TFS tfSTRIDE

Built-in scenario

gcp/sample_gcp_safe_plan.json

Safe GCP Plan Demo

Analyzed sample_gcp_safe_plan.json with 9 normalized resources and 1 trust boundaries.

Analyze another plan

Active findings

0

Analysis gaps

0

Trust boundaries

1

Resources

9

Observations

0
High 0
Medium 0
Low 0

Analysis coverage

Audit trail for this run

Terraform resources 9
Unsupported 0
Enabled rules 97
Unresolved refs 0

Sensitive resource labels are assumptions based on resource class. tfSTRIDE does not assess stored data contents from the plan.

Resource coverage

Provider resources considered
9
Normalized resources
9

No unsupported GCP resource types were encountered.

Rule coverage

Registered rules
97
Disabled rules
0

No enabled rules produced findings.

Analysis gaps

Unassessed operation paths

No operation gaps were reported by the 4 analysis families that ran. This does not establish complete authorization coverage.

Findings

Severity bands

High

0

No high findings.

Medium

0

No medium findings.

Low

0

No low findings.

Observations

Controls and mitigating signals

No observations were recorded for this plan.

Trust boundaries

Crossings that drive the model

Source
google_compute_instance.web
Relationship
workload-to-data-store
Destination
google_sql_database_instance.app

Rationale: Application or function workloads cross into a higher-sensitivity data plane when they share a VPC with the database and the plan does not provide tighter security-group evidence.

