Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
¿Por qué la infracción que esperaba no arrojará un error?
Si pruebas la lógica de validación y descubres que la restricción no muestra un error cuando debería ser, esta puede ser el resultado de una o más de las siguientes opciones:
¿Tu biblioteca de políticas está configurada correctamente? Verifica que tu biblioteca de políticas contenga un directorio policies/constraints, que contiene la restricción que esperas que cause una infracción.
¿Es el recurso de Terraform que contiene el incumplimiento un recurso compatible?gcloud beta terraform vet solo puede verificar los incumplimientos de los recursos que son compatibles con su versión. Vuelve a ejecutar tu comando con --verbosity=debug y busca un mensaje como: unsupported resource:
google_resource_name. También puedes verificar si tu recurso está en la lista de recursos compatibles.
¿Tu restricción se orienta al recurso de Terraform correcto?
Comprueba el campo kind de la restricción. Debería ser similar a lo siguiente: GCPAppengineLocationConstraintV1
Busca en el directorio policies/templates una política que tenga el mismo valor para spec.crd.spec.names.kind.
En el campo rego, busca algo como: asset.asset_type ==
"appengine.googleapis.com/Application". Este es el Tipo de recurso de CAI al que se orienta la restricción.
Asegúrate de que el tipo de recurso de CAI esté en la lista de recursos compatibles.
¿Por qué recibo un mensaje de error que indica que no se definió ningún proyecto?
El principal de los recursos se usa para compilar un nombre de recurso de CAI preciso. Si gcloud beta terraform vet no puede determinar automáticamente la ascendencia de un activo de CAI, se mostrará un error que indica: project: required field is not set. Puedes proporcionar un proyecto predeterminado con la marca --project o configurar uno mediante gcloud config.
¿Por qué recibo un error que dice getting resource ancestry for project PROJECT_ID: googleapi: Error 403: The caller does not have permission, forbidden?
Ejecuta el comando con --verbosity=debug y busca un mensaje como Terraform
is using this identity:. Debe estar seguido de una dirección de correo electrónico, que es la cuenta que se usa para las solicitudes a la API.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[[["\u003cp\u003ePre-General Availability (Pre-GA) products and features are governed by the "Pre-GA Offerings Terms" in the General Service Terms.\u003c/p\u003e\n"],["\u003cp\u003ePre-GA offerings are provided "as is" with potentially limited support, as detailed in the launch stage descriptions.\u003c/p\u003e\n"],["\u003cp\u003eConstraint violations may not trigger errors if the policy library is incorrectly set up, the resource is unsupported, or the constraint targets the wrong resource type.\u003c/p\u003e\n"],["\u003cp\u003eThe error "project: required field is not set" indicates that the tool cannot determine the CAI Asset's ancestry and requires a project to be specified.\u003c/p\u003e\n"],["\u003cp\u003eA "permission denied" error when getting resource ancestry suggests an authentication issue or insufficient permissions for the specified identity.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot gcloud beta terraform vet\n\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nWhy is a violation I expected not throwing an error?\n----------------------------------------------------\n\nIf you test your validation logic and find that the constraint isn't throwing an\nerror when it should be, this might be a result of one or more of the following:\n\n- **Is your policy-library set up correctly?** Verify that your policy library contains a `policies/constraints` directory, which contains the constraint you are expecting to cause a violation.\n- **Is the Terraform resource that contains the violation a supported\n resource?** `gcloud beta terraform vet` can only check for violations for resources that are supported in its version. Re-run your command with `--verbosity=debug` and look for a message like: `unsupported resource:\n google_resource_name`. Or you can check whether your resource is in the list of [supported resources](/docs/cloud-asset-inventory/overview#supported_resource_types).\n- **Is your constraint targeting the correct Terraform resource?**\n\n 1. Check the `kind` field of the constraint. It should be something like: `GCPAppengineLocationConstraintV1`\n 2. Search the `policies/templates` directory for a policy that has the same value for `spec.crd.spec.names.kind`\n 3. In the `rego` field, look for something like: `asset.asset_type ==\n \"appengine.googleapis.com/Application\"`. This is the [CAI Asset Type](/asset-inventory/docs/supported-asset-types) that the constraint targets.\n 4. Make sure that the CAI Asset Type is in the list of [supported resources](/docs/cloud-asset-inventory/overview#supported_resource_types).\n\nWhy am I getting an error saying that no project is defined?\n------------------------------------------------------------\n\nResource Ancestry is used to build an accurate CAI Asset Name. If\n`gcloud beta terraform vet` can't automatically determine the ancestry for a CAI Asset,\nit will return an error saying: `project: required field is not set`. You can\nprovide a default project with the `--project` flag or by setting one using\n[`gcloud config`](/sdk/gcloud/reference/config).\n\nWhy am I getting an error saying `getting resource ancestry for project PROJECT_ID: googleapi: Error 403: The caller does not have permission, forbidden`?\n----------------------------------------------------------------------------------------------------------------------------------------------------------\n\nRun the command with `--verbosity=debug` and look for a message like `Terraform\nis using this identity:`. It should be followed by an email address, which is\nthe account being used for API requests.\n\n- If there is no email address, then [make sure that your authentication is working properly](/sdk/gcloud/reference/auth).\n- If there is an email address, but it's not the service account that you wanted to impersonate, then [make sure that your service account impersonation is set up correctly](/sdk/gcloud/reference#--impersonate-service-account)\n- If the correct email address is showing, make sure that it has the following permissions on the project:\n - `getIamPolicy`\n - `resourcemanager.projects.get`"]]
