diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..26cb7ba --- /dev/null +++ b/.gitignore @@ -0,0 +1,38 @@ +# Local .terraform directories +**/.terraform/* + +# .tfstate files +*.tfstate +*.tfstate.* +.terraform.lock.hcl + +# Crash log files +crash.log +crash.*.log + +# Exclude all .tfvars files, which are likely to contain sensitive data, such as +# password, private keys, and other secrets. These should not be part of version +# control as they are data points which are potentially sensitive and subject +# to change depending on the environment. +*.tfvars +*.tfvars.json + +# Ignore override files as they are usually used to override resources locally and so +# are not checked in +override.tf +override.tf.json +*_override.tf +*_override.tf.json + +# Include override files you do wish to add to version control using negated pattern +# !example_override.tf + +# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan +# example: *tfplan* + +# Ignore CLI configuration files +.terraformrc +terraform.rc + +**/.DS_Store +.DS_Store diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..c61b663 --- /dev/null +++ b/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + +Copyright [yyyy] [name of copyright owner] + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/README.md b/README.md new file mode 100644 index 0000000..1ab9106 --- /dev/null +++ b/README.md @@ -0,0 +1,51 @@ +## customer-workload-identity-federation + +This repo provides terraform code for customers looking to implement Google Cloud connector support for the Bishop Fox Cosmos platform. + +There is a dependency on Workload Identity Federation (WIF) being enabled inside the designated project and _values.tfvars_ or env variables must be filled out with values for the following variables: + +- _projectID_ +- _projectNumber_ + +Run the following command in order to retrive the current project number: + +```bash +gcloud projects describe $(gcloud config get-value core/project) --format=value\(projectNumber\) +``` + +**Bishop Fox** will provide the customer with the following variable values: + +- AWS_accountID +- AWS_iamRole1 +- AWS_iamRole2 + +Once the Workload Identity Pool, Workload Identity Pool AWS provider and [Connected] Service Account are provisioned you can add the service account as a principal with _Compute Viewer role_ to IAM permissions of one or more GCP projects, at the folder-level or at the organization-level. + +The customer also needs to provide Bishop Fox with the WIF credentials file that is exported using the following command: + +```bash +gcloud iam workload-identity-pools create-cred-config \ +projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID \ + --service-account=SERVICE_ACCOUNT_EMAIL \ + --aws \ + --enable-imdsv2 \ + --output-file=FILEPATH.json + +Replace the following values: +• PROJECT_NUMBER: The project number of the project that contains the workload identity pool +• POOL_ID: The ID of the workload identity pool, ex. bfidentitypool +• PROVIDER_ID: The ID of the workload identity pool provider, ex. bfawsprovider +• SERVICE_ACCOUNT_EMAIL: The email address of the service account +• FILEPATH: The file to save configuration to +``` + +Lastly, Bishop Fox requires the customer GCP Organization ID which can be retrieved using the following command: + +```bash +gcloud organizations list +``` + +--- + +For more information about Workload Identity Federation best practices and requirements please see: +https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds diff --git a/main.tf b/main.tf new file mode 100644 index 0000000..4743d44 --- /dev/null +++ b/main.tf @@ -0,0 +1,63 @@ + +resource "google_iam_workload_identity_pool" "bishopfox" { + description = "managed by terraform" + disabled = false + display_name = var.displayName + project = var.projectID + workload_identity_pool_id = var.poolID + timeouts { + create = null + delete = null + update = null + } +} + +resource "google_iam_workload_identity_pool_provider" "bishopfox" { + attribute_condition = null + attribute_mapping = { + "attribute.account" = "assertion.account" + "attribute.aws_role" = "assertion.arn.extract('assumed-role/{role}/')" + "google.subject" = "assertion.arn" + } + description = "managed by terraform" + disabled = false + display_name = null + project = var.projectID + workload_identity_pool_id = var.poolID + workload_identity_pool_provider_id = var.providerID + aws { + account_id = var.AWS_accountID + } + timeouts { + create = null + delete = null + update = null + } + depends_on = [google_iam_workload_identity_pool.bishopfox] +} + +resource "google_service_account" "bishopfox" { + account_id = var.serviceAccountID + description = "managed by terraform" + disabled = false + display_name = var.serviceAccountDisplayName + project = var.projectID + timeouts { + create = null + } +} + +resource "google_service_account_iam_policy" "bishopfox" { + policy_data = "{\"bindings\":[{\"members\":[\"principalSet://iam.googleapis.com/projects/${var.projectNumber}/locations/global/workloadIdentityPools/${var.poolID}/*\",\"principalSet://iam.googleapis.com/projects/${var.projectNumber}/locations/global/workloadIdentityPools/${var.poolID}/attribute.aws_role/${var.AWS_iamRole1}\",\"principalSet://iam.googleapis.com/projects/${var.projectNumber}/locations/global/workloadIdentityPools/${var.poolID}/attribute.aws_role/${var.AWS_iamRole2}\"],\"role\":\"roles/iam.workloadIdentityUser\"}]}" + service_account_id = google_service_account.bishopfox.id + depends_on = [google_service_account.bishopfox] +} + + + + + + + + + diff --git a/outputs.tf b/outputs.tf new file mode 100644 index 0000000..8e78384 --- /dev/null +++ b/outputs.tf @@ -0,0 +1,18 @@ +output "workload_identity_pool" { + value = google_iam_workload_identity_pool.bishopfox.name + description = "Workload Identity Pool ID" + sensitive = false +} + +output "workload_identity_pool_provider" { + value = google_iam_workload_identity_pool_provider.bishopfox.name + description = "Workload Identity Pool Provider Name" + sensitive = false +} + +output "service_account" { + value = google_service_account.bishopfox.email + description = "WIF Service Account" + sensitive = false +} + diff --git a/variables.tf b/variables.tf new file mode 100644 index 0000000..377b51c --- /dev/null +++ b/variables.tf @@ -0,0 +1,55 @@ +variable "projectID" { + description = "This is the project ID of the project containing Workload Identity Federation" + type = string +} + +variable "projectNumber" { + description = "This is the project number of the project containing Workload Identity Federation" + type = string +} + +variable "poolID" { + description = "This is the ID of the Workload Identity Federation identity pool" + type = string + default = "bfidentitypool" +} + +variable "displayName" { + description = "This is the display name of the Workload Identity Federation pool" + type = string + default = "bishopfoxidentitypool" +} + +variable "providerID" { + description = "This is the ID of the Workload Identity Federation identity pool AWS provider" + type = string + default = "bfawsprovider" +} + +variable "AWS_accountID" { + description = "This is the ID of the Bishop Fox AWS account for the Workload Identity Federation identity pool AWS provider" + type = string +} + +variable "AWS_iamRole1" { + description = "This is the Bishop Fox IAM role for the Workload Identity Federation identity pool AWS provider" + type = string +} + +variable "AWS_iamRole2" { + description = "This is the Bishop Fox IAM role for the Workload Identity Federation identity pool AWS provider" + type = string +} + +variable "serviceAccountID" { + description = "This is the ID of the service account connected to the Workload Identity Federation identity pool" + type = string + default = "bfserviceaccount" +} + +variable "serviceAccountDisplayName" { + description = "This is the display name of the Workload Identity Federation pool" + type = string + default = "BF_Service_Account" +} +