Raw outputs

Stable contract and markdown

JSON report 
{
  "kind": "tfstride-report",
  "version": "1.3",
  "tool": {
    "name": "tfstride",
    "version": "0.5.0"
  },
  "title": "Safe GCP Plan Demo",
  "analyzed_file": "sample_gcp_safe_plan.json",
  "analyzed_path": "sample_gcp_safe_plan.json",
  "summary": {
    "normalized_resources": 9,
    "unsupported_resources": 0,
    "trust_boundaries": 1,
    "active_findings": 0,
    "total_findings": 0,
    "suppressed_findings": 0,
    "baselined_findings": 0,
    "severity_counts": {
      "high": 0,
      "medium": 0,
      "low": 0
    }
  },
  "filtering": {
    "total_findings": 0,
    "active_findings": 0,
    "suppressed_findings": 0,
    "baselined_findings": 0,
    "suppressions_path": null,
    "baseline_path": null
  },
  "analysis_coverage": {
    "resources": {
      "total_resources": 9,
      "provider_resources": 9,
      "normalized_resources": 9,
      "unsupported_resources": 0,
      "plan_time_unknown_resources": 0,
      "unsupported_resource_types": {}
    },
    "rules": {
      "registered_rule_count": 97,
      "enabled_rules": [
        "gcp-sensitive-resource-iam-external-access",
        "gcp-pubsub-public-access",
        "gcp-pubsub-topic-customer-managed-encryption-missing",
        "gcp-pubsub-message-retention-insufficient",
        "gcp-pubsub-subscription-dead-letter-policy-missing",
        "gcp-bigquery-public-access",
        "gcp-cloud-sql-public-authorized-network",
        "gcp-cloud-sql-backup-disabled",
        "gcp-cloud-sql-public-ip-without-private-network",
        "gcp-cloud-sql-ssl-not-required",
        "gcp-cloud-sql-point-in-time-recovery-disabled",
        "gcp-cloud-sql-deletion-protection-disabled",
        "gcp-cloud-sql-zonal-availability",
        "gcp-cloud-sql-query-insights-disabled",
        "gcp-cloud-sql-connector-enforcement-not-required",
        "gcp-firestore-customer-managed-encryption-missing",
        "gcp-firestore-point-in-time-recovery-disabled-or-unknown",
        "gcp-firestore-delete-protection-disabled-or-unknown",
        "gcp-cloud-sql-private-connectivity-not-modeled",
        "gcp-private-workload-private-google-access-disabled",
        "gcp-gcs-public-access",
        "gcp-gcs-uniform-bucket-level-access-disabled",
        "gcp-gcs-public-access-prevention-not-enforced",
        "gcp-gcs-versioning-disabled",
        "gcp-gcs-customer-managed-encryption-missing",
        "gcp-gcs-retention-policy-insufficient",
        "gcp-artifact-registry-docker-tags-mutable",
        "gcp-artifact-registry-customer-managed-encryption-missing",
        "gcp-artifact-registry-vulnerability-scanning-disabled",
        "gcp-secret-manager-customer-managed-encryption-missing",
        "gcp-secret-manager-lifecycle-posture-incomplete",
        "gcp-kms-key-rotation-not-configured-or-too-long",
        "gcp-kms-key-destroy-scheduled-duration-too-short",
        "gcp-public-compute-broad-ingress",
        "gcp-public-load-balanced-workload",
        "gcp-load-balancer-http-public-proxy",
        "gcp-load-balancer-ssl-policy-missing-or-weak",
        "gcp-public-load-balancer-cloud-armor-missing",
        "gcp-compute-os-login-disabled",
        "gcp-gke-public-control-plane",
        "gcp-gke-broad-authorized-networks",
        "gcp-gke-workload-identity-disabled",
        "gcp-gke-legacy-metadata-endpoints-enabled",
        "gcp-gke-broad-node-service-account",
        "gcp-gke-control-plane-logging-incomplete",
        "gcp-scc-asset-discovery-disabled",
        "gcp-logging-exclusion-drops-audit-security-logs",
        "gcp-logging-sink-audit-export-incomplete",
        "gcp-central-audit-sink-not-modeled",
        "gcp-subnetwork-flow-logs-not-configured",
        "gcp-subnetwork-flow-log-capture-incomplete",
        "gcp-gke-network-policy-disabled",
        "gcp-gke-secrets-encryption-not-configured",
        "gcp-gke-legacy-abac-enabled-or-unknown",
        "gcp-gke-client-certificate-auth-enabled-or-unknown",
        "gcp-gke-shielded-nodes-disabled-or-unknown",
        "gcp-gke-binary-authorization-not-enabled",
        "gcp-cloud-run-public-invoker",
        "gcp-cloud-functions-public-invoker",
        "gcp-cloud-run-image-not-digest-pinned",
        "gcp-cloud-run-artifact-registry-mutable-tag",
        "gcp-cloud-run-can-modify-image-repository",
        "gcp-cloud-run-sensitive-environment-value-inline",
        "gcp-cloud-run-secret-access-blast-radius",
        "gcp-public-cloud-run-firestore-mutation-access",
        "gcp-public-cloud-run-firestore-entity-disruption",
        "gcp-public-cloud-run-firestore-database-topology-disruption",
        "gcp-public-cloud-run-firestore-read-access",
        "gcp-public-cloud-run-kms-decrypt-access",
        "gcp-public-cloud-run-kms-signing-access",
        "gcp-public-cloud-run-kms-key-disruption",
        "gcp-public-cloud-run-kms-authorization-delegation",
        "gcp-public-cloud-run-secret-tampering",
        "gcp-public-cloud-run-secret-disruption",
        "gcp-public-cloud-run-gcs-mutation-access",
        "gcp-public-cloud-run-gcs-object-disruption",
        "gcp-public-cloud-run-gcs-bucket-topology-disruption",
        "gcp-public-cloud-run-pubsub-mutation-access",
        "gcp-public-cloud-run-pubsub-consume-access",
        "gcp-public-cloud-run-pubsub-message-disruption",
        "gcp-public-cloud-run-pubsub-topology-disruption",
        "gcp-public-cloud-run-logging-sink-disruption",
        "gcp-service-account-iam-broad-principal",
        "gcp-service-account-iam-privileged-role",
        "gcp-service-account-key-hygiene",
        "gcp-service-account-key-effective-access",
        "gcp-workload-identity-pool-wide-impersonation",
