Skip to content

Commit

Permalink
gcp secret manager
Browse files Browse the repository at this point in the history
  • Loading branch information
@JamesWoolfenden
JamesWoolfenden committed Oct 9, 2023
1 parent 673baf1 commit 6253177
Show file tree
Hide file tree
Showing 23 changed files with 170 additions and 37 deletions.
13 changes: 3 additions & 10 deletions src/coverage/google.md
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# todo google

Resource percentage coverage 7.79
Resource percentage coverage 7.77
Datasource percentage coverage 30.42

./resource.ps1 google_access_context_manager_access_level
Expand All @@ -21,6 +21,7 @@ Datasource percentage coverage 30.42
./resource.ps1 google_alloydb_backup
./resource.ps1 google_alloydb_cluster
./resource.ps1 google_alloydb_instance
./resource.ps1 google_alloydb_user
./resource.ps1 google_api_gateway_api
./resource.ps1 google_api_gateway_api_config
./resource.ps1 google_api_gateway_api_config_iam_binding
Expand Down Expand Up @@ -319,6 +320,7 @@ Datasource percentage coverage 30.42
./resource.ps1 google_data_loss_prevention_stored_info_type
./resource.ps1 google_data_pipeline_pipeline
./resource.ps1 google_database_migration_service_connection_profile
./resource.ps1 google_database_migration_service_private_connection
./resource.ps1 google_dataflow_flex_template_job
./resource.ps1 google_dataflow_job
./resource.ps1 google_dataform_repository
Expand Down Expand Up @@ -626,16 +628,12 @@ Datasource percentage coverage 30.42
./resource.ps1 google_project_iam_audit_config
./resource.ps1 google_project_iam_policy
./resource.ps1 google_project_organization_policy
./resource.ps1 google_project_service_identity
./resource.ps1 google_project_services
./resource.ps1 google_project_usage_export_bucket
./resource.ps1 google_public_ca_external_account_key
./resource.ps1 google_pubsub_subscription_iam_binding
./resource.ps1 google_pubsub_subscription_iam_member
./resource.ps1 google_pubsub_subscription_iam_policy
./resource.ps1 google_pubsub_topic_iam_binding
./resource.ps1 google_pubsub_topic_iam_member
./resource.ps1 google_pubsub_topic_iam_policy
./resource.ps1 google_recaptcha_enterprise_key
./resource.ps1 google_redis_cluster
./resource.ps1 google_redis_instance
Expand All @@ -654,11 +652,6 @@ Datasource percentage coverage 30.42
./resource.ps1 google_scc_source_iam_binding
./resource.ps1 google_scc_source_iam_member
./resource.ps1 google_scc_source_iam_policy
./resource.ps1 google_secret_manager_secret
./resource.ps1 google_secret_manager_secret_iam_binding
./resource.ps1 google_secret_manager_secret_iam_member
./resource.ps1 google_secret_manager_secret_iam_policy
./resource.ps1 google_secret_manager_secret_version
./resource.ps1 google_security_scanner_scan_config
./resource.ps1 google_service_directory_endpoint
./resource.ps1 google_service_directory_namespace
Expand Down
12 changes: 12 additions & 0 deletions src/files_gcp.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -165,3 +165,15 @@ var googlePubsubSchema []byte

//go:embed mapping/google/resource/pubsub/google_pubsub_subscription.json
var googlePubsubSubscription []byte

//go:embed mapping/google/resource/pubsub/google_pubsub_topic_iam_binding.json
var googlePubsubTopicIam []byte

//go:embed mapping/google/resource/secretmanager/google_secret_manager_secret.json
var googleSecretManagerSecret []byte

//go:embed mapping/google/resource/secretmanager/google_secret_manager_secret_iam_binding.json
var googleSecretManagerSecretIam []byte

