검사 논리를 테스트할 때 오류가 발생해야 하지만 제약조건으로 오류가 발생하지 않는 경우에는 다음 중 하나 이상의 결과 때문일 수 있습니다.
정책 라이브러리가 올바르게 설정되었나요? 정책 라이브러리에 policies/constraints 디렉터리가 있는지 확인합니다. 여기에는 위반을 일으키려는 제약조건이 포함됩니다.
위반을 포함하는 Terraform 리소스가 지원되는 리소스인가요?gcloud beta terraform vet은 해당 버전에서 지원되는 리소스에 대해서만 위반 사항을 확인할 수 있습니다. --verbosity=debug로 명령어를 다시 실행하고 unsupported resource:
google_resource_name과 같은 메시지가 표시되는지 확인합니다. 또는 리소스가 지원되는 리소스 목록에 있는지 확인해도 됩니다.
제약조건이 올바른 Terraform 리소스를 대상으로 하나요?
제약조건의 kind 필드를 확인합니다. GCPAppengineLocationConstraintV1과 같이 표시되어야 합니다.
policies/templates 디렉터리에서 spec.crd.spec.names.kind에 대해 동일한 값을 갖는 정책을 검색합니다.
rego 필드에서 asset.asset_type ==
"appengine.googleapis.com/Application"과 비슷한 항목을 찾습니다. 이것은 제약조건의 대상이 되는 CAI 애셋 유형입니다.
리소스 상위 항목은 정확한 CAI 애셋 이름을 빌드하기 위해 사용됩니다. gcloud beta terraform vet이 CAI 애셋의 상위 항목을 자동으로 확인할 수 없는 경우 project: required field is not set이라는 오류를 반환합니다. --project 플래그를 사용하여 기본 프로젝트를 제공하거나 gcloud config를 사용해서 프로젝트를 설정할 수 있습니다.
getting resource ancestry for project PROJECT_ID: googleapi: Error 403: The caller does not have permission, forbidden 오류가 표시되는 이유는 무엇인가요?
--verbosity=debug와 함께 명령어를 실행하고 Terraform
is using this identity:와 같은 메시지를 찾습니다. 그 뒤에 API 요청에 사용되는 계정인 이메일 주소가 와야 합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003ePre-General Availability (Pre-GA) products and features are governed by the "Pre-GA Offerings Terms" in the General Service Terms.\u003c/p\u003e\n"],["\u003cp\u003ePre-GA offerings are provided "as is" with potentially limited support, as detailed in the launch stage descriptions.\u003c/p\u003e\n"],["\u003cp\u003eConstraint violations may not trigger errors if the policy library is incorrectly set up, the resource is unsupported, or the constraint targets the wrong resource type.\u003c/p\u003e\n"],["\u003cp\u003eThe error "project: required field is not set" indicates that the tool cannot determine the CAI Asset's ancestry and requires a project to be specified.\u003c/p\u003e\n"],["\u003cp\u003eA "permission denied" error when getting resource ancestry suggests an authentication issue or insufficient permissions for the specified identity.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot gcloud beta terraform vet\n\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nWhy is a violation I expected not throwing an error?\n----------------------------------------------------\n\nIf you test your validation logic and find that the constraint isn't throwing an\nerror when it should be, this might be a result of one or more of the following:\n\n- **Is your policy-library set up correctly?** Verify that your policy library contains a `policies/constraints` directory, which contains the constraint you are expecting to cause a violation.\n- **Is the Terraform resource that contains the violation a supported\n resource?** `gcloud beta terraform vet` can only check for violations for resources that are supported in its version. Re-run your command with `--verbosity=debug` and look for a message like: `unsupported resource:\n google_resource_name`. Or you can check whether your resource is in the list of [supported resources](/docs/cloud-asset-inventory/overview#supported_resource_types).\n- **Is your constraint targeting the correct Terraform resource?**\n\n 1. Check the `kind` field of the constraint. It should be something like: `GCPAppengineLocationConstraintV1`\n 2. Search the `policies/templates` directory for a policy that has the same value for `spec.crd.spec.names.kind`\n 3. In the `rego` field, look for something like: `asset.asset_type ==\n \"appengine.googleapis.com/Application\"`. This is the [CAI Asset Type](/asset-inventory/docs/supported-asset-types) that the constraint targets.\n 4. Make sure that the CAI Asset Type is in the list of [supported resources](/docs/cloud-asset-inventory/overview#supported_resource_types).\n\nWhy am I getting an error saying that no project is defined?\n------------------------------------------------------------\n\nResource Ancestry is used to build an accurate CAI Asset Name. If\n`gcloud beta terraform vet` can't automatically determine the ancestry for a CAI Asset,\nit will return an error saying: `project: required field is not set`. You can\nprovide a default project with the `--project` flag or by setting one using\n[`gcloud config`](/sdk/gcloud/reference/config).\n\nWhy am I getting an error saying `getting resource ancestry for project PROJECT_ID: googleapi: Error 403: The caller does not have permission, forbidden`?\n----------------------------------------------------------------------------------------------------------------------------------------------------------\n\nRun the command with `--verbosity=debug` and look for a message like `Terraform\nis using this identity:`. It should be followed by an email address, which is\nthe account being used for API requests.\n\n- If there is no email address, then [make sure that your authentication is working properly](/sdk/gcloud/reference/auth).\n- If there is an email address, but it's not the service account that you wanted to impersonate, then [make sure that your service account impersonation is set up correctly](/sdk/gcloud/reference#--impersonate-service-account)\n- If the correct email address is showing, make sure that it has the following permissions on the project:\n - `getIamPolicy`\n - `resourcemanager.projects.get`"]]
