HansMarcus01 opened a new pull request, #39894:
URL: https://github.com/apache/beam/pull/39894
## Summary
- Rename service account key policy issues to make their purpose clearer.
- Use `[IAC_DRIFT_SA_KEY]` exclusively for unmanaged service account keys.
- Use `[ACCOUNT_KEYS_POLICY]` for service account policy drift.
- Add remediation guidance for deleting unmanaged keys and replacing them
through the official rotation system.
- Link users to `infra/keys/README.md` for additional information.
- Update the enforcement documentation and existing tests.
## Issue Classification
- `[IAC_DRIFT_SA_KEY] Action Required: Unmanaged Service Account Keys
Detected`
- Reports service account keys found in IAM that are not registered by the
official rotation system.
- `[ACCOUNT_KEYS_POLICY] Action Required: Service Account Policy Drift`
- Reports undeclared service accounts, undeclared managed secrets, and
permission mismatches.
## Remediation Guidance
The unmanaged key issue now instructs users to:
1. Delete all reported keys as soon as possible.
2. Replace them using the official Beam key rotation system.
3. Run the audit again to verify that the keys are correctly managed.
## Validation
- Python syntax validation completed successfully with `py_compile`.
- Existing `test_sending.py` tests pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
