google / google/stellar-engine

[Bug] Fix Custom KMS Organizational Policy

Open
#57 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
HCL
Stars
49
Forks
20
Avg merge
3d 14h
Merged PRs (30d)
28

Description

## Bug Description
A custom KMS organization policy bug prevents Terraform from deleting encryption keys.

## Environment and Deployment Context
Please provide details about your deployment to help us reproduce the issue.

* **Stellar Engine Version/Commit:** `main`
* **Deployment Type:**
* [ ] US Region Restricted (e.g., Access Policy constraint)
* [ ] FedRAMP Medium
* [ ] FedRAMP High
* [ ] DoD IL4
* [ ] DoD IL5
* [x] All / General
* **FAST Stage (if applicable):**
* [ ] Stage 0 (Bootstrap)
* [ ] Stage 1 (Resource Management)
* [ ] Stage 2 (Network Creation)
* [x] Stage 3 (Security and Audit)
* **Affected Component:** Custom KMS Org Policy configurations.
* **Terraform Version:** 1.5.7
* **GCP Provider Version:** 5.10.0

## Steps to Reproduce
Steps to reproduce the behavior:
1. Deploy KMS keys under the current custom KMS organization policy.
2. Attempt to destroy or delete the keys via Terraform.
3. See error related to violating constraints on unsetting rotation periods.

## Expected Behavior
Terraform should be able to cleanly delete or manage the lifecycle of KMS keys without Org Policy conflicts.

## Actual Behavior
The custom KMS organization policy prevents key deletion, blocking automated teardowns and updates.

## Relevant Logs and Errors
N/A

## Additional Context
The proposed fix is to modify the custom KMS organization policy or find a workaround to bypass the rotation period constraint during deletion.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.