🧹 Address PR review: deterministic binding IDs, permission handling, and resource constants

- Use role name instead of iteration index for IAM binding IDs to ensure
  deterministic caching across API calls
- Handle gRPC PermissionDenied errors gracefully in iamPolicy() methods
  so scans don't fail when caller lacks getIamPolicy permission
- Replace all string literal resource types with generated constants

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Author: tas50

providers/gcp/go.mod

@@ -281,7 +281,7 @@ require (
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260122232226-8e98ce8d340d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
-	google.golang.org/grpc v1.79.1 // indirect
+	google.golang.org/grpc v1.79.1
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	howett.net/plist v1.0.1 // indirect

providers/gcp/resources/pubsub.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"strconv"
 	"time"
 
 	"cloud.google.com/go/pubsub"
@@ -18,6 +17,8 @@ import (
 	"go.mondoo.com/mql/v13/types"
 	"google.golang.org/api/iterator"
 	"google.golang.org/api/option"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 func (g *mqlGcpProjectPubsubService) id() (string, error) {
@@ -50,7 +51,7 @@ func (g *mqlGcpProject) pubsub() (*mqlGcpProjectPubsubService, error) {
 	}
 	projectId := g.Id.Data
 
-	res, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService", map[string]*llx.RawData{
+	res, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubService, map[string]*llx.RawData{
 		"projectId": llx.StringData(projectId),
 	})
 	if err != nil {
@@ -168,7 +169,7 @@ func (g *mqlGcpProjectPubsubService) topics() ([]any, error) {
 		if err != nil {
 			return nil, err
 		}
-		mqlTopic, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService.topic", map[string]*llx.RawData{
+		mqlTopic, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubServiceTopic, map[string]*llx.RawData{
 			"projectId": llx.StringData(projectId),
 			"name":      llx.StringData(t.ID()),
 		})
@@ -213,19 +214,19 @@ func (g *mqlGcpProjectPubsubServiceTopic) config() (*mqlGcpProjectPubsubServiceT
 		return nil, err
 	}
 
-	messageStoragePolicy, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService.topic.config.messagestoragepolicy", map[string]*llx.RawData{
+	messageStoragePolicy, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubServiceTopicConfigMessagestoragepolicy, map[string]*llx.RawData{
 		"configId":                  llx.StringData(pubsubConfigId(projectId, t.ID())),
 		"allowedPersistenceRegions": llx.ArrayData(convert.SliceAnyToInterface(cfg.MessageStoragePolicy.AllowedPersistenceRegions), types.String),
 	})
 	if err != nil {
 		return nil, err
 	}
-	res, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService.topic.config", map[string]*llx.RawData{
+	res, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubServiceTopicConfig, map[string]*llx.RawData{
 		"projectId":            llx.StringData(projectId),
 		"topicName":            llx.StringData(t.ID()),
 		"labels":               llx.MapData(convert.MapToInterfaceMap(cfg.Labels), types.String),
 		"kmsKeyName":           llx.StringData(cfg.KMSKeyName),
-		"messageStoragePolicy": llx.ResourceData(messageStoragePolicy, "gcp.project.pubsubService.topic.config.messagestoragepolicy"),
+		"messageStoragePolicy": llx.ResourceData(messageStoragePolicy, ResourceGcpProjectPubsubServiceTopicConfigMessagestoragepolicy),
 		"state":                llx.StringData(topicStateToString(cfg.State)),
 	})
 	if err != nil {
@@ -266,7 +267,7 @@ func (g *mqlGcpProjectPubsubService) subscriptions() ([]any, error) {
 		if err != nil {
 			return nil, err
 		}
-		mqlSub, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService.subscription", map[string]*llx.RawData{
+		mqlSub, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubServiceSubscription, map[string]*llx.RawData{
 			"projectId": llx.StringData(projectId),
 			"name":      llx.StringData(s.ID()),
 		})
@@ -311,15 +312,15 @@ func (g *mqlGcpProjectPubsubServiceSubscription) config() (*mqlGcpProjectPubsubS
 		return nil, err
 	}
 
-	topic, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService.topic", map[string]*llx.RawData{
+	topic, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubServiceTopic, map[string]*llx.RawData{
 		"projectId": llx.StringData(projectId),
 		"name":      llx.StringData(cfg.Topic.ID()),
 	})
 	if err != nil {
 		return nil, err
 	}
 
