forked from GoogleCloudPlatform/cloud-foundation-fabric
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #13 from GoogleCloudPlatform/master
Sync fork
- Loading branch information
Showing
130 changed files
with
2,064 additions
and
1,922 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,27 +1,27 @@ | ||
| # Configuring workload identity federation for Terraform Cloud/Enterprise workflow | ||
| # Configuration of workload identity federation for Terraform Cloud/Enterprise workflows | ||
|
|
||
| The most common way to use Terraform Cloud for GCP deployments is to store a GCP Service Account Key as a part of TFE Workflow configuration, as we all know there are security risks due to the fact that keys are long term credentials that could be compromised. | ||
| The most common way to use Terraform Cloud for GCP deployments is to store a GCP Service Account Key as a part of TFC Workflow configuration, as we all know there are security risks due to the fact that keys are long term credentials that could be compromised. | ||
|
|
||
| Workload identity federation enables applications running outside of Google Cloud to replace long-lived service account keys with short-lived access tokens. This is achieved by configuring Google Cloud to trust an external identity provider, so applications can use the credentials issued by the external identity provider to impersonate a service account. | ||
|
|
||
| This blueprint shows how to set up [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation) between [Terraform Cloud/Enterprise](https://developer.hashicorp.com/terraform/enterprise) instance and Google Cloud. This will be possible by configuring workload identity federation to trust oidc tokens generated for a specific workflow in a Terraform Enterprise organization. | ||
| This blueprint shows how to set up [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation) between [Terraform Cloud/Enterprise](https://developer.hashicorp.com/terraform/enterprise) instance and Google Cloud. This will be possible by configuring workload identity federation and [Terraform Cloud Dynamic Provider Credentials](https://www.hashicorp.com/blog/terraform-cloud-adds-dynamic-provider-credentials-vault-official-cloud-providers). | ||
|
|
||
| The following diagram illustrates how the VM will get a short-lived access token and use it to access a resource: | ||
|
|
||
|  | ||
|
|
||
| ## Running the blueprint | ||
|
|
||
| ### Create Terraform Enterprise Workflow | ||
| If you don't have an existing Terraform Enterprise organization you can sign up for a [free trial](https://app.terraform.io/public/signup/account) account. | ||
| ### Create Terraform Cloud Workflow | ||
| If you don't have an existing Terraform Cloud organization you can sign up for a [free trial](https://app.terraform.io/public/signup/account) account. | ||
|
|
||
| Create a new Workspace for a `CLI-driven workflow` (Identity Federation will work for any workflow type, but for simplicity of the blueprint we use CLI driven workflow). | ||
|
|
||
| Note workspace name and id (id starts with `ws-`), we will use them on a later stage. | ||
|
|
||
| Go to the organization settings and note the org name and id (id starts with `org-`). | ||
|
|
||
| ### Deploy GCP Workload Identity Pool Provider for Terraform Enterprise | ||
| ### Deploy GCP Workload Identity Pool Provider for Terraform Cloud integration | ||
|
|
||
| > **_NOTE:_** This is a preparation part and should be executed on behalf of a user with enough permissions. | ||
|
|
@@ -32,7 +32,7 @@ Required permissions when new project is created: | |
| - Workload Identity Admin on the project level | ||
| - Project IAM Admin on the project level | ||
|
|
||
| Fill out required variables, use TFE Org and Workspace IDs from the previous steps (IDs are not the names). | ||
| Fill out required variables, use TFC Org and Workspace IDs from the previous steps (IDs are not the names). | ||
| ```bash | ||
| cd gcp-workload-identity-provider | ||
|
|
||
|
|
@@ -50,34 +50,41 @@ terraform init | |
| terraform apply | ||
| ``` | ||
|
|
||
| As a result a set of outputs will be provided (your values will be different), note the output since we will use it on the next steps. | ||
| You will receive a set of outputs (your values may be different), note them because we will need them in the next steps. | ||
|
|
||
| ``` | ||
| impersonate_service_account_email = "[email protected]" | ||
| project_id = "tfe-test-oidc" | ||
| workload_identity_audience = "//iam.googleapis.com/projects/476538149566/locations/global/workloadIdentityPools/tfe-pool/providers/tfe-provider" | ||
