✨ [DO NOT MERGE] Return full GCP IAM policy instead of just bindings #824
Conversation
resources/packs/gcp/gcp.lr
Outdated
| // Cloud audit logging configuration | ||
| auditConfigs []dict | ||
| // List of bindings associating lists of members, or principals, to roles | ||
| bindings []gcp.resourcemanager.binding |
There was a problem hiding this comment.
you should consider renaming gcp.resourcemanager.binding. It feels like it should be under iam
There was a problem hiding this comment.
In their own definitions it's under resourcemanager and that's why I kept it. I could map it to iam for us, since I agree it makes more sense
imilchev
changed the title
|
After this PR has been released quickly release those two PRs to avoid breaking queries: |
Signed-off-by: Ivan Milchev <[email protected]>
Signed-off-by: Ivan Milchev <[email protected]>
Signed-off-by: Ivan Milchev <[email protected]>
imilchev
force-pushed
the
ivan/gcp-iam-policy
branch
from
86c1c30 to
54efc47
Compare
There was a problem hiding this comment.
Thank you for the prototype and for exploring options. I do not think this is the right way forward. The current implementation has two main disadvantages:
- The resource definition is not inline with all the other services and iam policies should be under the iam service
- it breaks existing users, it would only be acceptable if it is the right move
Therefore this implementation breaks users and is not the right way moving forward. Instead I propose the following:
// GCP IAM Resources
private gcp.project.iamService {
// Project ID
projectId string
// List of service accounts
serviceAccounts() []gcp.project.iamService.serviceAccount
// List of policies
policy gcp.iam.policy
}
gcp.iam.policy {
// Policy ID
id string
// Project ID
projectId string
// Policy name
name string
// Creation timestamp
created time
// Last update timestamp
updated time
// Policy version
version int
}Note that this is not the full lr file and just illustrates where things belong. We should also use the proper iam policy api call then:
import (
iamv2 "cloud.google.com/go/iam/apiv2"
iamv2pb "google.golang.org/genproto/googleapis/iam/v2"
)
func (g *mqlGcpProjectIamService) GetPolicy() (interface{}, error) {
...
policiesSvc, err := iamv2.NewPoliciesClient(ctx, option.WithCredentials(creds))
if err != nil {
return nil, err
}
defer policiesSvc.Close()
policyObj := policiesSvc.GetPolicy(ctx, &iamv2pb.GetPolicyRequest{})
}This way has a few advantage:
- we call the right list policies call and get potentially multiple policies
- users have full access to the policy object
The old gcp.project.iamPolicy should stay as is and should be deprecated with the new implementation so that it can be fully removed in v9.
|
The confusing bit for me is the following. If we take as an example the The API we want to use for listing policies is iam/v2.Policy. They come from different packages and they seem completely different. One thing I know is that for the CIS GCP policy we require some checks on the Also one returns |
Updated for: