add comment for ValidateCredsCallback

- add validation callback will enable the host service to validate the newly created key before the deleting the old key

- wrapped both the call to validate permissions and validate callback in a retry because sometimes it takes some time for the newly created key to be active on GCP services. This throws an error and prevents host catalog creation

.github/pull_request_template.md

@@ -1,11 +0,0 @@
-## PCI review checklist
-
-<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
-
-- [ ] I have documented a clear reason for, and description of, the change I am making.
-
-- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
-
-- [ ] If applicable, I've documented the impact of any changes to security controls.
-
-  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/boundary-plugin-gcp
 
-go 1.23.0
+go 1.21
 
 require (
 	cloud.google.com/go/iam v1.2.0
@@ -9,7 +9,7 @@ require (
 	github.com/googleapis/gax-go/v2 v2.13.0
 	github.com/hashicorp/boundary/sdk v0.0.47
 	github.com/hashicorp/terraform-json v0.23.0
-	golang.org/x/oauth2 v0.27.0
+	golang.org/x/oauth2 v0.22.0
 	google.golang.org/api v0.196.0
 )
 
@@ -34,7 +34,7 @@ require (
 	go.opentelemetry.io/otel v1.29.0 // indirect
 	go.opentelemetry.io/otel/metric v1.29.0 // indirect
 	go.opentelemetry.io/otel/trace v1.29.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/sync v0.8.0 // indirect
 	golang.org/x/time v0.6.0 // indirect
 	google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 // indirect
@@ -55,10 +55,10 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/stretchr/testify v1.9.0
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/net v0.38.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/crypto v0.26.0 // indirect
+	golang.org/x/net v0.28.0 // indirect
+	golang.org/x/sys v0.24.0 // indirect
+	golang.org/x/text v0.17.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
 	google.golang.org/grpc v1.66.0
 	google.golang.org/protobuf v1.34.2

go.sum

@@ -215,8 +215,8 @@ go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
+golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -234,27 +234,27 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
-golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
+golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
-golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
+golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
+golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
+golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
 golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

internal/credential/attributes_test.go

@@ -119,17 +119,15 @@ func TestGetCredentialsConfig(t *testing.T) {
 				Zone: "us-central-1a",
 			},
 			expected: &Config{
-				Zone:                             "us-central-1a",
-				Scopes:                           []string{defaultGCPScope},
-				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
+				Zone:   "us-central-1a",
+				Scopes: []string{defaultGCPScope},
 			},
 		},
 		{
 			name:  "nil attributes",
 			attrs: nil,
 			expected: &Config{
-				Scopes:                           []string{defaultGCPScope},
-				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
+				Scopes: []string{defaultGCPScope},
 			},
 		},
 		{
@@ -156,13 +154,12 @@ func TestGetCredentialsConfig(t *testing.T) {
 				ClientEmail: "test@test.com",
 			},
 			expected: &Config{
-				ProjectId:                        "test-project",
-				Zone:                             "us-central-1a",
-				ClientEmail:                      "test@test.com",
-				PrivateKey:                       "test-private-key",
-				PrivateKeyId:                     "test-private-key-id",
-				Scopes:                           []string{defaultGCPScope},
-				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
+				ProjectId:    "test-project",
+				Zone:         "us-central-1a",
+				ClientEmail:  "test@test.com",
+				PrivateKey:   "test-private-key",
+				PrivateKeyId: "test-private-key-id",
+				Scopes:       []string{defaultGCPScope},
 			},
 		},
 		{
@@ -223,13 +220,12 @@ func TestGetCredentialsConfig(t *testing.T) {
 				Zone:        "us-central-1a",
 			},
 			expected: &Config{
-				ProjectId:                        "test-project",
-				Zone:                             "us-central-1a",
-				PrivateKey:                       "test-private-key",
-				PrivateKeyId:                     "test-private-key-id",
-				ClientEmail:                      "test@test.com",
-				Scopes:                           []string{defaultGCPScope},
-				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
+				ProjectId:    "test-project",
+				Zone:         "us-central-1a",
+				PrivateKey:   "test-private-key",
+				PrivateKeyId: "test-private-key-id",
+				ClientEmail:  "test@test.com",
+				Scopes:       []string{defaultGCPScope},
 			},
 		},
 		{
@@ -245,14 +241,13 @@ func TestGetCredentialsConfig(t *testing.T) {
 				TargetServiceAccountId: "test-target-service-account",
 			},
 			expected: &Config{
-				ProjectId:                        "test-project",
-				Zone:                             "us-central-1a",
-				PrivateKey:                       "test-private-key",
-				PrivateKeyId:                     "test-private-key-id",
-				ClientEmail:                      "test@test.com",
-				TargetServiceAccountId:           "test-target-service-account",
-				Scopes:                           []string{defaultGCPScope},
-				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
+				ProjectId:              "test-project",
+				Zone:                   "us-central-1a",
+				PrivateKey:             "test-private-key",
+				PrivateKeyId:           "test-private-key-id",
+				ClientEmail:            "test@test.com",
+				TargetServiceAccountId: "test-target-service-account",
+				Scopes:                 []string{defaultGCPScope},
 			},
 		},
 	}

