Support context security groups

[AlexanderMann]

Motivation

One problem we're definitely seeing is a 🐔 and 🥚 security constraint around protecting Contexts in CCI. Our team use this provider to auto populate/generate Contexts in CCI with Service Account tokens generated from elsewhere in Terraform land.

Locking those Contexts down is currently a manual thing we have to do ourselves very quickly after running this. Since there's a non-zero time when the Context is unprotected and an escalation of privileges attack is there for a bit. Especially, if we forget to do it immediately, the attack surface area is much larger.

Notes

We tinkered with the CCI (unsupported 🙄 ) GraphQL API and were able to reconstruct the basic requests necessary to get everything working, just haven't had the time (yet) to translate everything into Go.

Add Security Group

Get Security Groups and provide mapping from name: id

query: "query Context($contextId: ID!) {
  context(id: $contextId) {
    id
    resources {
      createdAt
      truncatedValue
      variable
    }
    groups {
      edges {
        node {
          id
          name
        }
      }
    }
    owner {
      ... on Organization {
        id
        groups {
          edges {
            node {
              id
              name
            }
          }
        }
      }
    }
    name
  }
}

Suggested Musical Pairing

https://soundcloud.com/dragonette/martin-solveig-dragonette-hello

[bendrucker]

Would be good to put a request to Circle about adding this to the official API. If it's not already requested on https://discuss.circleci.com you could mention there.

PR welcome using the GraphQL API, as long as the docs mention the potential for unannounced breaking changes.

[AlexanderMann]

⬆️ yeah, preach. There's chatter about wanting this feature for a while. I think having something out there actually using it is prolly the best way to actually get folks there working on it.

[AlexanderMann]

• https://discuss.circleci.com/t/automate-your-api-key-rotation-using-the-contexts-rest-api/39540/2
• https://circleci.canny.io/api-feature-requests/p/allow-context-restrictions-to-be-set-via-api