-	pushConfig, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService.subscription.config.pushconfig", map[string]*llx.RawData{
+	pushConfig, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubServiceSubscriptionConfigPushconfig, map[string]*llx.RawData{
 		"configId":   llx.StringData(pubsubConfigId(projectId, s.ID())),
 		"endpoint":   llx.StringData(cfg.PushConfig.Endpoint),
 		"attributes": llx.MapData(convert.MapToInterfaceMap(cfg.PushConfig.Attributes), types.String),
@@ -331,11 +332,11 @@ func (g *mqlGcpProjectPubsubServiceSubscription) config() (*mqlGcpProjectPubsubS
 	if exp, ok := cfg.ExpirationPolicy.(time.Duration); ok {
 		expPolicy = llx.DurationToTime(int64(exp.Seconds()))
 	}
-	res, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService.subscription.config", map[string]*llx.RawData{
+	res, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubServiceSubscriptionConfig, map[string]*llx.RawData{
 		"projectId":                 llx.StringData(projectId),
 		"subscriptionName":          llx.StringData(s.ID()),
-		"topic":                     llx.ResourceData(topic, "gcp.project.pubsubService.topic"),
-		"pushConfig":                llx.ResourceData(pushConfig, "gcp.project.pubsubService.subscription.config.pushconfig"),
+		"topic":                     llx.ResourceData(topic, ResourceGcpProjectPubsubServiceTopic),
+		"pushConfig":                llx.ResourceData(pushConfig, ResourceGcpProjectPubsubServiceSubscriptionConfigPushconfig),
 		"ackDeadline":               llx.TimeData(llx.DurationToTime(int64(cfg.AckDeadline.Seconds()))),
 		"retainAckedMessages":       llx.BoolData(cfg.RetainAckedMessages),
 		"retentionDuration":         llx.TimeData(llx.DurationToTime(int64(cfg.RetentionDuration.Seconds()))),
@@ -386,7 +387,7 @@ func (g *mqlGcpProjectPubsubService) snapshots() ([]any, error) {
 			return nil, err
 		}
 
-		topic, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService.topic", map[string]*llx.RawData{
+		topic, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubServiceTopic, map[string]*llx.RawData{
 			"id":        llx.StringData(s.Topic.ID()),
 			"projectId": llx.StringData(projectId),
 			"name":      llx.StringData(s.Topic.ID()),
@@ -395,11 +396,11 @@ func (g *mqlGcpProjectPubsubService) snapshots() ([]any, error) {
 			return nil, err
 		}
 
-		mqlSub, err := CreateResource(g.MqlRuntime, "gcp.project.pubsubService.snapshot", map[string]*llx.RawData{
+		mqlSub, err := CreateResource(g.MqlRuntime, ResourceGcpProjectPubsubServiceSnapshot, map[string]*llx.RawData{
 			"id":         llx.StringData(s.ID()),
 			"projectId":  llx.StringData(projectId),
 			"name":       llx.StringData(s.ID()),
-			"topic":      llx.ResourceData(topic, "gcp.project.pubsubService.topic"),
+			"topic":      llx.ResourceData(topic, ResourceGcpProjectPubsubServiceTopic),
 			"expiration": llx.TimeData(s.Expiration),
 		})
 		if err != nil {
@@ -439,15 +440,18 @@ func (g *mqlGcpProjectPubsubServiceTopic) iamPolicy() ([]any, error) {
 
 	policy, err := pubsubSvc.Topic(name).IAM().Policy(ctx)
 	if err != nil {
+		if s, ok := status.FromError(err); ok && s.Code() == codes.PermissionDenied {
+			return nil, nil
+		}
 		return nil, err
 	}
 
 	bindings := policy.InternalProto.Bindings
 	res := make([]any, 0, len(bindings))
 	topicPath := fmt.Sprintf("projects/%s/topics/%s", projectId, name)
-	for i, b := range bindings {
+	for _, b := range bindings {
 		mqlBinding, err := CreateResource(g.MqlRuntime, ResourceGcpResourcemanagerBinding, map[string]*llx.RawData{
-			"id":      llx.StringData(topicPath + "-" + strconv.Itoa(i)),
+			"id":      llx.StringData(topicPath + "/" + b.Role),
 			"role":    llx.StringData(b.Role),
 			"members": llx.ArrayData(convert.SliceAnyToInterface(b.Members), types.String),
 		})
@@ -487,15 +491,18 @@ func (g *mqlGcpProjectPubsubServiceSubscription) iamPolicy() ([]any, error) {
 
 	policy, err := pubsubSvc.Subscription(name).IAM().Policy(ctx)
 	if err != nil {
+		if s, ok := status.FromError(err); ok && s.Code() == codes.PermissionDenied {
+			return nil, nil
+		}
 		return nil, err
 	}
 
 	bindings := policy.InternalProto.Bindings
 	res := make([]any, 0, len(bindings))
 	subPath := fmt.Sprintf("projects/%s/subscriptions/%s", projectId, name)
-	for i, b := range bindings {
+	for _, b := range bindings {
 		mqlBinding, err := CreateResource(g.MqlRuntime, ResourceGcpResourcemanagerBinding, map[string]*llx.RawData{
-			"id":      llx.StringData(subPath + "-" + strconv.Itoa(i)),
+			"id":      llx.StringData(subPath + "/" + b.Role),
 			"role":    llx.StringData(b.Role),
 			"members": llx.ArrayData(convert.SliceAnyToInterface(b.Members), types.String),
 		})