internal/credential/config.go

@@ -41,21 +41,17 @@ const (
 	// and then controlling the service account's access by granting it IAM roles.
 	// https://cloud.google.com/compute/docs/access/service-accounts#scopes_best_practice
 	defaultGCPScope = "https://www.googleapis.com/auth/cloud-platform"
-	// defaultValidateServiceAccountKeyTimeout is the timeout for validating
-	// a service account key.
-	defaultValidateServiceAccountKeyTimeout = 5 * time.Second
 )
 
 // Config is the configuration for the GCP credential.
 type Config struct {
-	ProjectId                        string
-	PrivateKey                       string
-	PrivateKeyId                     string
-	Zone                             string
-	ClientEmail                      string
-	TargetServiceAccountId           string
-	Scopes                           []string
-	validateServiceAccountKeyTimeout time.Duration
+	ProjectId              string
+	PrivateKey             string
+	PrivateKeyId           string
+	Zone                   string
+	ClientEmail            string
+	TargetServiceAccountId string
+	Scopes                 []string
 }
 
 // credentials represents a simplified version of the GCP credentials file format.
@@ -76,14 +72,13 @@ func NewConfig(opt ...Option) (*Config, error) {
 		return nil, err
 	}
 	c := &Config{
-		ProjectId:                        opts.WithProjectId,
-		PrivateKey:                       opts.WithPrivateKey,
-		PrivateKeyId:                     opts.WithPrivateKeyId,
-		ClientEmail:                      opts.WithClientEmail,
-		TargetServiceAccountId:           opts.WithTargetServiceAccountId,
-		Zone:                             opts.WithZone,
-		Scopes:                           opts.WithScopes,
-		validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
+		ProjectId:              opts.WithProjectId,
+		PrivateKey:             opts.WithPrivateKey,
+		PrivateKeyId:           opts.WithPrivateKeyId,
+		ClientEmail:            opts.WithClientEmail,
+		TargetServiceAccountId: opts.WithTargetServiceAccountId,
+		Zone:                   opts.WithZone,
+		Scopes:                 opts.WithScopes,
 	}
 	return c, nil
 }
@@ -102,14 +97,13 @@ func (c *Config) toCredentials() *credentials {
 // clone returns a copy of the configuration.
 func (c *Config) clone() *Config {
 	return &Config{
-		ProjectId:                        c.ProjectId,
-		Zone:                             c.Zone,
-		PrivateKey:                       c.PrivateKey,
-		PrivateKeyId:                     c.PrivateKeyId,
-		ClientEmail:                      c.ClientEmail,
-		TargetServiceAccountId:           c.TargetServiceAccountId,
-		Scopes:                           c.Scopes,
-		validateServiceAccountKeyTimeout: c.validateServiceAccountKeyTimeout,
+		ProjectId:              c.ProjectId,
+		Zone:                   c.Zone,
+		PrivateKey:             c.PrivateKey,
+		PrivateKeyId:           c.PrivateKeyId,
+		ClientEmail:            c.ClientEmail,
+		TargetServiceAccountId: c.TargetServiceAccountId,
+		Scopes:                 c.Scopes,
 	}
 }
 

