These demos are pulled from the same checked-in fixture plans used to exercise the analyzer in the repo. They make the project scope legible without asking someone to prepare Terraform first.
Quiet reference architecture
gcp/sample_gcp_safe_plan.jsonPrivate-by-default GCP reference with hardened storage, private Cloud SQL, scoped identity, Secret Manager, and Cloud KMS.
Calibrated baseline
gcp/sample_gcp_baseline_plan.jsonMostly segmented GCP infrastructure with custom-role IAM risk and a focused Cloud SQL recovery finding.
Common architecture
gcp/sample_gcp_lb_compute_sql_plan.jsonExternal load-balancing edge, private compute, NAT egress posture, and private Cloud SQL in a common GCP web shape.
Serverless workload
gcp/sample_gcp_serverless_plan.jsonCloud Run and Cloud Functions public invoker paths with service-account access into Secret Manager.
Trust expansion
gcp/sample_gcp_cross_project_iam_plan.jsonFocused IAM blast-radius fixture for project-level grants, Secret Manager access, and Cloud KMS decryption trust.
Provider expansion
gcp/sample_gcp_plan.jsonMixed Google provider inventory covering compute, network, IAM, Pub/Sub, BigQuery, Cloud SQL, Secret Manager, Cloud KMS, and GCS.
Stress-case fixture
gcp/sample_gcp_nightmare_plan.jsonStacked GCP risk across compute, GKE, serverless, data services, org/folder/project IAM, and unsupported-resource coverage.