Skip to content

IAM Policy Non-Compliance Detected #39869

Description

@github-actions

Compliance Audit Report (2026-08-24 09:18:40 UTC)

IAM policy for project apache-beam-testing is not compliant with the defined policies on ../iam/users.yml

Permissions for user abdelrahman.ibrahim@akvelon.us differ.
In GCP: [{'role': 'roles/artifactregistry.admin'}, {'role': 'roles/bigquery.admin'}, {'role': 'roles/cloudaicompanion.codeToolsAdmin'}, {'role': 'roles/container.admin'}, {'role': 'roles/editor'}, {'role': 'roles/iam.serviceAccountUser'}, {'role': 'roles/secretmanager.admin'}, {'role': 'roles/storage.objectAdmin'}, {'role': 'roles/storage.objectCreator'}]
In ../iam/users.yml: [{'role': 'roles/artifactregistry.admin'}, {'role': 'roles/bigquery.admin'}, {'role': 'roles/container.admin'}, {'role': 'roles/editor'}, {'role': 'roles/iam.serviceAccountUser'}, {'role': 'roles/secretmanager.admin'}, {'role': 'roles/storage.objectAdmin'}, {'role': 'roles/storage.objectCreator'}]

Permissions for user andrey.devyatkin@akvelon.com differ.
In GCP: [{'role': 'roles/cloudsql.instanceUser'}, {'role': 'roles/dataflow.admin'}, {'role': 'roles/iam.serviceAccountAdmin'}, {'role': 'roles/storage.admin'}, {'role': 'roles/viewer'}]
In ../iam/users.yml: [{'role': 'roles/cloudsql.instanceUser'}, {'role': 'roles/dataflow.admin'}, {'role': 'roles/iam.serviceAccountAdmin'}, {'role': 'roles/owner'}, {'role': 'roles/storage.admin'}]

Permissions for user beam-github-actions@apache-beam-testing.iam.gserviceaccount.com differ.
In GCP: [{'role': 'roles/artifactregistry.createOnPushWriter'}, {'role': 'roles/artifactregistry.reader'}, {'role': 'roles/artifactregistry.writer'}, {'role': 'roles/autoscaling.metricsWriter'}, {'role': 'roles/bigquery.dataEditor'}, {'role': 'roles/bigtable.admin'}, {'role': 'roles/cloudfunctions.invoker'}, {'role': 'roles/cloudkms.admin'}, {'role': 'roles/cloudkms.cryptoKeyEncrypterDecrypter'}, {'role': 'roles/cloudkms.orgServiceAgent'}, {'role': 'roles/cloudkms.serviceAgent'}, {'role': 'roles/compute.viewer'}, {'role': 'roles/container.serviceAgent'}, {'role': 'roles/dataflow.admin'}, {'role': 'roles/dataflow.developer'}, {'role': 'roles/dataproc.editor'}, {'role': 'roles/editor'}, {'role': 'roles/healthcare.fhirResourceEditor'}, {'role': 'roles/healthcare.fhirStoreAdmin'}, {'role': 'roles/iam.roleAdmin'}, {'role': 'roles/iam.serviceAccountTokenCreator'}, {'role': 'roles/iam.serviceAccountUser'}, {'role': 'roles/logging.logWriter'}, {'role': 'roles/managedkafka.admin'}, {'role': 'roles/managedkafka.client'}, {'role': 'roles/managedkafka.schemaRegistryEditor'}, {'role': 'roles/monitoring.metricWriter'}, {'role': 'roles/monitoring.viewer'}, {'role': 'roles/resourcemanager.projectIamAdmin'}, {'role': 'roles/secretmanager.admin'}, {'role': 'roles/spanner.databaseAdmin'}, {'role': 'roles/stackdriver.resourceMetadata.writer'}, {'role': 'roles/storage.admin'}]
In ../iam/users.yml: [{'role': 'roles/artifactregistry.createOnPushWriter'}, {'role': 'roles/artifactregistry.reader'}, {'role': 'roles/artifactregistry.writer'}, {'role': 'roles/autoscaling.metricsWriter'}, {'role': 'roles/bigquery.dataEditor'}, {'role': 'roles/bigtable.admin'}, {'role': 'roles/cloudfunctions.invoker'}, {'role': 'roles/compute.viewer'}, {'role': 'roles/container.serviceAgent'}, {'role': 'roles/dataflow.admin'}, {'role': 'roles/dataflow.developer'}, {'role': 'roles/dataproc.editor'}, {'role': 'roles/editor'}, {'role': 'roles/healthcare.fhirResourceEditor'}, {'role': 'roles/healthcare.fhirStoreAdmin'}, {'role': 'roles/iam.roleAdmin'}, {'role': 'roles/iam.serviceAccountTokenCreator'}, {'role': 'roles/iam.serviceAccountUser'}, {'role': 'roles/logging.logWriter'}, {'role': 'roles/managedkafka.admin'}, {'role': 'roles/managedkafka.client'}, {'role': 'roles/managedkafka.schemaRegistryEditor'}, {'role': 'roles/monitoring.metricWriter'}, {'role': 'roles/monitoring.viewer'}, {'role': 'roles/resourcemanager.projectIamAdmin'}, {'role': 'roles/secretmanager.admin'}, {'role': 'roles/spanner.databaseAdmin'}, {'role': 'roles/stackdriver.resourceMetadata.writer'}, {'role': 'roles/storage.admin'}]

