62 lines
2.4 KiB
Bash
62 lines
2.4 KiB
Bash
source ./env.sh
|
|
|
|
# Create a workload identity pool and a X.509 provider
|
|
gcloud iam workload-identity-pools create "${POOL_ID}" \
|
|
--project="${PROJECT_ID}" \
|
|
--location=global \
|
|
--display-name="${POOL_DISPLAY_NAME}"
|
|
|
|
# Create X.509 provider
|
|
gcloud iam workload-identity-pools providers create-x509 "${PROVIDER_ID}" \
|
|
--project="${PROJECT_ID}" \
|
|
--location=global \
|
|
--workload-identity-pool="${POOL_ID}" \
|
|
--trust-store-config-path=trust_store.yaml \
|
|
--attribute-mapping="google.subject=assertion.subject.dn.cn"
|
|
|
|
# Create the service account
|
|
gcloud iam service-accounts create sa-test \
|
|
--project="${PROJECT_ID}" \
|
|
--display-name="SA Test"
|
|
|
|
# Allow impersonation of the service account
|
|
gcloud iam service-accounts add-iam-policy-binding \
|
|
"${SA_EMAIL}" \
|
|
--role=roles/iam.workloadIdentityUser \
|
|
--member="principal://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/subject/test-client"
|
|
|
|
# Grant the service account read access to the project
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${SA_EMAIL}" \
|
|
--role=roles/browser
|
|
|
|
# Create credentials configuration files
|
|
gcloud iam workload-identity-pools create-cred-config \
|
|
"projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/providers/${PROVIDER_ID}" \
|
|
--service-account="${SA_EMAIL}" \
|
|
--credential-cert-path=client_cert.pem \
|
|
--credential-cert-private-key-path=client_key.pem \
|
|
--output-file=cred.json
|
|
|
|
# Create a storage bucket
|
|
gcloud storage buckets create "gs://${BUCKET}" \
|
|
--project="${PROJECT_ID}" \
|
|
--location="${BUCKET_LOCATION}" \
|
|
--uniform-bucket-level-access
|
|
|
|
# Allow the service account to read and write objects in the bucket
|
|
gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
|
|
--member="serviceAccount:${SA_EMAIL}" \
|
|
--role=roles/storage.objectUser
|
|
|
|
# Create a managed folder and make the objects in it publicly readable
|
|
gcloud storage managed-folders create "gs://${BUCKET}/public/"
|
|
gcloud storage managed-folders add-iam-policy-binding "gs://${BUCKET}/public/" \
|
|
--member=allUsers \
|
|
--role=roles/storage.objectViewer
|
|
|
|
# Enable Data Access audit logs for Cloud Storage (project-wide, not per bucket)
|
|
gcloud projects get-iam-policy "${PROJECT_ID}" --format=yaml > iam_policy.yaml
|
|
./add_audit_config.mjs
|
|
gcloud projects set-iam-policy "${PROJECT_ID}" iam_policy.yaml
|