        "gcp-workload-identity-provider-unconditioned-broad-trust",
        "gcp-workload-identity-privileged-service-account-access",
        "gcp-org-folder-iam-broad-principal",
        "gcp-org-folder-iam-privileged-role",
        "gcp-project-iam-broad-principal",
        "gcp-project-iam-privileged-role",
        "gcp-iam-privileged-assignment",
        "gcp-inherited-iam-sensitive-resource-access",
        "gcp-inherited-iam-blast-radius",
        "gcp-public-workload-sensitive-data-access"
      ],
      "disabled_rules": [],
      "severity_overrides": {},
      "finding_counts_by_rule": {
        "gcp-sensitive-resource-iam-external-access": 0,
        "gcp-pubsub-public-access": 0,
        "gcp-pubsub-topic-customer-managed-encryption-missing": 0,
        "gcp-pubsub-message-retention-insufficient": 0,
        "gcp-pubsub-subscription-dead-letter-policy-missing": 0,
        "gcp-bigquery-public-access": 0,
        "gcp-cloud-sql-public-authorized-network": 0,
        "gcp-cloud-sql-backup-disabled": 0,
        "gcp-cloud-sql-public-ip-without-private-network": 0,
        "gcp-cloud-sql-ssl-not-required": 0,
        "gcp-cloud-sql-point-in-time-recovery-disabled": 0,
        "gcp-cloud-sql-deletion-protection-disabled": 0,
        "gcp-cloud-sql-zonal-availability": 0,
        "gcp-cloud-sql-query-insights-disabled": 0,
        "gcp-cloud-sql-connector-enforcement-not-required": 0,
        "gcp-firestore-customer-managed-encryption-missing": 0,
        "gcp-firestore-point-in-time-recovery-disabled-or-unknown": 0,
        "gcp-firestore-delete-protection-disabled-or-unknown": 0,
        "gcp-cloud-sql-private-connectivity-not-modeled": 0,
        "gcp-private-workload-private-google-access-disabled": 0,
        "gcp-gcs-public-access": 0,
        "gcp-gcs-uniform-bucket-level-access-disabled": 0,
        "gcp-gcs-public-access-prevention-not-enforced": 0,
        "gcp-gcs-versioning-disabled": 0,
        "gcp-gcs-customer-managed-encryption-missing": 0,
        "gcp-gcs-retention-policy-insufficient": 0,
        "gcp-artifact-registry-docker-tags-mutable": 0,
        "gcp-artifact-registry-customer-managed-encryption-missing": 0,
        "gcp-artifact-registry-vulnerability-scanning-disabled": 0,
        "gcp-secret-manager-customer-managed-encryption-missing": 0,
        "gcp-secret-manager-lifecycle-posture-incomplete": 0,
        "gcp-kms-key-rotation-not-configured-or-too-long": 0,
        "gcp-kms-key-destroy-scheduled-duration-too-short": 0,
        "gcp-public-compute-broad-ingress": 0,
        "gcp-public-load-balanced-workload": 0,
        "gcp-load-balancer-http-public-proxy": 0,
        "gcp-load-balancer-ssl-policy-missing-or-weak": 0,
        "gcp-public-load-balancer-cloud-armor-missing": 0,
        "gcp-compute-os-login-disabled": 0,
        "gcp-gke-public-control-plane": 0,
        "gcp-gke-broad-authorized-networks": 0,
        "gcp-gke-workload-identity-disabled": 0,
        "gcp-gke-legacy-metadata-endpoints-enabled": 0,
        "gcp-gke-broad-node-service-account": 0,
        "gcp-gke-control-plane-logging-incomplete": 0,
        "gcp-scc-asset-discovery-disabled": 0,
        "gcp-logging-exclusion-drops-audit-security-logs": 0,
        "gcp-logging-sink-audit-export-incomplete": 0,
        "gcp-central-audit-sink-not-modeled": 0,
        "gcp-subnetwork-flow-logs-not-configured": 0,
        "gcp-subnetwork-flow-log-capture-incomplete": 0,
        "gcp-gke-network-policy-disabled": 0,
        "gcp-gke-secrets-encryption-not-configured": 0,
        "gcp-gke-legacy-abac-enabled-or-unknown": 0,
        "gcp-gke-client-certificate-auth-enabled-or-unknown": 0,
        "gcp-gke-shielded-nodes-disabled-or-unknown": 0,
        "gcp-gke-binary-authorization-not-enabled": 0,
        "gcp-cloud-run-public-invoker": 0,
        "gcp-cloud-functions-public-invoker": 0,
        "gcp-cloud-run-image-not-digest-pinned": 0,
        "gcp-cloud-run-artifact-registry-mutable-tag": 0,
        "gcp-cloud-run-can-modify-image-repository": 0,
        "gcp-cloud-run-sensitive-environment-value-inline": 0,
        "gcp-cloud-run-secret-access-blast-radius": 0,
        "gcp-public-cloud-run-firestore-mutation-access": 0,
        "gcp-public-cloud-run-firestore-entity-disruption": 0,
        "gcp-public-cloud-run-firestore-database-topology-disruption": 0,
        "gcp-public-cloud-run-firestore-read-access": 0,
        "gcp-public-cloud-run-kms-decrypt-access": 0,
        "gcp-public-cloud-run-kms-signing-access": 0,
        "gcp-public-cloud-run-kms-key-disruption": 0,
        "gcp-public-cloud-run-kms-authorization-delegation": 0,
        "gcp-public-cloud-run-secret-tampering": 0,
        "gcp-public-cloud-run-secret-disruption": 0,
        "gcp-public-cloud-run-gcs-mutation-access": 0,
        "gcp-public-cloud-run-gcs-object-disruption": 0,
        "gcp-public-cloud-run-gcs-bucket-topology-disruption": 0,
        "gcp-public-cloud-run-pubsub-mutation-access": 0,
        "gcp-public-cloud-run-pubsub-consume-access": 0,
        "gcp-public-cloud-run-pubsub-message-disruption": 0,
        "gcp-public-cloud-run-pubsub-topology-disruption": 0,
        "gcp-public-cloud-run-logging-sink-disruption": 0,
        "gcp-service-account-iam-broad-principal": 0,
        "gcp-service-account-iam-privileged-role": 0,
        "gcp-service-account-key-hygiene": 0,
        "gcp-service-account-key-effective-access": 0,
        "gcp-workload-identity-pool-wide-impersonation": 0,
        "gcp-workload-identity-provider-unconditioned-broad-trust": 0,
        "gcp-workload-identity-privileged-service-account-access": 0,
        "gcp-org-folder-iam-broad-principal": 0,
        "gcp-org-folder-iam-privileged-role": 0,
        "gcp-project-iam-broad-principal": 0,
