FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Correcting Model Armor runtime IAM to supported attributes
Removing the unsupported resource condition while preserving the sanitize-only permission
Purpose
A Model Armor canary returned 503, and verification found that the service did not support the resource.name condition in runtime IAM, causing the binding itself to be rejected. The repair needed to make sanitization work without broadening permission.
Implementation
The unsupported resource.name condition was removed from runtime IAM policy. The custom role granted to the runtime service account still contains only the single permission for sanitizing a user prompt.
Module documentation, the integrated specification, and infrastructure verification were aligned with the same IAM contract, detecting reintroduction of the unsupported condition or additional permissions.
Rendering diagram…
What was confirmed
Verification results
Terraform formatting, validation, GCP verification, specification auditing, and the diff check passed.
Static checks confirmed that the custom role contained only the single sanitization permission.
A successful real canary after the repair had not been verified by the cutoff.
Basis for completion
This scope ended when the unsupported condition was removed and the sanitize-only IAM contract could be verified statically.