From e77a6af0b78f06ec1210f06978af033cd62228fd Mon Sep 17 00:00:00 2001 From: lvadlamudi Date: Wed, 12 Aug 2026 22:30:08 +0000 Subject: [PATCH 1/3] fix(lwpreflight): drop projects.list from GCP project perms GCP marks resourcemanager.projects.list as "Not applicable for project-level custom roles", so a customer onboarding a project-level GCP Configuration integration cannot grant it. Discovery required it anyway and failed with "Required permission missing", leaving no way forward. The permission was only ever needed at org scope, where it is already listed in RequiredPermissionsForOrg. Preflight itself never calls projects.list, and the project-level terraform-gcp-config custom role does not use it either. CAD-2292 --- lwpreflight/gcp/constants.go | 1 - 1 file changed, 1 deletion(-) diff --git a/lwpreflight/gcp/constants.go b/lwpreflight/gcp/constants.go index eebc7ceeb..9be0178ab 100644 --- a/lwpreflight/gcp/constants.go +++ b/lwpreflight/gcp/constants.go @@ -133,7 +133,6 @@ var RequiredPermissions = map[IntegrationType][]string{ "monitoring.timeSeries.list", "resourcemanager.projects.get", "resourcemanager.projects.getIamPolicy", - "resourcemanager.projects.list", "resourcemanager.projects.setIamPolicy", "serviceusage.quotas.get", "serviceusage.quotas.update", From f4df975b3c3a405ca2ed896052243be99defa9c4 Mon Sep 17 00:00:00 2001 From: lvadlamudi Date: Wed, 12 Aug 2026 23:04:47 +0000 Subject: [PATCH 2/3] fix(lwpreflight): require storage.objects.list for GCP Agentless Terraform force-destroys the Agentless scanning bucket, which enumerates the objects before deleting them. The Agentless permission lists granted storage.objects.delete but not storage.objects.list, so the destroy died partway through with "Permission 'storage.objects.list' denied". That partial destroy is what orphans resources: the Lacework integration is itself a Terraform-managed resource that depends on the GCP ones, so it is destroyed first and the account disappears from Cloud Accounts while the GCP resources it was meant to clean up survive. The AWS Agentless lists already pair s3:ListBucket with s3:DeleteObject for this same force-destroy path. GCP was missing the equivalent. CAD-2294 CAD-2295 --- lwpreflight/gcp/constants.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lwpreflight/gcp/constants.go b/lwpreflight/gcp/constants.go index 9be0178ab..e6e6c2c03 100644 --- a/lwpreflight/gcp/constants.go +++ b/lwpreflight/gcp/constants.go @@ -64,6 +64,7 @@ var RequiredPermissions = map[IntegrationType][]string{ "storage.buckets.list", "storage.buckets.setIamPolicy", "storage.objects.delete", + "storage.objects.list", }, AuditLog: { "cloudscheduler.locations.list", @@ -253,6 +254,7 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{ "storage.buckets.list", "storage.buckets.setIamPolicy", "storage.objects.delete", + "storage.objects.list", }, AuditLog: { "billing.accounts.get", From 67dbf430d1d330f2748781cf3d46118207162e64 Mon Sep 17 00:00:00 2001 From: lvadlamudi Date: Thu, 13 Aug 2026 00:23:21 +0000 Subject: [PATCH 3/3] fix(lwpreflight): require eks:ListClusters for AWS EKS Audit Log FetchEKSClusters calls eks:ListClusters once per region to enumerate the clusters to onboard, but neither EksAuditLog permission list required it, so preflight passed and Discovery then failed with a 403. CAD-2296 --- lwpreflight/aws/constants.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lwpreflight/aws/constants.go b/lwpreflight/aws/constants.go index e4f665a99..a2aa56919 100644 --- a/lwpreflight/aws/constants.go +++ b/lwpreflight/aws/constants.go @@ -247,6 +247,7 @@ var RequiredPermissions = map[IntegrationType][]string{ }, EksAuditLog: { "ec2:DescribeRegions", + "eks:ListClusters", "s3:CreateBucket", "s3:DeleteBucket", "s3:ListBucket", @@ -676,6 +677,7 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{ }, EksAuditLog: { "ec2:DescribeRegions", + "eks:ListClusters", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts",