From 46e1805f531ea5365a08a5ccf359f34e17d977df Mon Sep 17 00:00:00 2001 From: lvadlamudi Date: Wed, 12 Aug 2026 23:04:47 +0000 Subject: [PATCH] fix(lwpreflight): require storage.objects.list for GCP Agentless Terraform force-destroys the Agentless scanning bucket, which enumerates the objects before deleting them. The Agentless permission lists granted storage.objects.delete but not storage.objects.list, so the destroy died partway through with "Permission 'storage.objects.list' denied". That partial destroy is what orphans resources: the Lacework integration is itself a Terraform-managed resource that depends on the GCP ones, so it is destroyed first and the account disappears from Cloud Accounts while the GCP resources it was meant to clean up survive. The AWS Agentless lists already pair s3:ListBucket with s3:DeleteObject for this same force-destroy path. GCP was missing the equivalent. CAD-2294 CAD-2295 --- lwpreflight/gcp/constants.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lwpreflight/gcp/constants.go b/lwpreflight/gcp/constants.go index eebc7ceeb..2b77446a6 100644 --- a/lwpreflight/gcp/constants.go +++ b/lwpreflight/gcp/constants.go @@ -64,6 +64,7 @@ var RequiredPermissions = map[IntegrationType][]string{ "storage.buckets.list", "storage.buckets.setIamPolicy", "storage.objects.delete", + "storage.objects.list", }, AuditLog: { "cloudscheduler.locations.list", @@ -254,6 +255,7 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{ "storage.buckets.list", "storage.buckets.setIamPolicy", "storage.objects.delete", + "storage.objects.list", }, AuditLog: { "billing.accounts.get",