-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
gcp: Add p0_gcp_organization_iam_assessment (#35)
This supports the new organization-level IAM assessment component in P0 GCP.
- Loading branch information
Showing
7 changed files
with
265 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| --- | ||
| # generated by https://github.com/hashicorp/terraform-plugin-docs | ||
| page_title: "p0_gcp_organization_iam_assessment Resource - p0" | ||
| subcategory: "" | ||
| description: |- | ||
| An installation of P0, on an entire Google Cloud organization, for IAM assessment. | ||
| To use this resource, you must also: | ||
| create a custom role allowing IAM-assessment operations, andgrant this custom role to P0's service account. | ||
| Use the read-only attributes defined on p0_gcp to create the requisite Google Cloud infrastructure. | ||
| P0 recommends defining this infrastructure according to the example usage pattern. | ||
| --- | ||
|
|
||
| # p0_gcp_organization_iam_assessment (Resource) | ||
|
|
||
| An installation of P0, on an entire Google Cloud organization, for IAM assessment. | ||
|
|
||
| To use this resource, you must also: | ||
| - create a custom role allowing IAM-assessment operations, and | ||
| - grant this custom role to P0's service account. | ||
|
|
||
| Use the read-only attributes defined on `p0_gcp` to create the requisite Google Cloud infrastructure. | ||
|
|
||
| P0 recommends defining this infrastructure according to the example usage pattern. | ||
|
|
||
| ## Example Usage | ||
|
|
||
| ```terraform | ||
| resource "p0_gcp" "example" { | ||
| organization_id = "my_gcp_organization_id" | ||
| } | ||
| # This role grants P0 access to analyze your organization's IAM configuration and asset inventory | ||
| resource "google_organization_iam_custom_role" "example" { | ||
| org_id = p0_gcp.organization_id | ||
| role_id = "p0IamAssessor" | ||
| title = "P0 IAM assessor" | ||
| description = "Integration role for org-wide P0 IAM assessment integration" | ||
| permissions = concat( | ||
| p0_gcp.example.iam_assessment.permissions.project, | ||
| p0_gcp.example.iam_assessment.permissions.organization | ||
| ) | ||
| } | ||
| resource "google_organization_iam_member" "example" { | ||
| org_id = p0_gcp.example.organization_id | ||
| role = google_organization_iam_custom_role.example.id | ||
| member = "serviceAccount:${p0_gcp.gcp.service_account_email}" | ||
| } | ||
| # The `p0_gcp_organization_iam_assessment` resource will fail to validate unless it is installed | ||
| # _after_ the P0 service account is granted the above role | ||
| resource "p0_gcp_organization_iam_assessment" "example" { | ||
| depends_on = [google_organization_iam_member.example] | ||
| } | ||
| ``` | ||
|
|
||
| <!-- schema generated by tfplugindocs --> | ||
| ## Schema | ||
|
|
||
| ### Read-Only | ||
|
|
||
| - `state` (String) This item's install progress in the P0 application: | ||
| - 'stage': The item has been staged for installation | ||
| - 'configure': The item is available to be added to P0, and may be configured | ||
| - 'installed': The item is fully installed |
27 changes: 27 additions & 0 deletions
27
examples/resources/p0_gcp_organization_iam_assessment/resource.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| resource "p0_gcp" "example" { | ||
| organization_id = "my_gcp_organization_id" | ||
| } | ||
|
|
||
| # This role grants P0 access to analyze your organization's IAM configuration and asset inventory | ||
| resource "google_organization_iam_custom_role" "example" { | ||
| org_id = p0_gcp.organization_id | ||
| role_id = "p0IamAssessor" | ||
| title = "P0 IAM assessor" | ||
| description = "Integration role for org-wide P0 IAM assessment integration" | ||
| permissions = concat( | ||
| p0_gcp.example.iam_assessment.permissions.project, | ||
| p0_gcp.example.iam_assessment.permissions.organization | ||
| ) | ||
| } | ||
|
|
||
| resource "google_organization_iam_member" "example" { | ||
| org_id = p0_gcp.example.organization_id | ||
| role = google_organization_iam_custom_role.example.id | ||
| member = "serviceAccount:${p0_gcp.gcp.service_account_email}" | ||
| } | ||
|
|
||
| # The `p0_gcp_organization_iam_assessment` resource will fail to validate unless it is installed | ||
| # _after_ the P0 service account is granted the above role | ||
| resource "p0_gcp_organization_iam_assessment" "example" { | ||
