54 lines
2.6 KiB
Bash
54 lines
2.6 KiB
Bash
source ./env.sh
|
|
|
|
# Create a new gcloud configuration for the workload identity federation test
|
|
gcloud config configurations create wif-test
|
|
|
|
# Authenticate gcloud with the credentials configuration file
|
|
gcloud auth login --cred-file=cred.json
|
|
|
|
# Set the project
|
|
gcloud config set project "${PROJECT_ID}"
|
|
|
|
# Test the authentication by listing the project details
|
|
gcloud auth list
|
|
gcloud projects describe "${PROJECT_ID}"
|
|
gcloud projects get-iam-policy "${PROJECT_ID}" \
|
|
--flatten="bindings[].members" \
|
|
--format="table(bindings.role, bindings.members)"
|
|
|
|
# Test the bucket access by uploading and downloading a file
|
|
gcloud storage ls "gs://${BUCKET}"
|
|
gcloud storage cp README.md "gs://${BUCKET}/README.md"
|
|
gcloud storage ls "gs://${BUCKET}"
|
|
rm README.downloaded.md
|
|
gcloud storage cp "gs://${BUCKET}/README.md" README.downloaded.md
|
|
cmp README.md README.downloaded.md
|
|
|
|
# Then, switch back to your original account
|
|
gcloud config configurations activate default
|
|
|
|
# List the audit log of the operations made by the service account
|
|
# The same query for the Logs Explorer in the console, replace SA_EMAIL:
|
|
# protoPayload.authenticationInfo.principalEmail="SA_EMAIL"
|
|
gcloud logging read \
|
|
"protoPayload.authenticationInfo.principalEmail=\"${SA_EMAIL}\"" \
|
|
--project="${PROJECT_ID}" \
|
|
--freshness=1h \
|
|
--order=asc \
|
|
--format="table(timestamp, protoPayload.serviceName, protoPayload.methodName, protoPayload.authenticationInfo.principalEmail:label=EMAIL, protoPayload.authenticationInfo.principalSubject:label=SUBJECT, protoPayload.authenticationInfo.serviceAccountDelegationInfo[0].principalSubject:label=DELEGATED_BY)"
|
|
|
|
# List the audit log of all data operations on the bucket, regardless of the principal
|
|
# The same query for the Logs Explorer in the console, replace PROJECT_ID and BUCKET:
|
|
# logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access"
|
|
# resource.type="gcs_bucket"
|
|
# resource.labels.bucket_name="BUCKET"
|
|
gcloud logging read \
|
|
"logName=\"projects/${PROJECT_ID}/logs/cloudaudit.googleapis.com%2Fdata_access\" AND resource.type=\"gcs_bucket\" AND resource.labels.bucket_name=\"${BUCKET}\"" \
|
|
--project="${PROJECT_ID}" \
|
|
--freshness=1h \
|
|
--order=asc \
|
|
--format="table(timestamp, protoPayload.methodName, protoPayload.resourceName:label=RESOURCE, protoPayload.authenticationInfo.principalEmail:label=EMAIL, protoPayload.authenticationInfo.principalSubject:label=SUBJECT, protoPayload.authenticationInfo.serviceAccountDelegationInfo[0].principalSubject:label=DELEGATED_BY)"
|
|
|
|
# optionally switch back to the service account for further testing
|
|
# gcloud config configurations activate wif-test
|