Repository navigation
feat(gcp): read-only access for every connection, metrics switch controls collection only - #1477
Open
JeremyFunk wants to merge 18 commits into
Open
JeremyFunk wants to merge 18 commits into
JeremyFunk wants to merge 18 commits into
Maple Review Bot / Maple / review
succeeded
Oct 15, 2026 in 5m 42s
Confidence 9/10 · No issues found
🟢 Confidence 9/10 · safe to merge
Every production hunk was read at the head; the script's per-section reporting and exit codes, the riskiest part, are pinned by its tests.
quality 100/100 · no findings · tests covered · risk medium · 1/2 new units observable
Read-only GCP access becomes part of every connection's setup whenever the deployment has a Google identity, and the metrics switch becomes a collection-only toggle, with a Terraform module alternative and an on-demand access check. Safe to merge.
- Setup script always creates the read-only service account;
metrics_enabledonly switches collection checkAccessv2 endpoint backs an on-demand check of Maple's read of the scope- Configure dialog gains the Terraform module view and a "Check access" step
applied_metrics_enablednow means the read-only account is in place
Before merge
- Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/logs.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/main.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/outputs.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/reader.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/variables.tf - Infra · Check every environment has what this config now expects ·
deploy/terraform-google-maple/versions.tf
Production impact
Telemetry this change adds and removes (1)
- ➕ span name
GcpPromQlService.checkAccess·packages/backend/src/services/integrations/GcpPromQlService.ts:622
What was checked
- A read-only failure with log forwarding on exits 0 and sends no
metricsreport (gcp/setup-scripts.ts) - Removing the read-only account is confined to the cleanup script; a re-run leaves it in place
- The Terraform module reuses
gcpLogFilterand the script's account names, so both methods match
Observability coverage: 1 of 2 changes observable
| Change | Kind | Observable | Evidence |
|---|---|---|---|
| POST /v2/integrations/gcp/{id}/checkAccess | server | yes | Traced like the other v2 integration routes in the same router, which carry no explicit span |
| Google Monitoring/Cloud Asset read in GcpPromQlService.checkAccess | client | no | Same fetch path as the existing metrics reader in the same file, which adds no Client span either |
dad42b1 · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.
Loading