Removed personalized Google Cloud names from scripts and moved to a Git

ignored environment file.

make_wif.sh

@@ -1,56 +1,58 @@
+source ./env.sh
+
 # Create a workload identity pool and a X.509 provider
-gcloud iam workload-identity-pools create dom-lab-pool \
-  --project=dom-lab \
+gcloud iam workload-identity-pools create "${POOL_ID}" \
+  --project="${PROJECT_ID}" \
   --location=global \
-  --display-name="Dom Lab Pool"
+  --display-name="${POOL_DISPLAY_NAME}"
 
 # Create X.509 provider
-gcloud iam workload-identity-pools providers create-x509 dom-lab-x509 \
-  --project=dom-lab \
+gcloud iam workload-identity-pools providers create-x509 "${PROVIDER_ID}" \
+  --project="${PROJECT_ID}" \
   --location=global \
-  --workload-identity-pool=dom-lab-pool \
+  --workload-identity-pool="${POOL_ID}" \
   --trust-store-config-path=trust_store.yaml \
   --attribute-mapping="google.subject=assertion.subject.dn.cn"
 
 # Create the service account
 gcloud iam service-accounts create sa-test \
-  --project=dom-lab \
+  --project="${PROJECT_ID}" \
   --display-name="SA Test"
 
 # Allow impersonation of the service account
 gcloud iam service-accounts add-iam-policy-binding \
-    sa-test@dom-lab.iam.gserviceaccount.com \
+    "${SA_EMAIL}" \
     --role=roles/iam.workloadIdentityUser \
-    --member="principal://iam.googleapis.com/projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/subject/test-client"
+    --member="principal://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/subject/test-client"
 
 # Grant the service account read access to the project
-gcloud projects add-iam-policy-binding dom-lab \
-    --member="serviceAccount:sa-test@dom-lab.iam.gserviceaccount.com" \
+gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+    --member="serviceAccount:${SA_EMAIL}" \
     --role=roles/browser
 
 # Create credentials configuration files
 gcloud iam workload-identity-pools create-cred-config \
-    projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/providers/dom-lab-x509 \
-    --service-account=sa-test@dom-lab.iam.gserviceaccount.com \
+    "projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/providers/${PROVIDER_ID}" \
+    --service-account="${SA_EMAIL}" \
     --credential-cert-path=client_cert.pem \
     --credential-cert-private-key-path=client_key.pem \
     --output-file=cred.json
 
 # Create a storage bucket
-gcloud storage buckets create gs://dom-lab-wif-test \
-    --project=dom-lab \
-    --location=europe-central2 \
+gcloud storage buckets create "gs://${BUCKET}" \
+    --project="${PROJECT_ID}" \
+    --location="${BUCKET_LOCATION}" \
     --uniform-bucket-level-access
 
 # Allow the service account to read and write objects in the bucket
-gcloud storage buckets add-iam-policy-binding gs://dom-lab-wif-test \
-    --member="serviceAccount:sa-test@dom-lab.iam.gserviceaccount.com" \
+gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
+    --member="serviceAccount:${SA_EMAIL}" \
     --role=roles/storage.objectUser
 
 # Enable Data Access audit logs for Cloud Storage (project-wide, not per bucket)
-gcloud projects get-iam-policy dom-lab --format=yaml > iam_policy.yaml
+gcloud projects get-iam-policy "${PROJECT_ID}" --format=yaml > iam_policy.yaml
 node add_audit_config.mjs
-gcloud projects set-iam-policy dom-lab iam_policy.yaml
+gcloud projects set-iam-policy "${PROJECT_ID}" iam_policy.yaml
 
 # Create a new gcloud configuration for the workload identity federation test
 gcloud config configurations create wif-test
@@ -58,33 +60,39 @@ gcloud config configurations create wif-test
 # Authenticate gcloud with the credentials configuration file
 gcloud auth login --cred-file=cred.json
 
-# Set the project to dom-lab
-gcloud config set project dom-lab
+# Set the project
+gcloud config set project "${PROJECT_ID}"
 
 # Test the authentication by listing the project details
 gcloud auth list
-gcloud projects describe dom-lab
-gcloud projects get-iam-policy dom-lab \
+gcloud projects describe "${PROJECT_ID}"
+gcloud projects get-iam-policy "${PROJECT_ID}" \
     --flatten="bindings[].members" \
     --format="table(bindings.role, bindings.members)"
 
 # Test the bucket access by uploading and downloading a file
-gcloud storage ls gs://dom-lab-wif-test
-gcloud storage cp README.md gs://dom-lab-wif-test/README.md
-gcloud storage ls gs://dom-lab-wif-test
-gcloud storage cp gs://dom-lab-wif-test/README.md README.downloaded.md
+gcloud storage ls "gs://${BUCKET}"
+gcloud storage cp README.md "gs://${BUCKET}/README.md"
+gcloud storage ls "gs://${BUCKET}"
+gcloud storage cp "gs://${BUCKET}/README.md" README.downloaded.md
 cmp README.md README.downloaded.md
 
 # Then, switch back to your original account
 gcloud config configurations activate default
 
+# Create a managed folder and make the objects in it publicly readable
+gcloud storage managed-folders create "gs://${BUCKET}/public/"
+gcloud storage managed-folders add-iam-policy-binding "gs://${BUCKET}/public/" \
+    --member=allUsers \
+    --role=roles/storage.objectViewer
+
 # List the audit log of the operations made by the service account
 gcloud logging read \
-    'protoPayload.authenticationInfo.principalEmail="sa-test@dom-lab.iam.gserviceaccount.com"' \
-    --project=dom-lab \
+    "protoPayload.authenticationInfo.principalEmail=\"${SA_EMAIL}\"" \
+    --project="${PROJECT_ID}" \
     --freshness=1h \
     --order=asc \
-    --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName)"
+    --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName, protoPayload.authenticationInfo.principalEmail:label=EMAIL, protoPayload.authenticationInfo.principalSubject:label=SUBJECT, protoPayload.authenticationInfo.serviceAccountDelegationInfo[0].principalSubject:label=DELEGATED_BY)"
 
 # and again switch back to the service account
 gcloud config configurations activate wif-test