Skip to content

fix: add more permissions that are needed for resource group v2 #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
May 15, 2024
Merged

fix: add more permissions that are needed for resource group v2 #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4595e7a
misc: add permission required by resource group v2
May 14, 2024
f4d1ac8
fixup
May 14, 2024
26594d9
fixup
May 14, 2024
1ae3575
terraform-docs
May 15, 2024
7211b16
terraform-docs (signed)
May 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,9 @@ A Terraform Module to configure the Lacework Agentless Scanner.
| [google_cloud_run_v2_job.agentless_orchestrate](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_job) | resource |
| [google_cloud_scheduler_job.agentless_orchestrate](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_scheduler_job) | resource |
| [google_organization_iam_custom_role.agentless_orchestrate](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_custom_role) | resource |
| [google_organization_iam_custom_role.agentless_orchestrate_monitored_project_resource_group](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_custom_role) | resource |
| [google_organization_iam_member.agentless_orchestrate](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_member) | resource |
| [google_organization_iam_member.agentless_orchestrate_monitored_project_resource_group](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/organization_iam_member) | resource |
| [google_project_iam_custom_role.agentless_orchestrate](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_custom_role) | resource |
| [google_project_iam_custom_role.agentless_orchestrate_monitored_project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_custom_role) | resource |
| [google_project_iam_custom_role.agentless_scan](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_custom_role) | resource |
Expand Down
19 changes: 19 additions & 0 deletions custom_roles.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,22 @@ resource "google_project_iam_custom_role" "agentless_orchestrate_monitored_proje
]
}

// Scope : MONITORED_PROJECT
// Use : Accessing Folders/Organizations for Resource Group v2
// Role created at organization
// Note this binding happens at the organization level because the custom role requires organization level permissions
resource "google_organization_iam_custom_role" "agentless_orchestrate_monitored_project_resource_group" {
count = var.global && (var.integration_type == "PROJECT") ? 1 : 0

org_id = var.organization_id
role_id = replace("${var.prefix}-resource-group-${local.suffix}", "-", "_")
title = "Lacework Agentless Workload Scanning Role for monitored project (Resource Group)"
permissions = [
"resourcemanager.folders.get",
"resourcemanager.organizations.get",
]
}

//-----------------------------------------------------------------------------------

// Scope : MONITORED_ORGANIZATION
Expand All @@ -41,6 +57,9 @@ resource "google_organization_iam_custom_role" "agentless_orchestrate" {
"compute.zones.list",
"resourcemanager.folders.list",
"resourcemanager.projects.list",
// Required for Resource Group v2
"resourcemanager.organizations.get",
"resourcemanager.folders.get",
]
}

Expand Down
43 changes: 26 additions & 17 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,27 +52,27 @@ locals {
The target cloud run job still resides in the desired region.
*/
unsupported_cloud_scheduler_region_replacements = {
us-east5 = "us-east1"
us-south1 = "us-central1"
us-east5 = "us-east1"
us-south1 = "us-central1"
northamerica-northeast2 = "northamerica-northeast1"
southamerica-west1 = "southamerica-east1"
southamerica-west1 = "southamerica-east1"

europe-west10 = "europe-west1"
europe-west12 = "europe-west1"
europe-west4 = "europe-west1"
europe-west8 = "europe-west1"
europe-west9 = "europe-west1"
europe-west4 = "europe-west1"
europe-west8 = "europe-west1"
europe-west9 = "europe-west1"

europe-north1 = "europe-central2"
europe-north1 = "europe-central2"
europe-southwest1 = "europe-central2"
africa-south1 = "europe-central2"
me-central1 = "europe-central2"
me-central2 = "europe-central2"
me-west1 = "europe-central2"
africa-south1 = "europe-central2"
me-central1 = "europe-central2"
me-central2 = "europe-central2"
me-west1 = "europe-central2"

asia-south2 = "asia-south1"
asia-south2 = "asia-south1"
australia-southeast2 = "australia-southeast1"
}
}
cloud_scheduler_region = lookup(local.unsupported_cloud_scheduler_region_replacements, local.region, local.region)
}

Expand Down Expand Up @@ -267,6 +267,15 @@ resource "google_project_iam_member" "agentless_orchestrate_monitored_project" {
member = "serviceAccount:${local.agentless_orchestrate_service_account_email}"
}

// Orchestrate Service Account <-> Role Binding for Custom Role project-level resource group support
resource "google_organization_iam_member" "agentless_orchestrate_monitored_project_resource_group" {
count = var.global && (var.integration_type == "PROJECT") ? 1 : 0

org_id = local.organization_id
role = google_organization_iam_custom_role.agentless_orchestrate_monitored_project_resource_group[0].id
member = "serviceAccount:${local.agentless_orchestrate_service_account_email}"
}

// Orchestrate Service Account <-> Role Binding for Custom Role created in Scanner Project
resource "google_project_iam_member" "agentless_orchestrate" {
count = var.global ? 1 : 0
Expand Down Expand Up @@ -429,9 +438,9 @@ resource "google_cloud_scheduler_job" "agentless_orchestrate" {
description = "Invoke Lacework Agentless Workload Scanning on a schedule."
project = local.scanning_project_id
// for unsupported regions, cloud scheduler is configured in a different region
region = local.cloud_scheduler_region
schedule = "0 * * * *"
time_zone = "Etc/UTC"
region = local.cloud_scheduler_region
schedule = "0 * * * *"
time_zone = "Etc/UTC"

http_target {
http_method = "POST"
Expand All @@ -454,7 +463,7 @@ resource "terraform_data" "execute_cloud_run_job" {
}

provisioner "local-exec" {
command = "gcloud run jobs execute ${ google_cloud_run_v2_job.agentless_orchestrate[0].name } --region=${ local.region }"
command = "gcloud run jobs execute ${google_cloud_run_v2_job.agentless_orchestrate[0].name} --region=${local.region}"
}

depends_on = [google_cloud_run_v2_job.agentless_orchestrate]
Expand Down