91 lines
3.5 KiB
Bash
Executable File
91 lines
3.5 KiB
Bash
Executable File
# Create a workload identity pool and a X.509 provider
|
|
gcloud iam workload-identity-pools create dom-lab-pool \
|
|
--project=dom-lab \
|
|
--location=global \
|
|
--display-name="Dom Lab Pool"
|
|
|
|
# Create X.509 provider
|
|
gcloud iam workload-identity-pools providers create-x509 dom-lab-x509 \
|
|
--project=dom-lab \
|
|
--location=global \
|
|
--workload-identity-pool=dom-lab-pool \
|
|
--trust-store-config-path=trust_store.yaml \
|
|
--attribute-mapping="google.subject=assertion.subject.dn.cn"
|
|
|
|
# Create the service account
|
|
gcloud iam service-accounts create sa-test \
|
|
--project=dom-lab \
|
|
--display-name="SA Test"
|
|
|
|
# Allow impersonation of the service account
|
|
gcloud iam service-accounts add-iam-policy-binding \
|
|
sa-test@dom-lab.iam.gserviceaccount.com \
|
|
--role=roles/iam.workloadIdentityUser \
|
|
--member="principal://iam.googleapis.com/projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/subject/test-client"
|
|
|
|
# Grant the service account read access to the project
|
|
gcloud projects add-iam-policy-binding dom-lab \
|
|
--member="serviceAccount:sa-test@dom-lab.iam.gserviceaccount.com" \
|
|
--role=roles/browser
|
|
|
|
# Create credentials configuration files
|
|
gcloud iam workload-identity-pools create-cred-config \
|
|
projects/267098479356/locations/global/workloadIdentityPools/dom-lab-pool/providers/dom-lab-x509 \
|
|
--service-account=sa-test@dom-lab.iam.gserviceaccount.com \
|
|
--credential-cert-path=client_cert.pem \
|
|
--credential-cert-private-key-path=client_key.pem \
|
|
--output-file=cred.json
|
|
|
|
# Create a storage bucket
|
|
gcloud storage buckets create gs://dom-lab-wif-test \
|
|
--project=dom-lab \
|
|
--location=europe-central2 \
|
|
--uniform-bucket-level-access
|
|
|
|
# Allow the service account to read and write objects in the bucket
|
|
gcloud storage buckets add-iam-policy-binding gs://dom-lab-wif-test \
|
|
--member="serviceAccount:sa-test@dom-lab.iam.gserviceaccount.com" \
|
|
--role=roles/storage.objectUser
|
|
|
|
# Enable Data Access audit logs for Cloud Storage (project-wide, not per bucket)
|
|
gcloud projects get-iam-policy dom-lab --format=yaml > iam_policy.yaml
|
|
node add_audit_config.mjs
|
|
gcloud projects set-iam-policy dom-lab iam_policy.yaml
|
|
|
|
# Create a new gcloud configuration for the workload identity federation test
|
|
gcloud config configurations create wif-test
|
|
|
|
# Authenticate gcloud with the credentials configuration file
|
|
gcloud auth login --cred-file=cred.json
|
|
|
|
# Set the project to dom-lab
|
|
gcloud config set project dom-lab
|
|
|
|
# Test the authentication by listing the project details
|
|
gcloud auth list
|
|
gcloud projects describe dom-lab
|
|
gcloud projects get-iam-policy dom-lab \
|
|
--flatten="bindings[].members" \
|
|
--format="table(bindings.role, bindings.members)"
|
|
|
|
# Test the bucket access by uploading and downloading a file
|
|
gcloud storage ls gs://dom-lab-wif-test
|
|
gcloud storage cp README.md gs://dom-lab-wif-test/README.md
|
|
gcloud storage ls gs://dom-lab-wif-test
|
|
gcloud storage cp gs://dom-lab-wif-test/README.md README.downloaded.md
|
|
cmp README.md README.downloaded.md
|
|
|
|
# Then, switch back to your original account
|
|
gcloud config configurations activate default
|
|
|
|
# List the audit log of the operations made by the service account
|
|
gcloud logging read \
|
|
'protoPayload.authenticationInfo.principalEmail="sa-test@dom-lab.iam.gserviceaccount.com"' \
|
|
--project=dom-lab \
|
|
--freshness=1h \
|
|
--order=asc \
|
|
--format="table(timestamp, protoPayload.serviceName, protoPayload.methodName)"
|
|
|
|
# and again switch back to the service account
|
|
gcloud config configurations activate wif-test
|