Added storage bucket tests.

.gitignore

@@ -4,3 +4,5 @@ node_modules/
 cred.json
 trust_store.yaml
 package-lock.json
+*.downloaded.md
+iam_policy.yaml

README.md

@@ -121,7 +121,7 @@ The PEM files must contain only the certificate block. A trailing newline after
 
 ## 3. Create the pool, provider and credentials
 
-The script creates the workload identity pool, the X.509 provider and a service account. It allows the client certificate subject to impersonate the service account, grants the service account read access to the project, and writes `cred.json`. It then logs in with `cred.json` and checks the access.
+The script creates the workload identity pool, the X.509 provider and a service account. It allows the client certificate subject to impersonate the service account, grants the service account read access to the project, creates a storage bucket with read and write access to its objects for the service account, and writes `cred.json`. It then logs in with `cred.json` and checks the access.
 
 ```bash
 # Create a workload identity pool and a X.509 provider
@@ -154,6 +154,17 @@ gcloud projects add-iam-policy-binding my-project \
     --member="serviceAccount:sa-test@my-project.iam.gserviceaccount.com" \
     --role=roles/browser
 
+# Create a storage bucket
+gcloud storage buckets create gs://my-project-wif-test \
+    --project=my-project \
+    --location=europe-central2 \
+    --uniform-bucket-level-access
+
+# Allow the service account to read and write objects in the bucket
+gcloud storage buckets add-iam-policy-binding gs://my-project-wif-test \
+    --member="serviceAccount:sa-test@my-project.iam.gserviceaccount.com" \
+    --role=roles/storage.objectUser
+
 # Create credentials configuration files
 gcloud iam workload-identity-pools create-cred-config \
     projects/123456789012/locations/global/workloadIdentityPools/my-pool/providers/my-x509 \

add_audit_config.mjs

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync } from "node:fs";
+import YAML from "yaml";
+
+const policy = YAML.parse(readFileSync("iam_policy.yaml", "utf8"));
+
+// Replace the Cloud Storage entry, if any, and keep the other audit configs.
+policy.auditConfigs = (policy.auditConfigs ?? []).filter(
+  (c) => c.service !== "storage.googleapis.com",
+);
+policy.auditConfigs.push({
+  service: "storage.googleapis.com",
+  auditLogConfigs: [{ logType: "DATA_READ" }, { logType: "DATA_WRITE" }],
+});
+
+writeFileSync("iam_policy.yaml", YAML.stringify(policy, { indentSeq: false }));

make_wif.sh

@@ -36,9 +36,31 @@ gcloud iam workload-identity-pools create-cred-config \
     --credential-cert-private-key-path=client_key.pem \
     --output-file=cred.json
 
+# Create a storage bucket
+gcloud storage buckets create gs://dom-lab-wif-test \
+    --project=dom-lab \
+    --location=europe-central2 \
+    --uniform-bucket-level-access
+
+# Allow the service account to read and write objects in the bucket
+gcloud storage buckets add-iam-policy-binding gs://dom-lab-wif-test \
+    --member="serviceAccount:sa-test@dom-lab.iam.gserviceaccount.com" \
+    --role=roles/storage.objectUser
+
+# Enable Data Access audit logs for Cloud Storage (project-wide, not per bucket)
+gcloud projects get-iam-policy dom-lab --format=yaml > iam_policy.yaml
+node add_audit_config.mjs
+gcloud projects set-iam-policy dom-lab iam_policy.yaml
+
+# Create a new gcloud configuration for the workload identity federation test
+gcloud config configurations create wif-test
+
 # Authenticate gcloud with the credentials configuration file
 gcloud auth login --cred-file=cred.json
 
+# Set the project to dom-lab
+gcloud config set project dom-lab
+
 # Test the authentication by listing the project details
 gcloud auth list
 gcloud projects describe dom-lab
@@ -46,8 +68,23 @@ gcloud projects get-iam-policy dom-lab \
     --flatten="bindings[].members" \
     --format="table(bindings.role, bindings.members)"
 
-# Then, switch back to your original account
+# Test the bucket access by uploading and downloading a file
-gcloud config set account adminslawek@gcp-lab.koszewscy.waw.pl
+gcloud storage ls gs://dom-lab-wif-test
+gcloud storage cp README.md gs://dom-lab-wif-test/README.md
+gcloud storage ls gs://dom-lab-wif-test
+gcloud storage cp gs://dom-lab-wif-test/README.md README.downloaded.md
+cmp README.md README.downloaded.md
 
-# and again switch back to the service account using the credentials configuration file
+# Then, switch back to your original account
-gcloud config set account sa-test@dom-lab.iam.gserviceaccount.com
+gcloud config configurations activate default
+
+# List the audit log of the operations made by the service account
+gcloud logging read \
+    'protoPayload.authenticationInfo.principalEmail="sa-test@dom-lab.iam.gserviceaccount.com"' \
+    --project=dom-lab \
+    --freshness=1h \
+    --order=asc \
+    --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName)"
+
+# and again switch back to the service account
+gcloud config configurations activate wif-test