kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move FAST security delegated admins to iam_bindings_additive

Browse Source
This commit is contained in:
Julio Castillo
2023-09-16 19:55:37 +02:00
parent 9c878dc9cf
commit 121598dbea
3 changed files with 31 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
fast/stages/2-security/core-dev.tf
View File

@@ -33,6 +33,12 @@ module "dev-sec-project" {
iam = {
"roles/cloudkms.viewer" = local.dev_kms_restricted_admins
}
iam_bindings_additive = {
for member in local.dev_kms_restricted_admins :
"kms_restricted_admin.${member}" => merge(local.kms_restricted_admin_template, {
member = member
})
}
labels = { environment = "dev", team = "security" }
services = local.project_services
}
@@ -47,24 +53,3 @@ module "dev-sec-kms" {
}
keys = local.kms_locations_keys[each.key]
}
# TODO(ludo): add support for conditions to Fabric modules
resource "google_project_iam_member" "dev_key_admin_delegated" {
for_each = toset(local.dev_kms_restricted_admins)
project = module.dev-sec-project.project_id
role = "roles/cloudkms.admin"
member = each.key
condition {
title = "kms_sa_delegated_grants"
description = "Automation service account delegated grants."
expression = format(
"api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([%s]) && resource.type == 'cloudkms.googleapis.com/CryptoKey'",
join(",", formatlist("'%s'", [
"roles/cloudkms.cryptoKeyEncrypterDecrypter",
"roles/cloudkms.cryptoKeyEncrypterDecrypterViaDelegation"
]))
)
}
depends_on = [module.dev-sec-project]
}

27
fast/stages/2-security/core-prod.tf
View File

@@ -32,6 +32,12 @@ module "prod-sec-project" {
iam = {
"roles/cloudkms.viewer" = local.prod_kms_restricted_admins
}
iam_bindings_additive = {
for member in local.prod_kms_restricted_admins :
"kms_restricted_admin.${member}" => merge(local.kms_restricted_admin_template, {
member = member
})
}
labels = { environment = "prod", team = "security" }
services = local.project_services
}
@@ -46,24 +52,3 @@ module "prod-sec-kms" {
}
keys = local.kms_locations_keys[each.key]
}
# TODO(ludo): add support for conditions to Fabric modules
resource "google_project_iam_member" "prod_key_admin_delegated" {
for_each = toset(local.prod_kms_restricted_admins)
project = module.prod-sec-project.project_id
role = "roles/cloudkms.admin"
member = each.key
condition {
title = "kms_sa_delegated_grants"
description = "Automation service account delegated grants."
expression = format(
"api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([%s]) && resource.type == 'cloudkms.googleapis.com/CryptoKey'",
join(",", formatlist("'%s'", [
"roles/cloudkms.cryptoKeyEncrypterDecrypter",
"roles/cloudkms.cryptoKeyEncrypterDecrypterViaDelegation"
]))
)
}
depends_on = [module.prod-sec-project]
}

19
fast/stages/2-security/main.tf
View File

@@ -15,6 +15,25 @@
*/
locals {
# additive IAM binding for delegated KMS admins
kms_restricted_admin_template = {
role = "roles/cloudkms.admin"
condition = {
title = "kms_sa_delegated_grants"
description = "Automation service account delegated grants."
expression = format(
<<-EOT
api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([%s]) &&
resource.type == 'cloudkms.googleapis.com/CryptoKey'
EOT
, join(",", formatlist("'%s'", [
"roles/cloudkms.cryptoKeyEncrypterDecrypter",
"roles/cloudkms.cryptoKeyEncrypterDecrypterViaDelegation"
]))
)
}
}
# list of locations with keys
kms_locations = distinct(flatten([
for k, v in var.kms_keys : v.locations