| depends_on = [google_organization_iam_member.example] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
99 changes: 99 additions & 0 deletions
99
internal/provider/resources/install/gcp/org_iam_assessment.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| package installgcp | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| "github.com/hashicorp/terraform-plugin-framework/diag" | ||
| "github.com/hashicorp/terraform-plugin-framework/path" | ||
| "github.com/hashicorp/terraform-plugin-framework/resource" | ||
| "github.com/hashicorp/terraform-plugin-framework/resource/schema" | ||
| "github.com/hashicorp/terraform-plugin-framework/types" | ||
| "github.com/p0-security/terraform-provider-p0/internal" | ||
| installresources "github.com/p0-security/terraform-provider-p0/internal/provider/resources/install" | ||
| ) | ||
|
|
||
| // Ensure provider defined types fully satisfy framework interfaces. | ||
| var _ resource.Resource = &GcpOrgIamAssessment{} | ||
| var _ resource.ResourceWithImportState = &GcpOrgIamAssessment{} | ||
| var _ resource.ResourceWithConfigure = &GcpOrgIamAssessment{} | ||
|
|
||
| func NewGcpOrgIamAssessment() resource.Resource { | ||
| return &GcpOrgIamAssessment{} | ||
| } | ||
|
|
||
| type GcpOrgIamAssessment struct { | ||
| installer *installresources.Install | ||
| } | ||
|
|
||
| type gcpOrgIamAssessmentModel struct { | ||
| State types.String `tfsdk:"state"` | ||
| } | ||
|
|
||
| func (r *GcpOrgIamAssessment) Metadata(ctx context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) { | ||
| resp.TypeName = req.ProviderTypeName + "_gcp_organization_iam_assessment" | ||
| } | ||
|
|
||
| func (r *GcpOrgIamAssessment) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) { | ||
| resp.Schema = schema.Schema{ | ||
| MarkdownDescription: `An installation of P0, on an entire Google Cloud organization, for IAM assessment. | ||
| To use this resource, you must also: | ||
| - create a custom role allowing IAM-assessment operations, and | ||
| - grant this custom role to P0's service account. | ||
| Use the read-only attributes defined on ` + "`p0_gcp`" + ` to create the requisite Google Cloud infrastructure. | ||
| P0 recommends defining this infrastructure according to the example usage pattern.`, | ||
| Attributes: map[string]schema.Attribute{ | ||
| "state": stateAttribute, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func (r *GcpOrgIamAssessment) fromJson(ctx context.Context, diags *diag.Diagnostics, id string, json any) any { | ||
| data := gcpOrgIamAssessmentModel{} | ||
| jsonv, ok := json.(*gcpItemJson) | ||
| if !ok { | ||
| return nil | ||
| } | ||
|
|
||
| data.State = types.StringValue(jsonv.State) | ||
|
|
||
| return &data | ||
| } | ||
|
|
||
| func (r *GcpOrgIamAssessment) Configure(ctx context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) { | ||
| providerData := internal.Configure(&req, resp) | ||
| r.installer = &installresources.Install{ | ||
| Integration: GcpKey, | ||
| Component: OrgIamAssessment, | ||
| ProviderData: providerData, | ||
| GetId: singletonGetId, | ||
| GetItemJson: itemGetItemJson, | ||
| FromJson: r.fromJson, | ||
| ToJson: itemToJson, | ||
| } | ||
| } | ||
|
|
||
| func (s *GcpOrgIamAssessment) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) { | ||
| var model gcpOrgIamAssessmentModel | ||
| var json gcpItemApi | ||
| s.installer.Stage(ctx, &resp.Diagnostics, &req.Plan, &resp.State, &json, &model) | ||
| s.installer.UpsertFromStage(ctx, &resp.Diagnostics, &req.Plan, &resp.State, &json, &model) | ||
| } | ||
|
|
||
| func (s *GcpOrgIamAssessment) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) { | ||
| s.installer.Read(ctx, &resp.Diagnostics, &resp.State, &gcpItemApi{}, &gcpOrgIamAssessmentModel{}) | ||
| } | ||
|
|
||
| func (s *GcpOrgIamAssessment) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) { | ||
| s.installer.Delete(ctx, &resp.Diagnostics, &req.State, &gcpOrgIamAssessmentModel{}) | ||
| } | ||
|
|
||
| func (s *GcpOrgIamAssessment) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) { | ||
| s.installer.UpsertFromStage(ctx, &resp.Diagnostics, &req.Plan, &resp.State, &gcpItemApi{}, &gcpOrgIamAssessmentModel{}) | ||
| } | ||
|
|
||
| func (s *GcpOrgIamAssessment) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) { | ||
| resource.ImportStatePassthroughID(ctx, path.Empty(), req, resp) | ||
| } |