        "gcp-project-iam-privileged-role": 0,
        "gcp-iam-privileged-assignment": 0,
        "gcp-inherited-iam-sensitive-resource-access": 0,
        "gcp-inherited-iam-blast-radius": 0,
        "gcp-public-workload-sensitive-data-access": 0
      }
    },
    "references": {
      "unresolved_reference_count": 0,
      "symbolically_resolved_relationships": 0,
      "ambiguous_symbolic_relationships": 0,
      "unresolved_symbolic_relationships": 0,
      "unsupported_symbolic_relationships": 0,
      "unresolved_references": []
    }
  },
  "operation_gaps": {
    "reporting_families": [
      {
        "provider": "gcp",
        "name": "cloud_run_gcs_access"
      },
      {
        "provider": "gcp",
        "name": "cloud_run_gcs_bucket_topology"
      },
      {
        "provider": "gcp",
        "name": "cloud_run_gcs_mutation"
      },
      {
        "provider": "gcp",
        "name": "cloud_run_gcs_object_deletion"
      }
    ],
    "records": []
  },
  "resource_sensitivity": {
    "basis": "resource_class_assumption",
    "data_contents_state": "not_assessed",
    "explanation": "Sensitive resource labels are assumptions based on resource class. tfSTRIDE does not assess stored data contents from the plan."
  },
  "inventory": {
    "provider": "gcp",
    "unsupported_resources": [],
    "metadata": {
      "supported_resource_types": [
        "google_artifact_registry_repository",
        "google_artifact_registry_repository_iam_binding",
        "google_artifact_registry_repository_iam_member",
        "google_artifact_registry_repository_iam_policy",
        "google_bigquery_dataset",
        "google_bigquery_dataset_iam_binding",
        "google_bigquery_dataset_iam_member",
        "google_bigquery_dataset_iam_policy",
        "google_bigquery_table",
        "google_bigquery_table_iam_binding",
        "google_bigquery_table_iam_member",
        "google_bigquery_table_iam_policy",
        "google_cloud_run_service",
        "google_cloud_run_service_iam_binding",
        "google_cloud_run_service_iam_member",
        "google_cloud_run_service_iam_policy",
        "google_cloud_run_v2_service",
        "google_cloud_run_v2_service_iam_binding",
        "google_cloud_run_v2_service_iam_member",
        "google_cloud_run_v2_service_iam_policy",
        "google_cloudfunctions2_function",
        "google_cloudfunctions2_function_iam_binding",
        "google_cloudfunctions2_function_iam_member",
        "google_cloudfunctions2_function_iam_policy",
        "google_cloudfunctions_function",
        "google_cloudfunctions_function_iam_binding",
        "google_cloudfunctions_function_iam_member",
        "google_cloudfunctions_function_iam_policy",
        "google_compute_backend_bucket",
        "google_compute_backend_service",
        "google_compute_firewall",
        "google_compute_firewall_policy",
        "google_compute_firewall_policy_association",
        "google_compute_firewall_policy_rule",
        "google_compute_forwarding_rule",
        "google_compute_global_address",
        "google_compute_global_forwarding_rule",
        "google_compute_instance",
        "google_compute_managed_ssl_certificate",
        "google_compute_network",
        "google_compute_network_endpoint_group",
        "google_compute_region_backend_service",
        "google_compute_region_network_endpoint_group",
        "google_compute_region_security_policy",
        "google_compute_region_target_http_proxy",
        "google_compute_region_target_https_proxy",
        "google_compute_region_url_map",
        "google_compute_route",
        "google_compute_router",
        "google_compute_router_nat",
        "google_compute_security_policy",
        "google_compute_service_attachment",
        "google_compute_ssl_policy",
        "google_compute_subnetwork",
        "google_compute_target_http_proxy",
        "google_compute_target_https_proxy",
        "google_compute_url_map",
        "google_container_cluster",
        "google_container_node_pool",
        "google_firestore_database",
        "google_folder",
        "google_folder_iam_binding",
        "google_folder_iam_member",
        "google_folder_iam_policy",
        "google_folder_organization_policy",
        "google_iam_deny_policy",
        "google_iam_workload_identity_pool",
        "google_iam_workload_identity_pool_provider",
        "google_kms_crypto_key",
        "google_kms_crypto_key_iam_binding",
        "google_kms_crypto_key_iam_member",
        "google_kms_crypto_key_iam_policy",
        "google_kms_crypto_key_version",
        "google_kms_key_ring",
        "google_kms_key_ring_iam_binding",
        "google_kms_key_ring_iam_member",
        "google_kms_key_ring_iam_policy",
        "google_logging_organization_exclusion",
        "google_logging_organization_sink",
        "google_logging_project_exclusion",
        "google_logging_project_sink",
        "google_network_connectivity_service_connection_policy",
        "google_org_policy_policy",
        "google_organization_iam_binding",
        "google_organization_iam_custom_role",
        "google_organization_iam_member",
        "google_organization_iam_policy",
        "google_organization_policy",
        "google_project",
        "google_project_iam_binding",
        "google_project_iam_custom_role",
        "google_project_iam_member",
        "google_project_iam_policy",
        "google_project_organization_policy",
        "google_pubsub_subscription",
        "google_pubsub_subscription_iam_binding",
        "google_pubsub_subscription_iam_member",
        "google_pubsub_subscription_iam_policy",
        "google_pubsub_topic",
        "google_pubsub_topic_iam_binding",
        "google_pubsub_topic_iam_member",
