[FAST] Add permissions to nsec-r SA

GoogleCloudPlatform · Aug 21, 2024 · 191baab · 191baab
1 parent fe55217
commit 191baab
Show file tree

Hide file tree

Showing 12 changed files with 1,797 additions and 32 deletions.
diff --git a/fast/stages/0-bootstrap/data/custom-roles/network_firewall_policies_viewer.yaml b/fast/stages/0-bootstrap/data/custom-roles/network_firewall_policies_viewer.yaml
@@ -0,0 +1,20 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../schemas/custom-role.schema.json
+
+name: networkFirewallPoliciesViewer
+includedPermissions:
+  - networksecurity.firewallEndpointAssociations.get
+  - networksecurity.firewallEndpointAssociations.list
diff --git a/fast/stages/0-bootstrap/data/custom-roles/ngfw_enterprise_viewer.yaml b/fast/stages/0-bootstrap/data/custom-roles/ngfw_enterprise_viewer.yaml
@@ -0,0 +1,31 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# yaml-language-server: $schema=../../schemas/custom-role.schema.json
+
+name: ngfwEnterpriseViewer
+includedPermissions:
+  - networksecurity.firewallEndpoints.get
+  - networksecurity.firewallEndpoints.list
+  - networksecurity.firewallEndpoints.use
+  - networksecurity.locations.get
+  - networksecurity.locations.list
+  - networksecurity.operations.get
+  - networksecurity.operations.list
+  - networksecurity.securityProfileGroups.get
+  - networksecurity.securityProfileGroups.list
+  - networksecurity.securityProfileGroups.use
+  - networksecurity.securityProfiles.get
+  - networksecurity.securityProfiles.list
+  - networksecurity.securityProfiles.use
diff --git a/fast/stages/0-bootstrap/organization.tf b/fast/stages/0-bootstrap/organization.tf
@@ -188,7 +188,9 @@ module "organization" {
               ]))
               , join(",", formatlist("'%s'", [
                 module.organization.custom_role_id["network_firewall_policies_admin"],
+                module.organization.custom_role_id["network_firewall_policies_viewer"],
                 module.organization.custom_role_id["ngfw_enterprise_admin"],
+                module.organization.custom_role_id["ngfw_enterprise_viewer"],
                 module.organization.custom_role_id["service_project_network_admin"],
                 module.organization.custom_role_id["tenant_network_admin"]
               ]))

diff --git a/fast/stages/1-resman/README.md b/fast/stages/1-resman/README.md
diff --git a/fast/stages/1-resman/branch-networking.tf b/fast/stages/1-resman/branch-networking.tf
@@ -31,13 +31,19 @@ locals {
       "roles/resourcemanager.folderViewer" = [module.branch-network-r-sa.iam_email]
     },
     var.fast_features.nsec != true ? {} : {
-      # nsec service account
+      # nsec service accounts
       "roles/serviceusage.serviceUsageAdmin" = [
         try(module.branch-nsec-sa[0].iam_email, null)
       ]
+      "roles/serviceusage.serviceUsageConsumer" = [
+        try(module.branch-nsec-r-sa[0].iam_email, null)
+      ]
       (var.custom_roles["network_firewall_policies_admin"]) = [
         try(module.branch-nsec-sa[0].iam_email, null)
       ]
+      (var.custom_roles["network_firewall_policies_viewer"]) = [
+        try(module.branch-nsec-r-sa[0].iam_email, null)
+      ]
     }
   )
   # deep-merge FAST-specific IAM with user-provided bindings in var.folder_iam

diff --git a/fast/stages/1-resman/iam.tf b/fast/stages/1-resman/iam.tf
@@ -48,6 +48,14 @@ locals {
         member = module.branch-nsec-sa[0].iam_email
         role   = local.custom_roles["ngfw_enterprise_admin"],
       }
+      sa_net_nsec_r_fw_policy_admin = {
+        member = module.branch-nsec-sa[0].iam_email
+        role   = "roles/compute.orgFirewallPolicyUser"
+      }
+      sa_net_nsec_r_ngfw_enterprise_viewer = {
+        member = module.branch-nsec-r-sa[0].iam_email
+        role   = local.custom_roles["ngfw_enterprise_viewer"],
+      }
     },
     # optional billing roles for network and security
     local.billing_mode != "org" ? {} : {

diff --git a/fast/stages/1-resman/variables-fast.tf b/fast/stages/1-resman/variables-fast.tf
@@ -57,6 +57,7 @@ variable "custom_roles" {
     gcve_network_admin              = string
     network_firewall_policies_admin = string
     ngfw_enterprise_admin           = string
+    ngfw_enterprise_viewer          = string
     organization_admin_viewer       = string
     service_project_network_admin   = string
     storage_viewer                  = string