Permissions for user beam-wheels-github@apache-beam-testing.iam.gserviceaccount.com differ.
In GCP: [{'role': 'roles/aiplatform.user'}, {'role': 'roles/artifactregistry.admin'}, {'role': 'roles/artifactregistry.createOnPushWriter'}, {'role': 'roles/bigquery.admin'}, {'role': 'roles/bigquery.dataEditor'}, {'role': 'roles/bigtable.admin'}, {'role': 'roles/bigtable.user'}, {'role': 'roles/cloudkms.admin'}, {'role': 'roles/cloudkms.autokeyAdmin'}, {'role': 'roles/cloudkms.cryptoKeyDecrypter'}, {'role': 'roles/cloudkms.cryptoKeyEncrypter'}, {'role': 'roles/cloudkms.cryptoOperator'}, {'role': 'roles/container.admin'}, {'role': 'roles/dataflow.admin'}, {'role': 'roles/healthcare.fhirResourceEditor'}, {'role': 'roles/healthcare.fhirStoreAdmin'}, {'role': 'roles/iam.serviceAccountTokenCreator'}, {'role': 'roles/iam.serviceAccountUser'}, {'role': 'roles/pubsub.admin'}, {'role': 'roles/secretmanager.admin'}, {'role': 'roles/spanner.admin'}, {'role': 'roles/storage.admin'}, {'role': 'roles/storage.folderAdmin'}, {'role': 'roles/viewer'}]
In ../iam/users.yml: [{'role': 'roles/aiplatform.user'}, {'role': 'roles/artifactregistry.admin'}, {'role': 'roles/artifactregistry.createOnPushWriter'}, {'role': 'roles/bigquery.admin'}, {'role': 'roles/bigquery.dataEditor'}, {'role': 'roles/bigtable.admin'}, {'role': 'roles/bigtable.user'}, {'role': 'roles/container.admin'}, {'role': 'roles/dataflow.admin'}, {'role': 'roles/healthcare.fhirResourceEditor'}, {'role': 'roles/healthcare.fhirStoreAdmin'}, {'role': 'roles/iam.serviceAccountTokenCreator'}, {'role': 'roles/iam.serviceAccountUser'}, {'role': 'roles/pubsub.admin'}, {'role': 'roles/secretmanager.admin'}, {'role': 'roles/spanner.admin'}, {'role': 'roles/storage.admin'}, {'role': 'roles/storage.folderAdmin'}, {'role': 'roles/viewer'}]

Permissions for user cloud-data-workflow-dev@prod.google.com differ.
In GCP: [{'role': 'roles/compute.instanceAdmin.v1'}, {'role': 'roles/compute.networkViewer'}, {'role': 'roles/meshconfig.admin'}, {'role': 'roles/saasservicemgmt.admin'}, {'role': 'roles/storage.objectAdmin'}, {'role': 'roles/trafficdirector.client'}]
In ../iam/users.yml: [{'role': 'roles/compute.instanceAdmin.v1'}, {'role': 'roles/compute.networkViewer'}, {'role': 'roles/meshconfig.admin'}, {'role': 'roles/storage.objectAdmin'}, {'role': 'roles/trafficdirector.client'}]

Permissions for user dannymccormick@google.com differ.
In GCP: [{'role': 'roles/artifactregistry.admin'}, {'role': 'roles/artifactregistry.containerRegistryMigrationAdmin'}, {'role': 'roles/artifactregistry.createOnPushRepoAdmin'}, {'role': 'roles/artifactregistry.repoAdmin'}, {'role': 'roles/bigquery.dataOwner'}, {'role': 'roles/container.admin'}, {'role': 'roles/iam.serviceAccountUser'}, {'role': 'roles/owner'}, {'role': 'roles/resourcemanager.projectIamAdmin'}]
In ../iam/users.yml: [{'role': 'roles/bigquery.dataOwner'}, {'role': 'roles/container.admin'}, {'role': 'roles/iam.serviceAccountUser'}, {'role': 'roles/owner'}, {'role': 'roles/resourcemanager.projectIamAdmin'}]

Permissions for user hansmarcus14@gmail.com differ.
In GCP: [{'role': 'projects/apache-beam-testing/roles/beam_infra_manager'}, {'role': 'roles/serviceusage.apiKeysViewer'}, {'role': 'roles/viewer'}]
In ../iam/users.yml: [{'role': 'projects/apache-beam-testing/roles/beam_infra_manager'}]

Permissions for user k.loyola.gutierrez@akvelon.com differ.
In GCP: [{'role': 'roles/container.admin'}, {'role': 'roles/editor'}, {'role': 'roles/viewer'}]
In ../iam/users.yml: [{'role': 'roles/container.admin'}, {'role': 'roles/editor'}]