//go:embed mapping/google/resource/secretmanager/google_secret_manager_secret_version.json
var googleSecretManagerSecretVersion []byte
29 changes: 19 additions & 10 deletions src/gcp.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,13 @@ func GCPLookup(result string) interface{} {
"google_bigquery_job": googleBigqueryJob,
"google_bigquery_table": placeholder,
"google_bigtable_instance": googleBigtableInstance,
"google_bigtable_instance_iam_binding": googleBigTableInstanceIam,
"google_bigtable_instance_iam_member": googleBigTableInstanceIam,
"google_bigtable_instance_iam_policy": googleBigTableInstanceIam,
"google_bigtable_table": googleBigtableTable,
"google_bigtable_table_iam_binding": googleBigTableTableIam,
"google_bigtable_table_iam_member": googleBigTableTableIam,
"google_bigtable_table_iam_policy": googleBigTableTableIam,
"google_cloudfunctions_function": googleCloudfunctionsFunction,
"google_cloudfunctions_function_iam_member": googleCloudfunctionsFunctionIamPolicy,
"google_cloudfunctions_function_iam_policy": googleCloudfunctionsFunctionIamPolicy,
Expand All @@ -80,10 +87,22 @@ func GCPLookup(result string) interface{} {
"google_project_iam_binding": googleProjectIamBinding,
"google_project_iam_custom_role": googleProjectIamCustomRole,
"google_project_iam_member": googleProjectIamBinding,
"google_project_service": googleProjectService,
"google_project_service_identity": placeholder,
"google_pubsub_lite_reservation": googlePubsubLiteReservation,
"google_pubsub_lite_subscription": googlePubsubLiteSubscription,
"google_pubsub_lite_topic": googlePubsubLiteTopic,
"google_pubsub_schema": googlePubsubSchema,
"google_pubsub_subscription": googlePubsubSubscription,
"google_pubsub_topic": googlePubsubTopic,
"google_pubsub_topic_iam_binding": googlePubsubTopicIam,
"google_pubsub_topic_iam_member": googlePubsubTopicIam,
"google_pubsub_topic_iam_policy": googlePubsubTopicIam,
"google_secret_manager_secret": googleSecretManagerSecret,
"google_secret_manager_secret_iam_binding": googleSecretManagerSecretIam,
"google_secret_manager_secret_iam_member": googleSecretManagerSecretIam,
"google_secret_manager_secret_iam_policy": googleSecretManagerSecretIam,
"google_secret_manager_secret_version": googleSecretManagerSecretVersion,
"google_service_account": googleServiceAccount,
"google_service_account_iam_binding": googleServiceAccountIamBinding,
"google_service_account_iam_member": googleServiceAccountIamMember,
Expand All @@ -98,16 +117,6 @@ func GCPLookup(result string) interface{} {
"google_storage_bucket_acl": googleStorageBucketACL,
"google_storage_bucket_iam_binding": googleStorageBucketIamBinding,
"google_storage_bucket_object": googleStorageBucketObject,
"google_bigtable_table": googleBigtableTable,
"google_bigtable_instance_iam_policy": googleBigTableInstanceIam,
"google_bigtable_instance_iam_member": googleBigTableInstanceIam,
"google_bigtable_instance_iam_binding": googleBigTableInstanceIam,
"google_bigtable_table_iam_binding": googleBigTableTableIam,
"google_bigtable_table_iam_member": googleBigTableTableIam,
"google_bigtable_table_iam_policy": googleBigTableTableIam,
"google_pubsub_schema": googlePubsubSchema,
"google_pubsub_subscription": googlePubsubSubscription,
"google_project_service": googleProjectService,
}

return TFLookup[result]
Expand Down
14 changes: 14 additions & 0 deletions src/mapping/google/resource/pubsub/google_pubsub_topic_iam_binding.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
[
{
"apply": [
"pubsub.topics.getIamPolicy",
"pubsub.topics.setIamPolicy"
],
"attributes": {
"tags": []
},
"destroy": [],
"modify": [],
"plan": []
}
]
22 changes: 22 additions & 0 deletions src/mapping/google/resource/secretmanager/google_secret_manager_secret.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
[
{
"apply": [
"secretmanager.secrets.create",
"secretmanager.secrets.get",
"secretmanager.secrets.update",
"secretmanager.secrets.delete"
],
"attributes": {
"tags": []
},
"destroy": [
"secretmanager.secrets.delete"
],
"modify": [
"secretmanager.secrets.update"
],
"plan": [
"secretmanager.secrets.get"
]
}
]
14 changes: 14 additions & 0 deletions src/mapping/google/resource/secretmanager/google_secret_manager_secret_iam_binding.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
[
{
"apply": [
"secretmanager.secrets.getIamPolicy",
"secretmanager.secrets.setIamPolicy"
],
"attributes": {
"tags": []
},
"destroy": [],
"modify": [],
"plan": []
}
]
21 changes: 21 additions & 0 deletions src/mapping/google/resource/secretmanager/google_secret_manager_secret_version.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
[
{
"apply": [
"secretmanager.versions.add",
"secretmanager.versions.enable",
"secretmanager.versions.get",
"secretmanager.versions.access",
"secretmanager.versions.destroy"
],
"attributes": {
"tags": []
},
"destroy": [
"secretmanager.versions.destroy"
],
"modify": [],
"plan": [
"secretmanager.versions.get"
]
}
]
2 changes: 1 addition & 1 deletion terraform/google/backup/google_artifact_registry_repository_iam_binding.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,6 @@ resource "google_artifact_registry_repository_iam_binding" "pike" {
role = "roles/artifactregistry.reader"
members = [
"user:james.woolfenden@gmail.com",
"user:crwoolfenden@gmail.com"
"user:anonymous@gmail.com"
]
}
2 changes: 1 addition & 1 deletion terraform/google/backup/google_artifact_registry_repository_iam_member.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ resource "google_artifact_registry_repository_iam_member" "pike" {
location = google_artifact_registry_repository.pike.location
repository = google_artifact_registry_repository.pike.name
role = "roles/artifactregistry.reader"
member = "user:crwoolfenden@gmail.com"
member = "user:anonymous@gmail.com"
}
2 changes: 1 addition & 1 deletion terraform/google/backup/google_artifact_registry_repository_iam_policy.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ data "google_iam_policy" "admin" {
role = "roles/artifactregistry.reader"
members = [
"user:james.woolfenden@gmail.com",
"user:crwoolfenden@gmail.com",
"user:anonymous@gmail.com",
]
}
}
Expand Down
2 changes: 1 addition & 1 deletion terraform/google/backup/google_bigtable_table_iam_binding.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ data "google_iam_policy" "admin" {
binding {
role = "roles/bigtable.user"
members = [
"user:crwoolfenden@gmail.com",
"user:anonymous@gmail.com",
]
}
}
Expand Down
12 changes: 12 additions & 0 deletions terraform/google/backup/google_project_service_identity.tf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
data "google_project" "project" {}

resource "google_project_service_identity" "hc_sa" {
provider = google-beta

project = data.google_project.project.project_id
service = "healthcare.googleapis.com"
}

output "identity" {
value = google_project_service_identity.hc_sa
}
1 change: 1 addition & 0 deletions terraform/google/backup/google_pubsub_topic_iam_binding.tf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
resource "google_pubsub_topic_iam_binding" "pike" {}
5 changes: 5 additions & 0 deletions terraform/google/backup/google_pubsub_topic_iam_member.tf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
resource "google_pubsub_topic_iam_member" "pike" {
topic = "projects/pike-gcp/topics/pike"
member = "user:anonymous@gmail.com"
role = "roles/viewer"
}
1 change: 1 addition & 0 deletions terraform/google/backup/google_pubsub_topic_iam_policy.tf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
resource "google_pubsub_topic_iam_policy" "pike" {}
11 changes: 11 additions & 0 deletions terraform/google/backup/google_secret_manager_secret.tf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
resource "google_secret_manager_secret" "pike" {
secret_id = "secret-version"

labels = {
label = "my-label"
}

replication {
auto {}
}
}
1 change: 1 addition & 0 deletions terraform/google/backup/google_secret_manager_secret_iam_binding.tf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
resource "google_secret_manager_secret_iam_binding" "pike" {}
5 changes: 5 additions & 0 deletions terraform/google/backup/google_secret_manager_secret_iam_member.tf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
resource "google_secret_manager_secret_iam_member" "pike" {
member = "user:anonymous@gmail.com"
secret_id = google_secret_manager_secret.pike.id
role = "roles/secretmanager.secretAccessor"
}
1 change: 1 addition & 0 deletions terraform/google/backup/google_secret_manager_secret_iam_policy.tf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
resource "google_secret_manager_secret_iam_policy" "pike" {}
4 changes: 4 additions & 0 deletions terraform/google/backup/google_secret_manager_secret_version.tf
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
resource "google_secret_manager_secret_version" "pike" {
secret_data = "mysecret"
secret = google_secret_manager_secret.pike.id
}
2 changes: 1 addition & 1 deletion terraform/google/backup/google_service_account_iam_binding.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,6 @@ resource "google_service_account_iam_binding" "admin-account-iam" {
role = "roles/iam.serviceAccountUser"

members = [
"user:crwoolfenden@gmail.com",
"user:anonymous@gmail.com",
]
}
2 changes: 1 addition & 1 deletion terraform/google/backup/google_service_account_iam_member.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,5 @@ resource "google_service_account" "sa" {
resource "google_service_account_iam_member" "pike" {
service_account_id = google_service_account.sa.name
role = "roles/iam.serviceAccountUser"
member = "user:crwoolfenden@gmail.com"
member = "user:anonymous@gmail.com"
}
29 changes: 18 additions & 11 deletions terraform/google/role/google_project_iam_custom_role.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,20 +4,27 @@ resource "google_project_iam_custom_role" "pike" {
title = "pike terraform user"
description = "A user with least privileges"
permissions = [

//google_project_service
"serviceusage.services.get",
"serviceusage.services.list",
"serviceusage.services.enable",
"serviceusage.services.disable",

"resourcemanager.projects.get",
# "iam.serviceAccounts.list",
# "iam.serviceAccounts.setIamPolicy",
# "iam.serviceAccounts.getIamPolicy",
# "iam.serviceAccounts.undelete"

//google_pubsub_topic_iam_member
"pubsub.topics.getIamPolicy",
"pubsub.topics.setIamPolicy",

//google_secret_manager_secret
"secretmanager.secrets.create",
"secretmanager.secrets.get",
"secretmanager.secrets.update",
"secretmanager.secrets.delete",

//google_secret_manager_secret_iam_member
"secretmanager.secrets.getIamPolicy",
"secretmanager.secrets.setIamPolicy",

//google_secret_manager_secret_version
"secretmanager.versions.add",
"secretmanager.versions.enable",
"secretmanager.versions.get",
"secretmanager.versions.access",
"secretmanager.versions.destroy"
]
}

0 comments on commit 6253177

Please sign in to comment.