Review the project baseline
Rules evaluate project labels, folder placement, billing, and APIs without modifying the upstream Terraform modules.
Inspect the sourceINFRASTRUCTURE POLICY COMPANION
Review the plan.
Then decide what changes.
Evaluate Google Cloud Foundation Toolkit Terraform plans against YAML controls. Produce a decision and evidence bundle that your CI workflow can inspect before an apply step.
For platform engineers evaluating Google Cloud infrastructure changes.
Illustrative evaluation structure
An evidence trail for the plan.
- Input
- Terraform plan JSON
- Controls
- YAML policy rules
- Decision
- allow / deny
- Evidence
- plan hash + control results
WHERE IT FITS
A clear place in your stack.
Use this to attach configurable plan checks to a CI pipeline. Your pipeline must enforce the result before a deployment can proceed.
- 01
Export the plan
Supply Terraform plan JSON for the proposed Google Cloud change.
- 02
Evaluate controls
Run the configured YAML rules over the plan’s resource changes.
- 03
Use the result in CI
Inspect the JSONL evidence and denial exit code before your apply job.
Controls organized around infrastructure decisions.
- PROJECTS
- Labels, folders, billing, and required APIs.
- IDENTITY
- IAM role and service-account key checks.
- NETWORK
- Public SSH/RDP exposure and logging checks.
- GKE
- Private nodes and configured cluster baselines.
INSIDE THE PRODUCT
Capabilities you can inspect.
Follow each behavior to its implementation or maintained documentation.
Check network and identity changes
Implemented controls cover selected IAM roles, service-account keys, exposed SSH/RDP, firewall logging, and subnet flow logs.
Inspect the sourceInspect configured GKE controls
The pack checks private nodes, Workload Identity, Shielded Nodes, and release-channel settings represented in the plan.
Inspect the sourceKeep a concrete evaluation artifact
JSONL output contains the plan hash, supplied actor and role, control results, timestamp, and Merkle root. The CLI exits with code 2 on denial.
Inspect the sourceLOCAL EVALUATION
Evaluate a fixture before a real change.
From acgs-cft-governance-pack/ in the pinned monorepo checkout. The example evaluates a local allowed-plan fixture; it does not call terraform apply.
Prepare the companion pack
Use Python 3.10+ and install the source package with its test dependencies.
Evaluate the provided plan
Run the fixture against the bundled policies and choose a local output path.
Connect your CI decision
Review the example workflow and implement the apply dependency in your own pipeline. Configure Google Cloud policy validation separately.
Companion directory · shell
python -m pip install -e ".[test]"
python -m acgs_cft_governance_pack evaluate \
--plan examples/project-factory/terraform-plan.allowed.json \
--policy-dir policies \
--actor platform-ci --role validator \
--out evidence/local-project-factory.jsonlThe output is a local evidence file. The supplied actor and role are metadata, not authenticated identities.
Copy the example or select the code manually.
DESIGN AROUND THE BOUNDARY
Know the scope.
The integration and operating conditions are part of the product decision.
Does the included workflow deploy infrastructure?
No. The supplied GitHub Actions YAML is an attachment example and does not run terraform apply. Its gcloud terraform vet step prints setup guidance; configure that integration yourself.
Is this complete Google Cloud policy coverage?
It covers the implemented rule kinds and the data present in the Terraform plan. It complements Google Cloud policy validation and needs controls appropriate to your environment.
Is the evidence store immutable?
No. The writer creates a JSONL file at the chosen path. Retention, access control, external anchoring, and CI identity assurance are responsibilities of the integrating system.
Does a passing evaluation establish compliance?
It records the outcome of configured checks on a plan. It does not establish deployed state, regulatory compliance, or independent assurance.
SOURCE, RELEASE, AND CHECKS
Evidence with a reference.
An early companion pack in the ACGS monorepo. This audit verified source and example workflows, not a managed service or independently published package.
INSPECTED SOURCEacgs-cft-governance-pack 0.1.081de59eabacd
Reviewed 2026-09-08. Source version and published release are tracked separately.
CI SNAPSHOT · 2026-09-08No exact-head CFT run observed
The repository contains CFT tests and a path-filtered workflow. No CFT run appeared in the 12 workflow runs returned for the inspected monorepo head. No package tests were rerun for this review.
Read the workflow evidenceFROM READING TO EVALUATION
Start with the source.
Follow one example. Inspect the result. Decide whether it fits your workflow.