        "google_pubsub_topic_iam_policy",
        "google_scc_organization_settings",
        "google_secret_manager_secret",
        "google_secret_manager_secret_iam_binding",
        "google_secret_manager_secret_iam_member",
        "google_secret_manager_secret_iam_policy",
        "google_secret_manager_secret_version",
        "google_service_account",
        "google_service_account_iam_binding",
        "google_service_account_iam_member",
        "google_service_account_iam_policy",
        "google_service_account_key",
        "google_service_networking_connection",
        "google_sql_database_instance",
        "google_storage_bucket",
        "google_storage_bucket_iam_binding",
        "google_storage_bucket_iam_member",
        "google_storage_bucket_iam_policy"
      ],
      "total_input_resources": 9,
      "provider_resource_count": 9,
      "normalized_resource_count": 9,
      "unsupported_resource_types": {}
    },
    "resources": [
      {
        "address": "google_compute_instance.web",
        "provider": "gcp",
        "resource_type": "google_compute_instance",
        "name": "web",
        "category": "compute",
        "identifier": "tfstride-web",
        "arn": null,
        "vpc_id": "google_compute_network.main.id",
        "subnet_ids": [
          "google_compute_subnetwork.app.id"
        ],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "name": "tfstride-web",
          "project": "tfstride-demo",
          "zone": "us-central1-a",
          "machine_type": "e2-medium",
          "network_tags": [
            "web"
          ],
          "network_interfaces": [
            {
              "subnetwork": "google_compute_subnetwork.app.id"
            }
          ],
          "service_accounts": [
            {
              "email": "tfstride-web@example.iam.gserviceaccount.com",
              "scopes": [
                "https://www.googleapis.com/auth/logging.write"
              ]
            }
          ],
          "labels": {},
          "metadata": {
            "enable-oslogin": "true"
          },
          "can_ip_forward": false,
          "os_login_enabled": true,
          "public_access_reasons": [],
          "in_public_subnet": false,
          "has_nat_gateway_egress": false,
          "has_public_route": false,
          "internet_ingress_capable": false,
          "internet_ingress_reasons": [],
          "internet_ingress_uncertainties": [],
          "effective_firewall_ingress": [],
          "internet_ingress_state": "not_established",
          "internet_ingress_firewalls": [],
          "direct_internet_reachable": false,
          "public_exposure_reasons": []
        }
      },
      {
        "address": "google_compute_network.main",
        "provider": "gcp",
        "resource_type": "google_compute_network",
        "name": "main",
        "category": "network",
        "identifier": "tfstride-main",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "name": "tfstride-main",
          "project": "tfstride-demo",
          "auto_create_subnetworks": false,
          "routing_mode": "REGIONAL",
          "description": null
        }
      },
      {
        "address": "google_compute_subnetwork.app",
        "provider": "gcp",
        "resource_type": "google_compute_subnetwork",
        "name": "app",
        "category": "network",
        "identifier": "tfstride-app",
        "arn": null,
        "vpc_id": "google_compute_network.main.id",
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "name": "tfstride-app",
          "project": "tfstride-demo",
          "region": "us-central1",
          "network": "google_compute_network.main.id",
          "cidr_range": "10.10.1.0/24",
          "private_ip_google_access": true,
          "purpose": null,
          "stack_type": null,
          "secondary_ip_ranges": [],
          "subnetwork_flow_log_state": "enabled",
          "subnetwork_flow_log_config": {
            "aggregation_interval": "INTERVAL_5_SEC",
            "flow_sampling": 1.0,
            "metadata": "INCLUDE_ALL_METADATA"
          },
          "subnetwork_flow_log_aggregation_interval": "INTERVAL_5_SEC",
          "subnetwork_flow_log_sampling": "1.0",
          "subnetwork_flow_log_metadata": "INCLUDE_ALL_METADATA",
          "subnetwork_flow_log_metadata_fields": [],
          "network_telemetry_posture_uncertainties": [],
          "has_public_route": false,
          "is_public_subnet": false,
          "has_nat_gateway_egress": false
        }
      },
      {
        "address": "google_kms_crypto_key.customer",
        "provider": "gcp",
        "resource_type": "google_kms_crypto_key",
        "name": "customer",
        "category": "data",
        "identifier": "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-customer-key",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "sensitive",
        "metadata": {
          "name": "tfstride-customer-key",
          "project": "tfstride-demo",
          "kms_crypto_key_reference": "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-customer-key",
          "kms_key_ring": "projects/tfstride-demo/locations/global/keyRings/tfstride-app",
          "kms_purpose": "ENCRYPT_DECRYPT",
          "kms_rotation_period": "7776000s",
          "kms_posture_uncertainties": [],
          "labels": {
            "app": "tfstride"
          },
          "import_only": false,
          "skip_initial_version_creation": false,
          "storage_encrypted": true,
          "kms_iam_grants": [],
          "kms_iam_posture_uncertainties": [],
          "kms_encryption_dependencies": [],
          "kms_encryption_dependency_uncertainties": []
        }
      },
      {
        "address": "google_secret_manager_secret.api_key",