diff --git a/tests/fast/stages/s0_bootstrap/checklist.yaml b/tests/fast/stages/s0_bootstrap/checklist.yaml
diff --git a/tests/fast/stages/s0_bootstrap/simple.yaml b/tests/fast/stages/s0_bootstrap/simple.yaml
@@ -21,7 +21,7 @@ counts:
   google_logging_project_bucket_config: 4
   google_org_policy_policy: 22
   google_organization_iam_binding: 28
-  google_organization_iam_custom_role: 9
+  google_organization_iam_custom_role: 11
   google_organization_iam_member: 29
   google_project: 3
   google_project_iam_audit_config: 1
@@ -41,7 +41,7 @@ counts:
   google_tags_tag_value: 1
   local_file: 10
   modules: 20
-  resources: 229
+  resources: 231
 
 outputs:
   automation: __missing__
@@ -50,7 +50,9 @@ outputs:
   custom_roles:
     gcve_network_admin: organizations/123456789012/roles/gcveNetworkAdmin
     network_firewall_policies_admin: organizations/123456789012/roles/networkFirewallPoliciesAdmin
+    network_firewall_policies_viewer: organizations/123456789012/roles/networkFirewallPoliciesViewer
     ngfw_enterprise_admin: organizations/123456789012/roles/ngfwEnterpriseAdmin
+    ngfw_enterprise_viewer: organizations/123456789012/roles/ngfwEnterpriseViewer
     organization_admin_viewer: organizations/123456789012/roles/organizationAdminViewer
     organization_iam_admin: organizations/123456789012/roles/organizationIamAdmin
     service_project_network_admin: organizations/123456789012/roles/serviceProjectNetworkAdmin

diff --git a/tests/fast/stages/s0_bootstrap/simple_projects.yaml b/tests/fast/stages/s0_bootstrap/simple_projects.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 Google LLC
+# Copyright 2024 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

diff --git a/tests/fast/stages/s1_resman/checklist.tfvars b/tests/fast/stages/s1_resman/checklist.tfvars
@@ -13,12 +13,14 @@ billing_account = {
 }
 custom_roles = {
   # organization_iam_admin = "organizations/123456789012/roles/organizationIamAdmin",
-  gcve_network_admin              = "organizations/123456789012/roles/gcveNetworkAdmin"
-  network_firewall_policies_admin = "organizations/123456789012/roles/networkFirewallPoliciesAdmin"
-  ngfw_enterprise_admin           = "organizations/123456789012/roles/ngfwEnterpriseAdmin"
-  organization_admin_viewer       = "organizations/123456789012/roles/organizationAdminViewer"
-  service_project_network_admin   = "organizations/123456789012/roles/xpnServiceAdmin"
-  storage_viewer                  = "organizations/123456789012/roles/storageViewer"
+  gcve_network_admin               = "organizations/123456789012/roles/gcveNetworkAdmin"
+  network_firewall_policies_admin  = "organizations/123456789012/roles/networkFirewallPoliciesAdmin"
+  network_firewall_policies_viewer = "organizations/123456789012/roles/networkFirewallPoliciesViewer"
+  ngfw_enterprise_admin            = "organizations/123456789012/roles/ngfwEnterpriseAdmin"
+  ngfw_enterprise_viewer           = "organizations/123456789012/roles/ngfwEnterpriseViewer"
+  organization_admin_viewer        = "organizations/123456789012/roles/organizationAdminViewer"
+  service_project_network_admin    = "organizations/123456789012/roles/xpnServiceAdmin"
+  storage_viewer                   = "organizations/123456789012/roles/storageViewer"
 }
 factories_config = {
   checklist_data = "checklist-data.json"

diff --git a/tests/fast/stages/s1_resman/simple.tfvars b/tests/fast/stages/s1_resman/simple.tfvars
@@ -13,12 +13,14 @@ billing_account = {
 }
 custom_roles = {
   # organization_iam_admin = "organizations/123456789012/roles/organizationIamAdmin",
-  gcve_network_admin              = "organizations/123456789012/roles/gcveNetworkAdmin"
-  network_firewall_policies_admin = "organizations/123456789012/roles/networkFirewallPoliciesAdmin"
-  ngfw_enterprise_admin           = "organizations/123456789012/roles/ngfwEnterpriseAdmin"
-  organization_admin_viewer       = "organizations/123456789012/roles/organizationAdminViewer"
-  service_project_network_admin   = "organizations/123456789012/roles/xpnServiceAdmin"
-  storage_viewer                  = "organizations/123456789012/roles/storageViewer"
+  gcve_network_admin               = "organizations/123456789012/roles/gcveNetworkAdmin"
+  network_firewall_policies_admin  = "organizations/123456789012/roles/networkFirewallPoliciesAdmin"
+  network_firewall_policies_viewer = "organizations/123456789012/roles/networkFirewallPoliciesViewer"
+  ngfw_enterprise_admin            = "organizations/123456789012/roles/ngfwEnterpriseAdmin"
+  ngfw_enterprise_viewer           = "organizations/123456789012/roles/ngfwEnterpriseViewer"
+  organization_admin_viewer        = "organizations/123456789012/roles/organizationAdminViewer"
+  service_project_network_admin    = "organizations/123456789012/roles/xpnServiceAdmin"
+  storage_viewer                   = "organizations/123456789012/roles/storageViewer"
 }
 groups = {
   gcp-billing-admins      = "gcp-billing-admins",