internal/credential/config_test.go

@@ -403,14 +403,13 @@ func TestNewConfig(t *testing.T) {
 				WithScopes([]string{"scope1", "scope2"}),
 			},
 			expected: &Config{
-				ProjectId:                        "test-project-id",
-				PrivateKey:                       "test-private-key",
-				PrivateKeyId:                     "test-private-key-id",
-				ClientEmail:                      "test-email@example.com",
-				TargetServiceAccountId:           "target-service-account@example.com",
-				Zone:                             "test-zone",
-				Scopes:                           []string{"scope1", "scope2"},
-				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
+				ProjectId:              "test-project-id",
+				PrivateKey:             "test-private-key",
+				PrivateKeyId:           "test-private-key-id",
+				ClientEmail:            "test-email@example.com",
+				TargetServiceAccountId: "target-service-account@example.com",
+				Zone:                   "test-zone",
+				Scopes:                 []string{"scope1", "scope2"},
 			},
 			expectError: false,
 		},
@@ -418,8 +417,7 @@ func TestNewConfig(t *testing.T) {
 			name:    "No Options",
 			options: []Option{},
 			expected: &Config{
-				Scopes:                           []string{defaultGCPScope},
-				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
+				Scopes: []string{defaultGCPScope},
 			},
 			expectError: false,
 		},
@@ -444,14 +442,13 @@ func TestNewConfig(t *testing.T) {
 				WithZone("test-zone"),
 			},
 			expected: &Config{
-				ProjectId:                        "test-project-id",
-				PrivateKey:                       "test-private-key",
-				PrivateKeyId:                     "test-private-key-id",
-				ClientEmail:                      "test-email@example.com",
-				TargetServiceAccountId:           "target-service-account@example.com",
-				Zone:                             "test-zone",
-				Scopes:                           []string{defaultGCPScope},
-				validateServiceAccountKeyTimeout: defaultValidateServiceAccountKeyTimeout,
+				ProjectId:              "test-project-id",
+				PrivateKey:             "test-private-key",
+				PrivateKeyId:           "test-private-key-id",
+				ClientEmail:            "test-email@example.com",
+				TargetServiceAccountId: "target-service-account@example.com",
+				Zone:                   "test-zone",
+				Scopes:                 []string{defaultGCPScope},
 			},
 			expectError: false,
 		},

internal/credential/rotate.go

@@ -32,6 +32,9 @@ const (
 	// required to delete a service account key.
 	// This permission is required to rotate service account keys.
 	IAMServiceAccountKeysDeletePermission = "iam.serviceAccountKeys.delete"
+	// validateServiceAccountKeyTimeout is the timeout for validating
+	// a service account key.
+	validateServiceAccountKeyTimeout = 5 * time.Second
 )
 
 // ServiceAccountPrivateKey represents a decoded PrivateKeyData
@@ -158,31 +161,19 @@ func (c *Config) ValidateServiceAccountKey(
 	var validatePermissionsErr error
 	var validationCallbackErr error
 
-	ticker := time.NewTicker(200 * time.Millisecond)
-	defer ticker.Stop()
+	for start := time.Now(); time.Since(start) < validateServiceAccountKeyTimeout; time.Sleep(200 * time.Millisecond) {
+		_, validatePermissionsErr = c.ValidateIamPermissions(ctx, permissions, opts...)
 
-	ctx, cancel := context.WithTimeout(ctx, c.validateServiceAccountKeyTimeout)
-	defer cancel()
+		if validateCredsCallback != nil {
+			validationCallbackErr = validateCredsCallback(c, opts...)
+		}
 
-	for {
-		select {
-		case <-ctx.Done():
-			if ctx.Err() == context.DeadlineExceeded {
-				return fmt.Errorf("failed to validate service account key before timeout: %w", errors.Join(validatePermissionsErr, validationCallbackErr))
-			}
-			return ctx.Err()
-		case <-ticker.C:
-			_, validatePermissionsErr = c.ValidateIamPermissions(ctx, permissions, opts...)
-
-			if validateCredsCallback != nil {
-				validationCallbackErr = validateCredsCallback(c, opts...)
-			}
-
-			if validatePermissionsErr == nil && validationCallbackErr == nil {
-				return nil
-			}
+		if validatePermissionsErr == nil && validationCallbackErr == nil {
+			return nil
 		}
 	}
+
+	return errors.Join(validatePermissionsErr, validationCallbackErr)
 }
 
 func (c *Config) DeletePrivateKey(ctx context.Context, opts ...option.ClientOption) error {

internal/credential/rotate_test.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 	"testing"
-	"time"
 
