Skip to content

Runbook: securing an MCP setup - #7

Closed
ChrisInvictus wants to merge 1 commit into
mainfrom
docs/mcp-setup-runbook
Closed

Runbook: securing an MCP setup#7
ChrisInvictus wants to merge 1 commit into
mainfrom
docs/mcp-setup-runbook

Conversation

@ChrisInvictus

Copy link
Copy Markdown
Owner

The threat model applied as a checklist to a live connector configuration — five boundaries, five findings including one remediation performed during the audit (two unused high-sensitivity grants disconnected). Theory → detection → prevention → practice.

@github-actions

Copy link
Copy Markdown

Terraform plan — stack demosuccess

Show plan
data.terraform_remote_state.org: Reading...
module.demo_project.random_id.suffix: Refreshing state... [id=IgU]
data.terraform_remote_state.org: Read complete after 0s
module.demo_project.google_project.this: Refreshing state... [id=projects/paved-org-demo-2205]
module.demo_project.google_project_service.baseline["iap.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/iap.googleapis.com]
module.demo_project.google_project_service.baseline["iam.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/iam.googleapis.com]
module.demo_project.google_project_service.baseline["artifactregistry.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/artifactregistry.googleapis.com]
module.demo_project.google_project_service.baseline["serviceusage.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/serviceusage.googleapis.com]
module.demo_project.google_project_service.baseline["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/cloudresourcemanager.googleapis.com]
module.demo_project.google_project_service.baseline["cloudbuild.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/cloudbuild.googleapis.com]
module.demo_project.google_project_service.baseline["compute.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/compute.googleapis.com]
module.demo_project.google_project_service.baseline["run.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/run.googleapis.com]
module.demo_project.google_project_service.baseline["monitoring.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/monitoring.googleapis.com]
module.demo_project.google_billing_budget.guard[0]: Refreshing state... [id=billingAccounts/01327E-49B005-4A311F/budgets/085c714a-bacd-4698-964e-a2fecc79e56a]
module.demo_project.google_project_service.baseline["logging.googleapis.com"]: Refreshing state... [id=paved-org-demo-2205/logging.googleapis.com]
google_artifact_registry_repository.app: Refreshing state... [id=projects/paved-org-demo-2205/locations/us-east1/repositories/demo]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

@github-actions

Copy link
Copy Markdown

Terraform plan — stack orgsuccess

Show plan
google_folder.workloads: Refreshing state... [id=folders/442367273223]
google_org_policy_policy.disable_sa_key_creation: Refreshing state... [id=organizations/386600224156/policies/iam.disableServiceAccountKeyCreation]
google_org_policy_policy.no_vm_external_ip: Refreshing state... [id=organizations/386600224156/policies/compute.vmExternalIpAccess]
google_org_policy_policy.domain_restricted_sharing: Refreshing state... [id=organizations/386600224156/policies/iam.allowedPolicyMemberDomains]
google_iam_workload_identity_pool.github: Refreshing state... [id=projects/paved-org-seed/locations/global/workloadIdentityPools/github-pool]
google_logging_project_bucket_config.org_audit: Refreshing state... [id=projects/paved-org-seed/locations/global/buckets/org-audit]
google_org_policy_policy.skip_default_network: Refreshing state... [id=organizations/386600224156/policies/compute.skipDefaultNetworkCreation]
google_org_policy_policy.uniform_bucket_access: Refreshing state... [id=organizations/386600224156/policies/storage.uniformBucketLevelAccess]
google_org_policy_policy.no_public_sql: Refreshing state... [id=organizations/386600224156/policies/sql.restrictPublicIp]
google_org_policy_policy.no_default_sa_grants: Refreshing state... [id=organizations/386600224156/policies/iam.automaticIamGrantsForDefaultServiceAccounts]
google_folder.sandbox: Refreshing state... [id=folders/402625647000]
google_service_account.deployer: Refreshing state... [id=projects/paved-org-seed/serviceAccounts/paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_logging_organization_sink.audit: Refreshing state... [id=organizations/386600224156/sinks/org-audit-sink]
google_iam_workload_identity_pool_provider.github: Refreshing state... [id=projects/paved-org-seed/locations/global/workloadIdentityPools/github-pool/providers/github-oidc]
google_project_iam_member.deployer_wif_admin: Refreshing state... [id=paved-org-seed/roles/iam.workloadIdentityPoolAdmin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_organization_iam_member.deployer_iam_read: Refreshing state... [id=386600224156/roles/iam.securityReviewer/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_organization_iam_member.deployer_orgpolicy: Refreshing state... [id=386600224156/roles/orgpolicy.policyAdmin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_service_account_iam_member.wif_binding: Refreshing state... [id=projects/paved-org-seed/serviceAccounts/paved-org-deployer@paved-org-seed.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/540939044753/locations/global/workloadIdentityPools/github-pool/attribute.repository/ChrisInvictus/paved-org]
google_storage_bucket_iam_member.deployer_state: Refreshing state... [id=b/paved-org-tfstate-386600224156/roles/storage.admin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_project_iam_member.deployer_logging_admin: Refreshing state... [id=paved-org-seed/roles/logging.admin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_project_iam_member.deployer_sa_admin: Refreshing state... [id=paved-org-seed/roles/iam.serviceAccountAdmin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_organization_iam_member.deployer_logging: Refreshing state... [id=386600224156/roles/logging.configWriter/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_organization_iam_member.deployer_folders: Refreshing state... [id=386600224156/roles/resourcemanager.folderAdmin/serviceAccount:paved-org-deployer@paved-org-seed.iam.gserviceaccount.com]
google_project_iam_member.audit_sink_writer: Refreshing state... [id=paved-org-seed/roles/logging.bucketWriter/serviceAccount:service-org-386600224156@gcp-sa-logging.iam.gserviceaccount.com]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

@ChrisInvictus
ChrisInvictus deleted the docs/mcp-setup-runbook branch July 18, 2026 08:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant