slawek/gcp-wif-test
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md - make it more readable.

Browse Source
This commit is contained in:
slawek committed 2026-10-17 11:23:00 +02:00
1 parent fa3c612668
commit 7f07e47138
1 file changed
+21 -3
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+21 -3
View File
@@ -40,7 +40,11 @@ The `.sh` files are meant as references for copying and pasting the commands one
## 1. Create the certificates ## 1. Create the certificates
`make_certs.sh` creates a root CA, an issuing CA and a client certificate. The client certificate subject CN (`test-client`) becomes the WiF subject. `make_certs.sh` performs the following steps:
1. Creates a root CA certificate and key (`ca_cert.pem`, `ca_key.pem`).
2. Creates an issuing CA certificate and key (`issuing_ca_cert.pem`, `issuing_ca_key.pem`), signed by the root CA.
3. Creates a client certificate and key (`client_cert.pem`, `client_key.pem`), signed by the issuing CA. Its subject CN (`test-client`) becomes the WiF subject.
```bash ```bash
bash make_certs.sh bash make_certs.sh
@@ -69,13 +73,27 @@ The PEM files must contain only the certificate block. A trailing newline after
## 3. Create the pool, provider and credentials ## 3. Create the pool, provider and credentials
`make_wif.sh` creates the workload identity pool, the X.509 provider and a service account. It allows the client certificate subject to impersonate the service account, grants the service account read access to the project, creates a storage bucket with read and write access to its objects for the service account, enables Data Access audit logs for Cloud Storage, and writes `cred.json`. It then logs in with `cred.json` in a separate gcloud configuration, checks the access, uploads and downloads a file, makes the public folder of the bucket publicly readable, and lists the audit log of the service account operations. `make_wif.sh` performs the following steps:
1. Creates the workload identity pool and the X.509 provider.
2. Creates a service account.
3. Allows the client certificate subject to impersonate the service account.
4. Grants the service account read access to the project.
5. Writes `cred.json`.
6. Creates a storage bucket and grants the service account read and write access to its objects.
7. Enables Data Access audit logs for Cloud Storage.
8. Creates a separate gcloud configuration and logs in with `cred.json`.
9. Checks the access to the project and the bucket, including an upload and a download of a file.
10. Switches back to the original gcloud configuration.
11. Makes the `public/` managed folder of the bucket publicly readable.
12. Lists the audit log of the service account operations.
13. Optionally switches back to the service account configuration.
```bash ```bash
bash make_wif.sh bash make_wif.sh
``` ```
Data Access audit logs are enabled for the whole project, not per bucket, by editing the project IAM policy. `add_audit_config.mjs` adds the `auditConfigs` section to the policy file fetched by gcloud. The policy must be fetched as YAML, because a different default gcloud output format makes `set-iam-policy` reject the file. Data Access audit logs are enabled for the whole project, not per bucket, by editing the project IAM policy. `add_audit_config.mjs` adds the `auditConfigs` section to the policy file fetched by gcloud.
The audit log lists only Cloud Storage operations of the service account. Resource Manager calls such as `projects describe` are not covered by the Data Access configuration. The audit log lists only Cloud Storage operations of the service account. Resource Manager calls such as `projects describe` are not covered by the Data Access configuration.