 	"cloud.google.com/go/iam/admin/apiv1/adminpb"
 	"cloud.google.com/go/iam/apiv1/iampb"
@@ -31,7 +30,6 @@ func TestRotateServiceAccountKey(t *testing.T) {
 			},
 		},
 	}
-	testValidateTimeout := 1 * time.Second
 
 	tests := []struct {
 		name          string
@@ -78,10 +76,9 @@ func TestRotateServiceAccountKey(t *testing.T) {
 		{
 			name: "DeleteServiceAccountKey returns error",
 			config: &Config{
-				PrivateKey:                       "some-private-key",
-				PrivateKeyId:                     "some-private-key-id",
-				ClientEmail:                      "client@example.com",
-				validateServiceAccountKeyTimeout: testValidateTimeout,
+				PrivateKey:   "some-private-key",
+				PrivateKeyId: "some-private-key-id",
+				ClientEmail:  "client@example.com",
 			},
 			setup: func() {
 				testIAMAdminServer.testCreateServiceAccountKeyError = nil
@@ -92,10 +89,9 @@ func TestRotateServiceAccountKey(t *testing.T) {
 		{
 			name: "Successful rotation",
 			config: &Config{
-				PrivateKey:                       "some-private-key",
-				PrivateKeyId:                     "some-private-key-id",
-				ClientEmail:                      "client@example.com",
-				validateServiceAccountKeyTimeout: testValidateTimeout,
+				PrivateKey:   "some-private-key",
+				PrivateKeyId: "some-private-key-id",
+				ClientEmail:  "client@example.com",
 			},
 			setup: func() {
 				testIAMAdminServer.testCreateServiceAccountKeyError = nil
@@ -265,104 +261,6 @@ func TestValidateIamPermissions(t *testing.T) {
 		})
 	}
 }
-
-func TestValidateServiceAccountKey(t *testing.T) {
-	ctx := context.Background()
-	testResourceServer := &testResourceServer{}
-	testValidateTimeout := 1 * time.Second
-
-	tests := []struct {
-		name                    string
-		config                  *Config
-		permissions             []string
-		validateCredsCallback   ValidateCredsCallback
-		testIamPermissionsError error
-		expectedError           error
-	}{
-		{
-			name: "Successful validation",
-			config: &Config{
-				ProjectId:                        "test-project-id",
-				PrivateKey:                       "test-private-key",
-				ClientEmail:                      "test@test.com",
-				validateServiceAccountKeyTimeout: testValidateTimeout,
-			},
-			permissions: []string{
-				ComputeInstancesListPermission,
-				IAMServiceAccountKeysCreatePermission,
-				IAMServiceAccountKeysDeletePermission,
-			},
-			validateCredsCallback: func(c *Config, opts ...googleOption.ClientOption) error {
-				return nil
-			},
-			expectedError: nil,
-		},
-		{
-			name: "Validation callback returns error",
-			config: &Config{
-				ProjectId:                        "test-project-id",
-				PrivateKey:                       "test-private-key",
-				ClientEmail:                      "test@test.com",
-				validateServiceAccountKeyTimeout: testValidateTimeout,
-			},
-			permissions: []string{
-				ComputeInstancesListPermission,
-				IAMServiceAccountKeysCreatePermission,
-				IAMServiceAccountKeysDeletePermission,
-			},
-			validateCredsCallback: func(c *Config, opts ...googleOption.ClientOption) error {
-				return errors.New("validation callback error")
-			},
-			expectedError: errors.New("validation callback error"),
-		},
-		{
-			name: "IAM permissions validation returns error",
-			config: &Config{
-				ProjectId:                        "test-project-id",
-				PrivateKey:                       "test-private-key",
-				ClientEmail:                      "test@test.com",
-				validateServiceAccountKeyTimeout: testValidateTimeout,
-			},
-			permissions: []string{
-				ComputeInstancesListPermission,
-				IAMServiceAccountKeysCreatePermission,
-				IAMServiceAccountKeysDeletePermission,
-			},
-			testIamPermissionsError: errors.New("IAM permissions error"),
-			expectedError:           errors.New("failed to validate IAM permissions"),
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			testResourceServer.testIamPermissionsResponse = &iampb.TestIamPermissionsResponse{
-				Permissions: tt.permissions,
-			}
-			testResourceServer.testIamPermissionsError = tt.testIamPermissionsError
-
-			gsrv := NewGRPCServer()
-			resourcemanagerpb.RegisterProjectsServer(gsrv.Server, testResourceServer)
-			addr, err := gsrv.Start()
-			require.NoError(t, err)
-
-			testOptions := []googleOption.ClientOption{
-				googleOption.WithEndpoint(addr),
-				googleOption.WithoutAuthentication(),
-				googleOption.WithGRPCDialOption(grpc.WithTransportCredentials(insecure.NewCredentials())),
-				googleOption.WithTokenSource(nil),
-			}
-
-			err = tt.config.ValidateServiceAccountKey(ctx, tt.permissions, tt.validateCredsCallback, testOptions...)
-			if tt.expectedError != nil {
-				require.ErrorContains(t, err, tt.expectedError.Error())
-				return
-			}
-
-			require.NoError(t, err)
-		})
-	}
-}
-
 func TestDeletePrivateKey(t *testing.T) {
 	testIAMAdminServer := &testIAMAdminServer{}
 

plugin/service/host/attributes.go

@@ -108,7 +108,7 @@ func buildListInstancesRequest(attributes *SetAttributes, catalog *CatalogAttrib
 		return nil, fmt.Errorf("error building filters: %w", err)
 	}
 
-	if len(filters) > 0 {
+	if len(filters) > 1 {
 		filters := strings.Join(filters, " AND ")
 		request.Filter = &filters
 	}

plugin/service/host/attributes_test.go

@@ -183,23 +183,6 @@ func TestBuildListInstancesRequest(t *testing.T) {
 			},
 			expectedErrContains: "error building filters",
 		},
-		{
-			name: "valid request with no filters",
-			attributes: &SetAttributes{
-				Filters: []string{},
-			},
-			catalog: &CatalogAttributes{
-				CredentialAttributes: &cred.CredentialAttributes{
-					ProjectId: "test-12345",
-					Zone:      "us-central-1a",
-				},
-			},
-			expected: &computepb.ListInstancesRequest{
-				Project: "test-12345",
-				Zone:    "us-central-1a",
-				Filter:  stringPtr("status = running"),
-			},
-		},
 	}
 
 	for _, tc := range cases {

plugin/service/host/plugin.go

@@ -87,10 +87,6 @@ func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalo
 		credential.IAMServiceAccountKeysDeletePermission,
 	}
 
-	if !credState.CredentialsConfig.IsRotatable() && !catalogAttributes.DisableCredentialRotation {
-		return nil, status.Error(codes.InvalidArgument, "cannot rotate credentials for non-rotatable credentials")
-	}
-
 	if credState.CredentialsConfig.IsRotatable() && !catalogAttributes.DisableCredentialRotation {
 		state, err := newGCPCatalogPersistedState(
 			append([]gcpCatalogPersistedStateOption{
@@ -617,6 +613,11 @@ func validateSet(s *hostsets.HostSet) error {
 	}
 
 	badFields := make(map[string]string)
+	_, filterSet := attrMap[ConstListInstancesFilter]
+
+	if filterSet && len(attrs.Filters) == 0 {
+		badFields[fmt.Sprintf("attributes.%s", ConstListInstancesFilter)] = "must not be empty"
+	}
 
 	for f := range attrMap {
 		if _, ok := allowedSetFields[f]; !ok {

plugin/service/host/plugin_test.go

@@ -878,53 +878,6 @@ func TestCreateCatalog(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "create with application default credentials and credential rotation disabled",
-			req: &pb.OnCreateCatalogRequest{
-				Catalog: &hostcatalogs.HostCatalog{
-					Attrs: &hostcatalogs.HostCatalog_Attributes{
-						Attributes: &structpb.Struct{
-							Fields: map[string]*structpb.Value{
-								cred.ConstProjectId:                 structpb.NewStringValue("test-project"),
-								cred.ConstZone:                      structpb.NewStringValue("us-central1-a"),
-								cred.ConstDisableCredentialRotation: structpb.NewBoolValue(true),
-							},
-						},
-					},
-				},
-			},
-			catalogOpts: []gcpCatalogPersistedStateOption{
-				withTestInstancesAPIFunc(newTestMockInstances(ctx,
-					nil,
-					testMockInstancesWithListInstancesOutput(&computepb.InstanceList{}),
-					testMockInstancesWithListInstancesError(nil),
-				)),
-			},
-			expectedRsp: &pb.OnCreateCatalogResponse{
-				Persisted: &pb.HostCatalogPersisted{
-					Secrets: &structpb.Struct{
-						Fields: map[string]*structpb.Value{},
-					},
-				},
-			},
-		},
-		{
-			name: "create with application default credentials and credential rotation enabled",
-			req: &pb.OnCreateCatalogRequest{
-				Catalog: &hostcatalogs.HostCatalog{
-					Attrs: &hostcatalogs.HostCatalog_Attributes{
-						Attributes: &structpb.Struct{
-							Fields: map[string]*structpb.Value{
-								cred.ConstProjectId:                 structpb.NewStringValue("test-project"),
-								cred.ConstZone:                      structpb.NewStringValue("us-central1-a"),
-								cred.ConstDisableCredentialRotation: structpb.NewBoolValue(false),
-							},
-						},
-					},
-				},
-			},
-			expectedErr: "cannot rotate credentials for non-rotatable credentials",
-		},
 	}
 
 	for _, tc := range cases {