🧠 Google Project with KMS keys has a principal with Owner role - prod.logic.yaml🟢

• Contextual name: 🧠 prod.logic.yaml🟢
• ID: /ce/ca/google/iam/kms-project-has-owner/prod.logic.yaml
• Tags:
  • 🟢 Logic test success
  • 🟢 Logic with extracts
  • 🟢 Logic with test data

Uses

• 📗 Google Project
• 🔌 Google Cloud KMS Crypto Key - object.extracts.yaml
• 🔌 Google IAM Role - object.extracts.yaml
• 🔌 Google Project - object.extracts.yaml
• 🔌 Google IAM Policy Binding - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2025-10-25T12:02:46.724522773Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	001	✔️ 199	✔️ CA10__Google_CloudKSM_Crypto_Keys__r.hasNo(INCOMPLIANT)	✔️ null
🟢	002	✔️ 300	✔️ otherwise	✔️ null
🟢	003	✔️ 299	✔️ CA10__Google_IAM_Policy_Bindings__r.has(INCOMPLIANT) && CA10__Google_CloudKSM_Crypto_Keys__r.has(INCOMPLIANT)	✔️ null
🟢	004	✔️ 199	✔️ CA10__Google_CloudKSM_Crypto_Keys__r.hasNo(INCOMPLIANT)	✔️ null

Generation Bundle

	File	MD5
Open	/ce/ca/google/iam/kms-project-has-owner/policy.yaml	3AC2681DB05903381D6B59AC31C3A47C
Open	/ce/ca/google/iam/kms-project-has-owner/prod.logic.yaml	3E04A5C3B9F5EDC6E69ED24234BA0293
Open	/ce/ca/google/iam/kms-project-has-owner/test-data.json	6B7DCEE33B5F0D17B8749CF562B0E87E
Open	/types/CA10__CaGoogleCloudKmsCryptoKey__c/object.extracts.yaml	FBA6F55EDAD759EA3CCFC1311CEB0AAB
Open	/types/CA10__CaGoogleIamRole__c/object.extracts.yaml	545CD4D347F041DCDD9980D122D63882
Open	/types/CA10__CaGoogleProject__c/object.extracts.yaml	8EB422663BF4493D44ABA5FEC0FB9AD4
Open	/types/CA10__CaGoogleIamPolicyBinding__c/object.extracts.yaml	DA65DB880E2440923287921FF4E70B30

Available Commands

repo-manager policies generate FULL /ce/ca/google/iam/kms-project-has-owner/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/google/iam/kms-project-has-owner/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/google/iam/kms-project-has-owner/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/google/iam/kms-project-has-owner/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/google/iam/kms-project-has-owner/prod.logic.yaml

Content

Open File

---
inputType: "CA10__CaGoogleProject__c"
testData:
  - file: test-data.json
importExtracts:
  - file: /types/CA10__CaGoogleProject__c/object.extracts.yaml
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "This project does not contain any KMS keys."
    check:
      RELATED_LIST_HAS_NO:
        status: "INCOMPLIANT"
        relationshipName: "CA10__Google_CloudKSM_Crypto_Keys__r"
  - status: "INCOMPLIANT"
    currentStateMessage: "The project contains cryptographic keys and has a principal with Owner permissions."
    remediationMessage: "Assign more granular predefined or custom roles instead."
    check:
      AND:
        args:
          - RELATED_LIST_HAS:
              status: "INCOMPLIANT"
              relationshipName: "CA10__Google_IAM_Policy_Bindings__r"
          - RELATED_LIST_HAS:
              status: "INCOMPLIANT"
              relationshipName: "CA10__Google_CloudKSM_Crypto_Keys__r"
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "The project either does not have any principals with the Owner role."
relatedLists:
  - relationshipName: "CA10__Google_IAM_Policy_Bindings__r"
    importExtracts:
      - file: "/types/CA10__CaGoogleIamPolicyBinding__c/object.extracts.yaml"
      - file: /types/CA10__CaGoogleIamRole__c/object.extracts.yaml
    recordTypes:
      - "caGoogleIamPolicyBindingProject"
    conditions: 
       - status: "COMPLIANT"
         currentStateMessage: "Binding without a role."
         check:
           IS_EMPTY_LOOKUP: "CA10__iamRole__r"
       - status: "INCOMPLIANT"
         currentStateMessage: "This principal is assigned the Owner role at the project level."
         remediationMessage: "Remove the binding."
         check: 
           IS_EQUAL:
            left:
              EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
            right:
              TEXT: "roles/owner"
    otherwise:
      status: "COMPLIANT"
      currentStateMessage: "Other IAM Role Bindings."
  - relationshipName: "CA10__Google_CloudKSM_Crypto_Keys__r"
    importExtracts:
      - file: "/types/CA10__CaGoogleCloudKmsCryptoKey__c/object.extracts.yaml"
    conditions: []
    otherwise:
      status: "INCOMPLIANT"
      currentStateMessage: "The Project with KMS Crypto Key."