storage resources

src/files_gcp.go

@@ -33,3 +33,9 @@ var googleKmsKeyRing []byte
 
 //go:embed  mapping/gcp/resource/cloudkms/google_kms_crypto_key.json
 var googleKmsCryptoKey []byte
+
+//go:embed  mapping/gcp/resource/storage/google_storage_bucket_acl.json
+var googleStorageBucketAcl []byte
+
+//go:embed  mapping/gcp/resource/storage/google_storage_bucket_iam_binding.json
+var googleStorageBucketIamBinding []byte

src/gcp.go

@@ -19,16 +19,18 @@ func GetGCPPermissions(result ResourceV2) []string {
 // GetGCPResourcePermissions looks up permissions required for resources
 func GetGCPResourcePermissions(result ResourceV2) []string {
 	TFLookup := map[string]interface{}{
-		"google_compute_instance":        googleComputeInstance,
-		"google_storage_bucket":          googleStorageBucket,
-		"google_storage_bucket_object":   googleStorageBucketObject,
-		"google_compute_network":         googleComputeNetwork,
-		"google_compute_address":         googleComputeAddress,
-		"google_compute_firewall":        googleComputeFirewall,
-		"google_project_iam_custom_role": googleProjectIamCustomRole,
-		"google_service_account":         googleServiceAccount,
-		"google_kms_crypto_key":          googleKmsCryptoKey,
-		"google_kms_key_ring":            googleKmsKeyRing,
+		"google_compute_instance":           googleComputeInstance,
+		"google_storage_bucket":             googleStorageBucket,
+		"google_storage_bucket_object":      googleStorageBucketObject,
+		"google_compute_network":            googleComputeNetwork,
+		"google_compute_address":            googleComputeAddress,
+		"google_compute_firewall":           googleComputeFirewall,
+		"google_project_iam_custom_role":    googleProjectIamCustomRole,
+		"google_service_account":            googleServiceAccount,
+		"google_kms_crypto_key":             googleKmsCryptoKey,
+		"google_kms_key_ring":               googleKmsKeyRing,
+		"google_storage_bucket_acl":         googleStorageBucketAcl,
+		"google_storage_bucket_iam_binding": googleStorageBucketIamBinding,
 	}
 
 	var Permissions []string

src/mapping/gcp/resource/storage/google_storage_bucket_acl.json

@@ -0,0 +1,15 @@
+[
+  {
+    "apply": [
+      "storage.buckets.get",
+      "storage.buckets.update",
+      "storage.buckets.setIamPolicy"
+    ],
+    "attributes": {
+      "tags": []
+    },
+    "destroy": [],
+    "modify": [],
+    "plan": []
+  }
+]

src/mapping/gcp/resource/storage/google_storage_bucket_iam_binding.json

@@ -0,0 +1,16 @@
+[
+  {
+    "apply": [
+      "storage.buckets.get",
+      "storage.buckets.update",
+      "storage.buckets.getIamPolicy",
+      "storage.buckets.setIamPolicy"
+    ],
+    "attributes": {
+      "tags": []
+    },
+    "destroy": [],
+    "modify": [],
+    "plan": []
+  }
+]

terraform/gcp/backup/google_storage_bucket_acl.bucket-acl.tf

@@ -0,0 +1,5 @@
+resource "google_storage_bucket_acl" "bucketacl" {
+  bucket = "test-bucket-jgw-today"
+
+  predefined_acl = "projectprivate"
+}

terraform/gcp/backup/google_storage_bucket_iam_binding.binding.tf

@@ -0,0 +1,9 @@
+resource "google_storage_bucket_iam_binding" "binding" {
+  bucket = "test-bucket-jgw-today"
+  role   = "roles/storage.admin"
+  members = [
+    "user:james.woolfenden@gmail.com",
+    "serviceAccount:pike-service@pike-361314.iam.gserviceaccount.com"
+  ]
+
+}

terraform/gcp/role/google_project_iam_custom_role.tf

@@ -4,6 +4,9 @@ resource "google_project_iam_custom_role" "pike" {
   title       = "pike terraform user"
   description = "A user with least privileges"
   permissions = [
-    "cloudkms.cryptoKeys.get"
+    "storage.buckets.get",
+    "storage.buckets.update",
+    "storage.buckets.getIamPolicy",
+    "storage.buckets.setIamPolicy"
   ]
 }

todo_gcp.md

@@ -26,6 +26,3 @@
  google_sql_database not implemented
  google_sql_database_instance not implemented
  google_sql_user not implemented
- google_storage_bucket_acl not implemented
- google_storage_bucket_acl not implemented
- google_storage_bucket_iam_binding not implemented