chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity
feat/opax-web-bff-readonly
OSVauco/docs/handoffs/cloud-build-vpc-sc-blocker-2026-09-10.md

5.4 KiB
Raw Permalink Blame History

Handoff: Cloud Build blocked by organization policy / VPC Service Controls

Resume point

  • Handoff date: 2026-09-10
  • Branch at handoff: feat/opax-web-bff-readonly
  • HEAD at handoff: 5d74fb09f3f1725bb6bec8662d890c22dd038188
  • Earlier source-provenance commit: 5d74fb09f3f1725bb6bec8662d890c22dd038188
  • Working directory: CLEAN at the original Git-provenance check

This document records the deployment-investigation state. It does not authorize infrastructure changes, another build, or deployment.

Intended first image build

  • Build mechanism: Cloud Build from a local, approved source snapshot
  • Build context: opax-web/
  • Dockerfile: opax-web/Dockerfile
  • Project: propane-will-491900-m5
  • Artifact Registry location: us-central1
  • Repository: osvauco-repo
  • Image: opax-web
  • Intended immutable tag: 5d74fb09f3f1725bb6bec8662d890c22dd038188
  • Intended image reference: us-central1-docker.pkg.dev/propane-will-491900-m5/osvauco-repo/opax-web:5d74fb09f3f1725bb6bec8662d890c22dd038188

Verified facts

  • opax-web/Dockerfile was present as a regular file.
  • opax-web/.gcloudignore was absent.
  • opax-web/cloudbuild.yaml was absent.
  • opax-web/cloudbuild.yml was absent.
  • Effective Cloud Build default runtime service account: 357036551735-compute@developer.gserviceaccount.com
  • That runtime service account has direct roles/artifactregistry.writer on: us-central1/osvauco-repo
  • Active local gcloud caller observed during the investigation: chris.christiansen@vauco.no
  • This project-level IAM binding was successfully added: roles/serviceusage.serviceUsageConsumer for user:chris.christiansen@vauco.no on project propane-will-491900-m5.

Build blocker

Two attempts to submit local source using gcloud builds submit failed before a Cloud Build started.

Affected Cloud Build source bucket:

gs://propane-will-491900-m5_cloudbuild

Observed failure category:

PERMISSION_DENIED

Observed error included:

The user is forbidden from accessing the bucket [propane-will-491900-m5_cloudbuild]

Adding roles/serviceusage.serviceUsageConsumer did not resolve the failure.

A bucket-level IAM remediation was attempted but was not applied:

  • Intended principal: user:chris.christiansen@vauco.no
  • Intended resource: gs://propane-will-491900-m5_cloudbuild
  • Intended role: roles/storage.objectCreator

The attempted bucket IAM change was denied with:

Request is prohibited by organization's policy

The response contained a VPC Service Controls diagnostic correlation ID:

hSyd2GQvlMqQGdZ0HXTW5fNlD0n0U48CHziavzv6HhoKYEI_8vWYFM2YtMCsz6QbhjOiyDowZRU7gJ-3

Current conclusion

The immediate blocker is organization-level policy enforcement, likely VPC Service Controls, affecting the active caller's access to the Cloud Build-managed source bucket.

No successful Cloud Build has been confirmed. No image push has been confirmed. No Cloud Run deployment has been performed.

Instructions for the next browser-enabled agent

  1. Use Google Cloud Console with approved browser-based organizational access. Start read-only.

  2. Identify the VPC Service Controls service perimeter, ingress policy, egress policy, access level, IAM Condition, or related organization policy that blocks:

    • Active caller: chris.christiansen@vauco.no
    • Source bucket: gs://propane-will-491900-m5_cloudbuild
    • Project: propane-will-491900-m5

  3. Use this only as diagnostic correlation information: hSyd2GQvlMqQGdZ0HXTW5fNlD0n0U48CHziavzv6HhoKYEI_8vWYFM2YtMCsz6QbhjOiyDowZRU7gJ-3

  4. Inspect the applicable perimeter, ingress/egress rules, access levels, and any available perimeter-violation or dry-run evidence. Identify the exact blocking rule before proposing a change.

  5. Propose the smallest specific correction. Do not:

    • Disable VPC Service Controls.
    • Create a broad perimeter exception.
    • Broaden organization policy unnecessarily.
    • Grant broad IAM roles as a substitute for identifying the policy block.
    • Change the Cloud Build runtime service account's Artifact Registry writer role.
    • Deploy to Cloud Run.

  6. Before any VPC Service Controls, Access Context Manager, IAM, source-upload, build, image, or deployment change:

    • Present the exact action.
    • Explain scope, expected effect, risk, and rollback.
    • Obtain separate explicit approval.

  7. After an approved policy correction:

    • Re-check the current branch, full HEAD SHA, and clean working-tree status.
    • Confirm the build context remains opax-web/.
    • Reuse image tag 5d74fb09f3f1725bb6bec8662d890c22dd038188 only if current HEAD is exactly 5d74fb09f3f1725bb6bec8662d890c22dd038188.
    • If HEAD differs, stop and make a new provenance/tag decision.
    • Submit at most one explicitly approved Cloud Build.
    • Do not retry automatically.

  8. After a successful Cloud Build:

    • Do not deploy automatically.
    • Retrieve the pushed image digest through a separate read-only gate.
    • Use the image digest, not only the tag, in any later Cloud Run deployment proposal.
    • Require a separate explicit Cloud Run deploy gate.

Git closeout

This file is intended to be the only local change made during closeout.

Before staging or committing:

  • Verify that this exact file is the only intended change.
  • Present the exact Git commands and commit message for approval.
  • Commit only after separate approval.
  • Report the resulting commit SHA.
  • Do not push until the exact commit SHA and push target have been separately approved.