| workload_identity_pool_provider_id = "projects/476538149566/locations/global/workloadIdentityPools/tfe-pool/providers/tfe-provider" | ||
| project_id = "tfc-dynamic-creds-gcp" | ||
| tfc_workspace_wariables = { | ||
| "TFC_GCP_PROJECT_NUMBER" = "200635100209" | ||
| "TFC_GCP_PROVIDER_AUTH" = "true" | ||
| "TFC_GCP_RUN_SERVICE_ACCOUNT_EMAIL" = "[email protected]" | ||
| "TFC_GCP_WORKLOAD_POOL_ID" = "tfc-pool" | ||
| "TFC_GCP_WORKLOAD_PROVIDER_ID" = "tfc-provider" | ||
| } | ||
| ``` | ||
|
|
||
| ### Configure OIDC provider for your TFE Workflow | ||
| ### Configure Dynamic Provider Credentials for your TFC Workflow | ||
|
|
||
| To enable OIDC for a TFE workflow it's enough to setup an environment variable `TFC_WORKLOAD_IDENTITY_AUDIENCE`. | ||
| To configure [GCP Dynamic Provider Credentials](https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/gcp-configuration) for a TFC workflow, you need to set a set of environment variables: | ||
| - `TFC_GCP_PROVIDER_AUTH` | ||
| - `TFC_GCP_PROJECT_NUMBER` | ||
| - `TFC_GCP_RUN_SERVICE_ACCOUNT_EMAIL` | ||
| - `TFC_GCP_WORKLOAD_POOL_ID` | ||
| - `TFC_GCP_WORKLOAD_PROVIDER_ID` | ||
|
|
||
| Go the the Workflow -> Variables and add a new variable `TFC_WORKLOAD_IDENTITY_AUDIENCE` equal to the value of `workload_identity_audience` output, in our example it's: | ||
| Go to the Workflow -> Variables page and click the + Add variable button. For variable type select ` Environment variable`. The variable names listed above are the names of the variables that you need to set. The values provided in the terraform output in the previous step are the values that you need to provide for each variable. | ||
|
|
||
| ``` | ||
| TFC_WORKLOAD_IDENTITY_AUDIENCE = "//iam.googleapis.com/projects/476538149566/locations/global/workloadIdentityPools/tfe-pool/providers/tfe-provider" | ||
| ``` | ||
|
|
||
| At that point we setup GCP Identity Federation to trust TFE generated OIDC tokens, so the TFE workflow can use the token to impersonate a GCP Service Account. | ||
| At that point we set up GCP Identity Federation to trust TFC generated OIDC tokens, workflow should be able to use Dynamic Provider Credentials to impersonate a GCP Service Account. | ||
|
|
||
| ## Testing the blueprint | ||
|
|
||
| In order to test the setup we will deploy a GCS bucket from TFE Workflow using OIDC token for Service Account Impersonation. | ||
| To test the setup, we will deploy a GCS bucket from the TFC Workflow created in the previous step. | ||
|
|
||
| This will allow us to verify that the workflow can successfully interact with GCP services using the TFC Dynamic Provider Credentials. | ||
|
|
||
| ### Configure backend and variables | ||
|
|
||
| First, we need to configure TFE Remote backend for our testing terraform code, use TFE Organization name and workspace name (names are not the same as ids) | ||
| First, we need to configure the TFC Remote backend for our testing Terraform code. Use the TFC Organization name and workspace name (names are not the same as ids). | ||
|
|
||
| ``` | ||
| cd ../tfc-workflow-using-wif | ||
|
|
@@ -89,7 +96,7 @@ vi backend.tf | |
| ``` | ||
|
|
||
| Fill out variables based on the output from the preparation steps: | ||
| Fill out `project_id` variable based on the output from the preparation steps: | ||
|
|
||
| ``` | ||
| mv terraform.auto.tfvars.template terraform.auto.tfvars | ||
|
|
@@ -100,7 +107,7 @@ vi terraform.auto.tfvars | |
|
|
||
| ### Authenticate terraform for triggering CLI-driven workflow | ||
|
|
||
| Follow this [documentation](https://learn.hashicorp.com/tutorials/terraform/cloud-login) to login ti terraform cloud from the CLI. | ||
| Follow this [documentation](https://learn.hashicorp.com/tutorials/terraform/cloud-login) to login to terraform cloud from the CLI. | ||
|
|
||
| ### Trigger the workflow | ||
|
|
||
|
|
@@ -110,6 +117,6 @@ terraform init | |
| terraform apply | ||
| ``` | ||
|
|
||
| As a result we have a successfully deployed GCS bucket from Terraform Enterprise workflow using Workload Identity Federation. | ||
| As a result we have a successfully deployed GCS bucket from Terraform Cloud workflow using Workload Identity Federation. | ||
|
|
||
| Once done testing, you can clean up resources by running `terraform destroy` first in the `tfc-workflow-using-wif` and then `gcp-workload-identity-provider` folders. | ||
Binary file added
BIN
+73.9 KB
blueprints/cloud-operations/terraform-cloud-dynamic-credentials/diagram.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.