Added configuration flag to separate resources requiring elevated pri…

README.md

@@ -42,6 +42,12 @@ export GCP_LOCATION=<region, defaults to europe-west2>
 export GCP_ZONE=<zone, defaults to europe-west2-a>
 ```
 
+Some resources require elevated privileges to create in GCP.  These are disabled by default but can be activated via:
+```bash
+export GCP_ENABLE_PRIVILEGED_RESOURCES=1
+```
+This takes effect during the "plan" task as described in the next section.  Affected terraform resources are included/excluded and associated inspec tests enabled/disabled accordingly.
+
 3. Run the integration tests via:
 
 ```bash

Rakefile

@@ -79,7 +79,8 @@ namespace :test do
 
   task :run_integration_tests do
     puts "----> Run"
-    cmd = format("bundle exec inspec exec %s/verify --attrs %s/build/%s -t gcp://", integration_dir, integration_dir, profile_attributes)
+    # Since the default behaviour is to skip tests, the below absorbs an inspec "101 run okay + skipped only" exit code as successful
+    cmd = format("bundle exec inspec exec %s/verify --attrs %s/build/%s -t gcp://; rc=$?; if [ $rc -eq 0 ] || [ $rc -eq 101 ]; then exit 0; else exit 1; fi", integration_dir, integration_dir, profile_attributes)
     sh(cmd)
   end
 

test/integration/build/gcp.tf

@@ -14,13 +14,6 @@ terraform {
 
 variable "gcp_project_name" {}
 variable "gcp_project_id" {}
-# BELOW TO BE REMOVED as not used
-variable "gcp_storage_account_name" {}
-variable "gcp_admin_password" {}
-# Set a unique string which will be appended to public facing items
-# to ensure there are no clashes
-#variable "suffix" {}
-
 variable "gcp_location" {
   default = "europe-west2"
 }
@@ -70,6 +63,8 @@ variable "gcp_storage_bucket_name" {
   default ="gcp-inspec"
 }
 
+variable "gcp_enable_privileged_resources" {}
+
 provider "google" {
   region = "${var.gcp_location}"
 }
@@ -150,12 +145,14 @@ resource "google_compute_instance" "generic_windows_internal_vm_instance" {
 }
 
 resource "google_service_account" "generic_service_account_object_viewer" {
+  count = "${var.gcp_enable_privileged_resources}"
   project = "${var.gcp_project_id}"
   account_id   = "object-viewer"
   display_name = "${var.gcp_service_account_display_name}"
 }
 
 resource "google_project_iam_custom_role" "generic_project_iam_custom_role" {
+  count = "${var.gcp_enable_privileged_resources}"
   project = "${var.gcp_project_id}"
   role_id     = "${var.gcp_project_iam_custom_role_id}"
   title       = "GCP Inspec Generic Project IAM Custom Role"

test/integration/configuration/gcp_inspec_config.rb

@@ -11,14 +11,11 @@ module GCPInspecConfig
 
   # Config for terraform / inspec in the below hash
   @config = {
-      # Generic GCP resrource parameters
+      # Generic GCP resource parameters
       :gcp_project_name => "SPaterson Project",
       :gcp_project_id => "spaterson-project",
       :gcp_project_number => "1041358276233",
       # Determine the storage account name and the admin password
-      # BELOW two variables to be removed
-      :gcp_storage_account_name => (0...15).map { (65 + rand(26)).chr }.join.downcase,
-      :gcp_admin_password => Passgen::generate(length: 12, uppercase: true, lowercase: true, symbols: true, digits: true),
       :gcp_location => "europe-west2",
       :gcp_zone => "europe-west2-a",
       :gcp_int_vm_name => "gcp-inspec-int-linux-vm",
@@ -61,7 +58,13 @@ module GCPInspecConfig
       :gcp_kube_cluster_zone_extra2 => "europe-west2-c",
       :gcp_kube_cluster_master_user => "gcp-inspec-kube-admin",
       :gcp_kube_cluster_master_pass => Passgen::generate(length: 20, uppercase: true, lowercase: true, symbols: true, digits: true),
-      :gcp_kube_nodepool_name => "default-pool"
+      :gcp_kube_nodepool_name => "default-pool",
+      # Some resources require elevated privileges to create and therefore test against.  The below flag is used to control
+      # both the terraform resource creation and the inspec test execution for those resources.  Default behaviour is for this to
+      # be disabled meaning a user needs no special GCP privileges to run the integration test pack.
+      #
+      # Note, would prefer to use boolean true or false here but will revisit for a future version of tf, see here for more detail: https://www.terraform.io/docs/configuration/variables.html
+      :gcp_enable_privileged_resources => 0
   }
 
   def self.config

test/integration/verify/controls/generic_iam_role.rb

@@ -2,9 +2,10 @@
 
 gcp_project_id = attribute(:gcp_project_id, default: '', description: 'The GCP project identifier.')
 gcp_project_iam_custom_role_id = attribute(:gcp_project_iam_custom_role_id, default: '', description: 'The GCP IAM custom role identifier.')
+gcp_enable_privileged_resources = attribute(:gcp_enable_privileged_resources,default:0,description:'Flag to enable privileged resources requiring elevated privileges in GCP.')
 
 control 'gcp-generic-iam-role' do
-
+  only_if { gcp_enable_privileged_resources == 1 }
   impact 1.0
   title 'Ensure that the IAM role is correctly set up'
 

test/integration/verify/controls/generic_iam_service_account.rb

@@ -2,9 +2,11 @@
 
 gcp_project_id = attribute(:gcp_project_id, default: '', description: 'The GCP project identifier.')
 gcp_service_account_display_name = attribute(:gcp_service_account_display_name, default: '', description: 'The GCP IAM Service Account display name.')
+gcp_enable_privileged_resources = attribute(:gcp_enable_privileged_resources,default:0,description:'Flag to enable privileged resources requiring elevated privileges in GCP.')
 
 control 'gcp-generic-iam-service-account' do
 
+  only_if { gcp_enable_privileged_resources == 1 }
   impact 1.0
   title 'Ensure that the Service Account is correctly set up'