Permissions for user rezarokni@google.com differ.
In GCP: [{'role': 'roles/alloydb.admin'}, {'role': 'roles/bigquery.admin'}, {'role': 'roles/compute.networkAdmin'}, {'role': 'roles/dataflow.admin'}, {'role': 'roles/editor'}, {'role': 'roles/pubsub.admin'}, {'role': 'roles/storage.objectAdmin'}]
In ../iam/users.yml: [{'role': 'roles/bigquery.admin'}, {'role': 'roles/dataflow.admin'}, {'role': 'roles/pubsub.admin'}, {'role': 'roles/storage.objectAdmin'}]

Permissions for user sergey.makarkin@akvelon.com differ.
In GCP: [{'role': 'roles/editor'}, {'role': 'roles/iam.workloadIdentityPoolAdmin'}, {'role': 'roles/secretmanager.admin'}, {'role': 'roles/viewer'}]
In ../iam/users.yml: [{'role': 'roles/editor'}, {'role': 'roles/iam.workloadIdentityPoolAdmin'}, {'role': 'roles/secretmanager.admin'}]

Permissions for user tannapareddy@google.com differ.
In GCP: [{'role': 'organizations/433637338589/roles/GcsBucketOwner'}, {'role': 'roles/alloydb.admin'}, {'role': 'roles/artifactregistry.admin'}, {'role': 'roles/biglake.admin'}, {'role': 'roles/bigquery.admin'}, {'role': 'roles/dataproc.admin'}, {'role': 'roles/editor'}, {'role': 'roles/iam.securityAdmin'}, {'role': 'roles/owner'}, {'role': 'roles/pubsub.admin'}, {'role': 'roles/run.admin'}, {'role': 'roles/storage.admin'}]
In ../iam/users.yml: [{'role': 'organizations/433637338589/roles/GcsBucketOwner'}, {'role': 'roles/alloydb.admin'}, {'role': 'roles/artifactregistry.admin'}, {'role': 'roles/biglake.admin'}, {'role': 'roles/bigquery.admin'}, {'role': 'roles/dataproc.admin'}, {'role': 'roles/editor'}, {'role': 'roles/owner'}, {'role': 'roles/pubsub.admin'}, {'role': 'roles/storage.admin'}]

Permissions for user tarun-926@apache-beam-testing.iam.gserviceaccount.com differ.
In GCP: [{'role': 'roles/alloydb.admin'}, {'role': 'roles/artifactregistry.admin'}, {'role': 'roles/artifactregistry.writer'}, {'role': 'roles/biglake.admin'}, {'role': 'roles/bigquery.admin'}, {'role': 'roles/compute.admin'}, {'role': 'roles/config.admin'}, {'role': 'roles/config.agent'}, {'role': 'roles/dataflow.worker'}, {'role': 'roles/iam.serviceAccountAdmin'}, {'role': 'roles/iam.serviceAccountTokenCreator'}, {'role': 'roles/iam.serviceAccountUser'}, {'role': 'roles/logging.logWriter'}, {'role': 'roles/monitoring.metricWriter'}, {'role': 'roles/owner'}, {'role': 'roles/pubsub.admin'}, {'role': 'roles/pubsub.subscriber'}, {'role': 'roles/resourcemanager.projectIamAdmin'}, {'role': 'roles/run.admin'}, {'role': 'roles/storage.admin'}, {'role': 'roles/tpu.admin'}]
In ../iam/users.yml: [{'role': 'roles/alloydb.admin'}, {'role': 'roles/artifactregistry.admin'}, {'role': 'roles/biglake.admin'}, {'role': 'roles/bigquery.admin'}, {'role': 'roles/dataflow.worker'}, {'role': 'roles/iam.serviceAccountAdmin'}, {'role': 'roles/logging.logWriter'}, {'role': 'roles/monitoring.metricWriter'}, {'role': 'roles/pubsub.admin'}, {'role': 'roles/pubsub.subscriber'}, {'role': 'roles/resourcemanager.projectIamAdmin'}, {'role': 'roles/storage.admin'}, {'role': 'roles/tpu.admin'}]

Permissions for user vitaly.terentyev.akv@gmail.com differ.
In GCP: [{'role': 'roles/cloudaicompanion.codeToolsAdmin'}, {'role': 'roles/container.admin'}, {'role': 'roles/editor'}, {'role': 'roles/iam.serviceAccountAdmin'}, {'role': 'roles/iam.workloadIdentityPoolAdmin'}, {'role': 'roles/secretmanager.secretAccessor'}]
In ../iam/users.yml: [{'role': 'roles/container.admin'}, {'role': 'roles/editor'}, {'role': 'roles/iam.serviceAccountAdmin'}, {'role': 'roles/iam.workloadIdentityPoolAdmin'}, {'role': 'roles/secretmanager.secretAccessor'}]

Permissions for user vladislav.chunikhin@akvelon.com differ.
In GCP: [{'role': 'roles/editor'}, {'role': 'roles/viewer'}]
In ../iam/users.yml: [{'role': 'roles/editor'}]

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions