketVersionswiths3:DeleteObjectfor exactly this path. GCP was missing the equivalent.The orphaning is a consequence rather than a separate defect. The Lacework integration is itself a Terraform-managed resource that depends on the GCP resources, so
destroytears it down first and then dies on the bucket. Any partial destroy leaves that same shape.Change
Adds
storage.objects.listtoRequiredPermissions[Agentless]andRequiredPermissionsForOrg[Agentless]. The permission is valid in both project- and org-level custom roles.Adds a test asserting that any list granting
storage.objects.deletealso grantsstorage.objects.list. Verified it fails on both lists before the fix and passes after.CAD-2294
CAD-2295