@suss/terraform-gcp 0.9.0 → 0.11.0

package/README.md

@@ -4,7 +4,7 @@ Says what Google Cloud's Terraform provider declares, for `@suss/contract-terraf
 
 ## What this package is
 
-A pack, and nothing but entries. Two of them say what a resource is, and what its own words mean in the terms suss compares boundaries in.
+A pack, and nothing but entries. Each one says what a resource is, and what its own words mean in the terms suss compares boundaries in.
 
 ```ts
 import { terraformFileToSummaries } from "@suss/contract-terraform";
@@ -21,14 +21,18 @@ const summaries = terraformFileToSummaries("infra/terraform/monitoring", {
 
 | Resource | Becomes |
 | --- | --- |
+| `google_storage_bucket` | a store whose objects have no fields to compare against, under the name code passes to `bucket()` |
+| `google_redis_instance` | a Redis store with no container to pair on; see below |
 | `google_logging_metric` | a metric, identified by the type Cloud Monitoring gives it, `logging.googleapis.com/user/<name>` |
 | `google_monitoring_alert_policy` | one consumer of a metric per `condition_threshold`, identified by the `metric.type` its filter states |
 
 Everything else a configuration declares is skipped.
 
+A bucket pairs by name: `@suss/framework-gcs` records the bucket an access reaches, and the `name` attribute is the same string, so `suss check` compares the two sides. A Memorystore instance does not: code addresses Redis by key namespace, no attribute of the instance declares one, and a match on the instance's own name would be a coincidence, so the summary declares the store with no container name and the storage check claims no access for it. The `@suss/terraform-aws` README walks through the same decision for ElastiCache.
+
 ## The pair the provider refuses
 
-A log-based metric can declare that each measurement is a spread of buckets:
+A log-based metric can declare that each measurement is a histogram of buckets:
 
 ```hcl
 resource "google_logging_metric" "sweep_refused" {
@@ -53,7 +57,7 @@ condition_threshold {
 
 Both blocks are well formed, `terraform validate` and `terraform plan` both pass, and the apply fails minutes in: a distribution has no single value to compare, and Cloud Monitoring wants an aligner such as `ALIGN_PERCENTILE_95` to reduce each window to one number first.
 
-The entries say that `value_type = "DISTRIBUTION"` means the measurements are a spread, that a `threshold_value` means the condition compares against a single number, and that the four percentile aligners are the ones that reduce a window to a number. `checkMetric` puts those together and reports the pair as a `boundaryShapeMismatch` at error severity, naming `aggregations.per_series_aligner` and the four values that would fix it.
+The entries say that `value_type = "DISTRIBUTION"` means the measurements are a histogram, that a `threshold_value` means the condition compares against a single number, and that the four percentile aligners are the ones that reduce a window to a number. `checkMetric` puts those together and reports the pair as a `boundaryShapeMismatch` at error severity, naming `aggregations.per_series_aligner` and the four values that would fix it.
 
 A condition that states one of the percentile aligners is left alone, as is a condition on a metric declared as `INT64` or `DOUBLE`.
 

package/dist/index.cjs

@@ -29,12 +29,12 @@ var METRIC_SYSTEM = "cloud-monitoring";
 var VALUE_TYPES = {
   INT64: "number",
   DOUBLE: "number",
-  DISTRIBUTION: "spread"
+  DISTRIBUTION: "histogram"
 };
 var METRIC_KINDS = {
-  GAUGE: "point",
-  DELTA: "interval",
-  CUMULATIVE: "sinceStart"
+  GAUGE: "gauge",
+  DELTA: "delta",
+  CUMULATIVE: "cumulative"
 };
 var ALIGNERS = {
   ALIGN_PERCENTILE_99: "number",
@@ -47,6 +47,32 @@ function googleTerraform() {
     name: "terraform-gcp",
     provider: "google",
     resources: [
+      {
+        resource: "google_storage_bucket",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "storage",
+          storageSystem: "gcs",
+          // The name is what code passes to `bucket()`, so it is the
+          // identity both sides spell.
+          nameAttribute: "name",
+          // An object has no fields to compare a read against.
+          fieldSet: "none"
+        }
+      },
+      {
+        resource: "google_redis_instance",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "storage",
+          storageSystem: "redis",
+          // Code addresses key namespaces, which no attribute of the
+          // instance lists, so it declares the store and claims no
+          // access. The README says how the sides meet.
+          declares: "store",
+          fieldSet: "none"
+        }
+      },
       {
         resource: "google_logging_metric",
         providerVersions: CURRENT,

package/dist/index.js

@@ -4,12 +4,12 @@ var METRIC_SYSTEM = "cloud-monitoring";
 var VALUE_TYPES = {
   INT64: "number",
   DOUBLE: "number",
-  DISTRIBUTION: "spread"
+  DISTRIBUTION: "histogram"
 };
 var METRIC_KINDS = {
-  GAUGE: "point",
-  DELTA: "interval",
-  CUMULATIVE: "sinceStart"
+  GAUGE: "gauge",
+  DELTA: "delta",
+  CUMULATIVE: "cumulative"
 };
 var ALIGNERS = {
   ALIGN_PERCENTILE_99: "number",
@@ -22,6 +22,32 @@ function googleTerraform() {
     name: "terraform-gcp",
     provider: "google",
     resources: [
+      {
+        resource: "google_storage_bucket",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "storage",
+          storageSystem: "gcs",
+          // The name is what code passes to `bucket()`, so it is the
+          // identity both sides spell.
+          nameAttribute: "name",
+          // An object has no fields to compare a read against.
+          fieldSet: "none"
+        }
+      },
+      {
+        resource: "google_redis_instance",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "storage",
+          storageSystem: "redis",
+          // Code addresses key namespaces, which no attribute of the
+          // instance lists, so it declares the store and claims no
+          // access. The README says how the sides meet.
+          declares: "store",
+          fieldSet: "none"
+        }
+      },
       {
         resource: "google_logging_metric",
         providerVersions: CURRENT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suss/terraform-gcp",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "type": "module",
   "description": "What Google Cloud's Terraform provider declares, for the Terraform contract reader.",
   "keywords": [
@@ -44,8 +44,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@suss/behavioral-ir": "0.9.0",
-    "@suss/contract-terraform": "0.9.0"
+    "@suss/behavioral-ir": "0.11.0",
+    "@suss/contract-terraform": "0.11.0"
   },
   "devDependencies": {
     "@suss/checker": "*",