        "provider": "gcp",
        "resource_type": "google_secret_manager_secret",
        "name": "api_key",
        "category": "data",
        "identifier": "projects/tfstride-demo/secrets/tfstride-api-key",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "sensitive",
        "metadata": {
          "name": "projects/tfstride-demo/secrets/tfstride-api-key",
          "secret_id": "tfstride-api-key",
          "project": "tfstride-demo",
          "labels": {
            "app": "tfstride"
          },
          "secret_manager_replication_mode": "automatic",
          "secret_manager_kms_key_names": [
            "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager"
          ],
          "secret_manager_replication": {
            "mode": "automatic",
            "kms_key_names": [
              "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager"
            ]
          },
          "secret_manager_posture_uncertainties": [],
          "secret_manager_ttl": "2592000s",
          "secret_manager_version_destroy_ttl": "604800s",
          "annotations": {},
          "topics": [],
          "customer_managed_encryption": true,
          "storage_encrypted": true,
          "secret_manager_iam_grants": [],
          "secret_manager_iam_posture_uncertainties": [],
          "kms_encryption_dependencies": [
            {
              "dependent_address": "google_secret_manager_secret.api_key",
              "dependent_resource_type": "google_secret_manager_secret",
              "dependency_source_address": "google_secret_manager_secret.api_key",
              "dependency_source_type": "google_secret_manager_secret",
              "configuration_path": [
                "replication",
                0,
                "auto",
                0,
                "customer_managed_encryption",
                0,
                "kms_key_name"
              ],
              "configured_key_reference": "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager",
              "reference_provenance": "planned_value",
              "reference_kind": "crypto_key_resource_name",
              "resolution_state": "unresolved",
              "customer_managed_encryption_state": "configured",
              "candidate_targets": [],
              "key_address": null,
              "key_resource_name": null,
              "key_project": null,
              "key_location": null,
              "key_ring": null,
              "key_purpose": null,
              "key_version_address": null,
              "key_version_resource_name": null,
              "version_reference_is_explicit": false,
              "posture_uncertainties": [
                "Cloud KMS reference projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager does not resolve to a modeled CryptoKey"
              ]
            }
          ],
          "kms_encryption_dependency_uncertainties": [
            "google_secret_manager_secret.api_key: Cloud KMS reference projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager does not resolve to a modeled CryptoKey"
          ]
        }
      },
      {
        "address": "google_service_account.web",
        "provider": "gcp",
        "resource_type": "google_service_account",
        "name": "web",
        "category": "iam",
        "identifier": "tfstride-web@example.iam.gserviceaccount.com",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "name": "projects/tfstride-demo/serviceAccounts/tfstride-web@example.iam.gserviceaccount.com",
          "project": "tfstride-demo",
          "service_account_account_id": "tfstride-web",
          "service_account_email": "tfstride-web@example.iam.gserviceaccount.com",
          "service_account_member": "serviceAccount:tfstride-web@example.iam.gserviceaccount.com",
          "service_account_unique_id": "100000000000000000001",
          "service_account_disabled": false,
          "display_name": "tfSTRIDE web workload",
          "description": "Service account used by the sample web workload."
        }
      },
      {
        "address": "google_service_networking_connection.private_services",
        "provider": "gcp",
        "resource_type": "google_service_networking_connection",
        "name": "private_services",
        "category": "network",
        "identifier": "servicenetworking-googleapis-com",
        "arn": null,
        "vpc_id": "google_compute_network.main.id",
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "name": "private_services",
          "network": "google_compute_network.main.id",
          "private_connectivity_service": "servicenetworking.googleapis.com",
          "private_connectivity_reserved_ranges": [
            "private-services-range"
          ],
          "private_connectivity_peering": "servicenetworking-googleapis-com",
          "deletion_policy": null,
          "private_connectivity_uncertainties": []
        }
      },
      {
        "address": "google_sql_database_instance.app",
        "provider": "gcp",
        "resource_type": "google_sql_database_instance",
        "name": "app",
        "category": "data",
        "identifier": "tfstride-app-db",
        "arn": null,
        "vpc_id": "google_compute_network.main.id",
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "sensitive",
        "metadata": {
          "name": "tfstride-app-db",
          "project": "tfstride-demo",
          "region": "us-central1",
          "database_version": "POSTGRES_15",
          "cloud_sql_private_network": "google_compute_network.main.id",
          "availability_type": "REGIONAL",
          "cloud_sql_query_insights_state": "not_configured",
          "cloud_sql_insights_config": {},
          "cloud_sql_deletion_protection_state": "unknown",
          "cloud_sql_posture_uncertainties": [],
          "cloud_sql_ipv4_enabled": false,
          "cloud_sql_backup_enabled": true,
          "cloud_sql_point_in_time_recovery_enabled": true,
          "cloud_sql_require_ssl": true,
          "cloud_sql_authorized_networks": [],
          "cloud_sql_backup_configuration": {
            "enabled": true,
            "point_in_time_recovery_enabled": true
          },
          "cloud_sql_ip_configuration": {
            "ipv4_enabled": false,
            "require_ssl": true,
            "authorized_networks": [],
            "private_network": "google_compute_network.main.id"
          },
          "deletion_protection": true,
          "labels": {},
          "tier": "db-f1-micro",
          "disk_type": "PD_SSD",
          "disk_size": 20,
          "public_access_reasons": [],
          "direct_internet_reachable": false,
          "internet_ingress_capable": false,
          "internet_ingress_reasons": [],
          "public_exposure_reasons": [],
          "publicly_accessible": false,
          "storage_encrypted": true
        }
      },
      {
        "address": "google_storage_bucket.logs",
        "provider": "gcp",
        "resource_type": "google_storage_bucket",
        "name": "logs",
        "category": "data",
        "identifier": "tfstride-logs",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "sensitive",
        "metadata": {
          "name": "tfstride-logs",
          "bucket": "tfstride-logs",
          "project": "tfstride-demo",
          "labels": {},
          "uniform_bucket_level_access": true,
          "public_access_prevention": "enforced",
          "gcs_versioning_enabled": true,
          "gcs_versioning_configuration": {
            "enabled": true
          },
          "gcs_versioning_uncertainties": [],
          "gcs_soft_delete_state": "not_observed",
          "gcs_soft_delete_policy_uncertainties": [],
          "gcs_default_kms_key_name": "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-gcs",
          "gcs_encryption_configuration": {
            "default_kms_key_name": "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-gcs"
          },
          "gcs_retention_period_seconds": 2592000,
          "gcs_retention_policy_locked": true,
          "gcs_retention_policy_configuration": {
            "retention_period": 2592000,
            "is_locked": true
          },
          "gcs_retention_policy_uncertainties": [],
          "location": "US",
          "storage_class": null,
          "force_destroy": false,
          "customer_managed_encryption": true,
          "storage_encrypted": true,
          "public_access_reasons": [],
          "direct_internet_reachable": false,
          "kms_encryption_dependencies": [
            {
              "dependent_address": "google_storage_bucket.logs",
              "dependent_resource_type": "google_storage_bucket",
              "dependency_source_address": "google_storage_bucket.logs",
              "dependency_source_type": "google_storage_bucket",
              "configuration_path": [
                "encryption",
                0,
                "default_kms_key_name"
              ],
              "configured_key_reference": "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-gcs",
              "reference_provenance": "planned_value",
              "reference_kind": "crypto_key_resource_name",
              "resolution_state": "unresolved",
              "customer_managed_encryption_state": "configured",
              "candidate_targets": [],
              "key_address": null,
              "key_resource_name": null,
              "key_project": null,
              "key_location": null,
              "key_ring": null,
              "key_purpose": null,
              "key_version_address": null,
              "key_version_resource_name": null,
              "version_reference_is_explicit": false,
              "posture_uncertainties": [
                "Cloud KMS reference projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-gcs does not resolve to a modeled CryptoKey"
              ]
            }
          ],
          "kms_encryption_dependency_uncertainties": [
            "google_storage_bucket.logs: Cloud KMS reference projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-gcs does not resolve to a modeled CryptoKey"
          ]
        }
      }
    ]
  },
  "trust_boundaries": [
    {
      "identifier": "workload-to-data-store:google_compute_instance.web->google_sql_database_instance.app",
      "boundary_type": "workload-to-data-store",
      "source": "google_compute_instance.web",
      "target": "google_sql_database_instance.app",
      "description": "google_compute_instance.web can interact with google_sql_database_instance.app.",
      "rationale": "Application or function workloads cross into a higher-sensitivity data plane when they share a VPC with the database and the plan does not provide tighter security-group evidence."
    }
  ],
  "findings": [],
  "suppressed_findings": [],
  "baselined_findings": [],
  "observations": [],
  "limitations": [
    "GCP support covers a curated set of compute, serverless, data, IAM, Kubernetes, networking, audit, private-connectivity, messaging, registry, and key-management resources. Analysis is plan-local and does not model every provider resource, runtime drift, or every organization-level control; provider-specific positive observations remain more limited than finding coverage.",
    "The engine reasons over Terraform planned values only and does not validate runtime drift, runtime audit evidence, or post-deployment control-plane activity."
  ]
}
Markdown report 
# Safe GCP Plan Demo

- Analyzed file: `sample_gcp_safe_plan.json`
- Provider: `gcp`
- Normalized resources: `9`
- Unsupported resources: `0`

## Summary

This run identified **1 trust boundary** and **0 findings** across **9 normalized resources**.

- High severity findings: `0`
- Medium severity findings: `0`
- Low severity findings: `0`

## Analysis Coverage

- Terraform resources seen: `9`
- Provider resources considered: `9`
- Normalized resources: `9`
- Unsupported resources: `0`
- Resources with plan-time unknown values: `0`
- Registered provider rules (GCP): `97`
- Enabled provider rules (GCP): `97`
- Disabled rules: `0`
- Severity overrides: `0`
- Configuration-reference resolution: `0 symbolic`, `0 ambiguous`, `0 unresolved`, `0 unsupported`
- Recorded unresolved modeled references: `0`

Sensitive resource labels are assumptions based on resource class. tfSTRIDE does not assess stored data contents from the plan.

## Discovered Trust Boundaries

### `workload-to-data-store`

- Source: `google_compute_instance.web`
- Target: `google_sql_database_instance.app`
- Description: google_compute_instance.web can interact with google_sql_database_instance.app.
- Rationale: Application or function workloads cross into a higher-sensitivity data plane when they share a VPC with the database and the plan does not provide tighter security-group evidence.

## Findings

### High

No findings in this severity band.

### Medium

No findings in this severity band.

### Low

No findings in this severity band.

## Limitations / Unsupported Resources

- GCP support covers a curated set of compute, serverless, data, IAM, Kubernetes, networking, audit, private-connectivity, messaging, registry, and key-management resources. Analysis is plan-local and does not model every provider resource, runtime drift, or every organization-level control; provider-specific positive observations remain more limited than finding coverage.
- The engine reasons over Terraform planned values only and does not validate runtime drift, runtime audit evidence, or post-deployment control-plane activity.

Limits

Unsupported or intentionally scoped areas

  • GCP support covers a curated set of compute, serverless, data, IAM, Kubernetes, networking, audit, private-connectivity, messaging, registry, and key-management resources. Analysis is plan-local and does not model every provider resource, runtime drift, or every organization-level control; provider-specific positive observations remain more limited than finding coverage.
  • The engine reasons over Terraform planned values only and does not validate runtime drift, runtime audit evidence, or post-deployment control-plane activity.