External Project Access Scanner reports violations for rules that are actually an allow-list

[kevensen]

The logic needs to be corrected.

forseti-security/google/cloud/forseti/scanner/audit/external_project_access_rules_engine.py

Lines 280 to 288 in 705cb3c

	for resource in self.rules['ancestor_resources']:
	if resource in ancestry:
	matched_resources.append(resource)
	if 'users' in list(self.rules.keys()):
	if user_email not in self.rules['users']:
	applies_to_user = False
	if not (matched_resources and applies_to_user):

[auto-comment]

Thank you for opening an issue. Our team's interrupts engineer will review your issue shortly.

Issue Resolution:

• [Interrupts Engineer] Triage / apply categorization labels
• [Interrupts Engineer] Verify / Reproduce the reported issue
• [Forseti Engineer] Perform root cause analysis
• Forseti Engineer] Add tasks and next steps to resolve this issue.

[kevensen]

• Fix logic

[red2k18]

@kevensen Thanks for submitting PR to fix this issue! Please address the comments on the PR when you get a chance so this can be closed.

[gkowalski-google]

@kevensen Can you confirm the PR linked will resolve this issue? If so, we can get it over the finish line.