[tim-thacker-nullify]

GCP scans cannot read seven service configurations when their APIs are disabled in the connector host project.

• Enable KMS, Cloud SQL, Spanner, Dataflow, BigQuery, Org Policy and Access Context Manager APIs in the host project.
• Expose enable_scan_quota_apis at the root module and both examples.
• Keep Terraform strict: a blocked API causes apply failure; the root opt-out supports restricted projects.
• Enable optional installer APIs independently with bounded retries and per-service readiness results.
• Add mocked root-module plans and synthetic full-installer failure/retry cases.
• Correctness confidence: high (90%); Terraform mock plans and installer regressions pass; live Google propagation remains unverified.
• Merge risk: low to moderate; defaults enable additional APIs without changing reader roles.
• Activation risk: customer reapply can fail under organization policy or API dependencies; opt-out is explicit.
• The connector change is backward compatible and can merge independently of Nullify-Platform/nullify#18346; deploy its CAI reader before Cloud Build acceptance checks.
• Existing customers need a version bump and reapply, followed by a fresh scan that verifies consumer API failures are gone.

flowchart LR
  A["Connector host project"] --> B["Terraform: strict API enablement"]
  A --> C["Installer: bounded per-API attempts"]
  B --> D["Service configuration reads"]
  C --> D

Loading