Added storage bucket tests.

make_wif.sh

@@ -36,9 +36,31 @@ gcloud iam workload-identity-pools create-cred-config \
     --credential-cert-private-key-path=client_key.pem \
     --output-file=cred.json
 
+# Create a storage bucket
+gcloud storage buckets create gs://dom-lab-wif-test \
+    --project=dom-lab \
+    --location=europe-central2 \
+    --uniform-bucket-level-access
+
+# Allow the service account to read and write objects in the bucket
+gcloud storage buckets add-iam-policy-binding gs://dom-lab-wif-test \
+    --member="serviceAccount:sa-test@dom-lab.iam.gserviceaccount.com" \
+    --role=roles/storage.objectUser
+
+# Enable Data Access audit logs for Cloud Storage (project-wide, not per bucket)
+gcloud projects get-iam-policy dom-lab --format=yaml > iam_policy.yaml
+node add_audit_config.mjs
+gcloud projects set-iam-policy dom-lab iam_policy.yaml
+
+# Create a new gcloud configuration for the workload identity federation test
+gcloud config configurations create wif-test
+
 # Authenticate gcloud with the credentials configuration file
 gcloud auth login --cred-file=cred.json
 
+# Set the project to dom-lab
+gcloud config set project dom-lab
+
 # Test the authentication by listing the project details
 gcloud auth list
 gcloud projects describe dom-lab
@@ -46,8 +68,23 @@ gcloud projects get-iam-policy dom-lab \
     --flatten="bindings[].members" \
     --format="table(bindings.role, bindings.members)"
 
-# Then, switch back to your original account
-gcloud config set account adminslawek@gcp-lab.koszewscy.waw.pl
+# Test the bucket access by uploading and downloading a file
+gcloud storage ls gs://dom-lab-wif-test
+gcloud storage cp README.md gs://dom-lab-wif-test/README.md
+gcloud storage ls gs://dom-lab-wif-test
+gcloud storage cp gs://dom-lab-wif-test/README.md README.downloaded.md
+cmp README.md README.downloaded.md
 
-# and again switch back to the service account using the credentials configuration file
-gcloud config set account sa-test@dom-lab.iam.gserviceaccount.com
+# Then, switch back to your original account
+gcloud config configurations activate default
+
+# List the audit log of the operations made by the service account
+gcloud logging read \
+    'protoPayload.authenticationInfo.principalEmail="sa-test@dom-lab.iam.gserviceaccount.com"' \
+    --project=dom-lab \
+    --freshness=1h \
+    --order=asc \
+    --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName)"
+
+# and again switch back to the service account
+gcloud config configurations activate wif-test