Added a variant of the test that uses HashiCorp Vault to manage te

Certificate Authorities.

make_wif.sh

@@ -49,50 +49,13 @@ gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
     --member="serviceAccount:${SA_EMAIL}" \
     --role=roles/storage.objectUser
 
-# Enable Data Access audit logs for Cloud Storage (project-wide, not per bucket)
-gcloud projects get-iam-policy "${PROJECT_ID}" --format=yaml > iam_policy.yaml
-node add_audit_config.mjs
-gcloud projects set-iam-policy "${PROJECT_ID}" iam_policy.yaml
-
-# Create a new gcloud configuration for the workload identity federation test
-gcloud config configurations create wif-test
-
-# Authenticate gcloud with the credentials configuration file
-gcloud auth login --cred-file=cred.json
-
-# Set the project
-gcloud config set project "${PROJECT_ID}"
-
-# Test the authentication by listing the project details
-gcloud auth list
-gcloud projects describe "${PROJECT_ID}"
-gcloud projects get-iam-policy "${PROJECT_ID}" \
-    --flatten="bindings[].members" \
-    --format="table(bindings.role, bindings.members)"
-
-# Test the bucket access by uploading and downloading a file
-gcloud storage ls "gs://${BUCKET}"
-gcloud storage cp README.md "gs://${BUCKET}/README.md"
-gcloud storage ls "gs://${BUCKET}"
-gcloud storage cp "gs://${BUCKET}/README.md" README.downloaded.md
-cmp README.md README.downloaded.md
-
-# Then, switch back to your original account
-gcloud config configurations activate default
-
 # Create a managed folder and make the objects in it publicly readable
 gcloud storage managed-folders create "gs://${BUCKET}/public/"
 gcloud storage managed-folders add-iam-policy-binding "gs://${BUCKET}/public/" \
     --member=allUsers \
     --role=roles/storage.objectViewer
 
-# List the audit log of the operations made by the service account
-gcloud logging read \
-    "protoPayload.authenticationInfo.principalEmail=\"${SA_EMAIL}\"" \
-    --project="${PROJECT_ID}" \
-    --freshness=1h \
-    --order=asc \
-    --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName, protoPayload.authenticationInfo.principalEmail:label=EMAIL, protoPayload.authenticationInfo.principalSubject:label=SUBJECT, protoPayload.authenticationInfo.serviceAccountDelegationInfo[0].principalSubject:label=DELEGATED_BY)"
-
-# optionally switch back to the service account for further testing
-# gcloud config configurations activate wif-test
+# Enable Data Access audit logs for Cloud Storage (project-wide, not per bucket)
+gcloud projects get-iam-policy "${PROJECT_ID}" --format=yaml > iam_policy.yaml
+node add_audit_config.mjs
+gcloud projects set-iam-policy "${PROJECT_ID}" iam_policy.yaml