From 24df96f663bb8ae12b00d622d15b1858ad5978e0 Mon Sep 17 00:00:00 2001 From: Ben Huston Date: Tue, 11 Apr 2023 12:05:59 +0000 Subject: [PATCH 1/3] Add support for overriding default GCP org policies --- infrastructure/org-policies/README | 0 infrastructure/org-policies/main.tf | 25 ++++++ infrastructure/org-policies/org-policies.tf | 78 +++++++++++++++++++ .../org-policies/project-services.tf | 21 +++++ infrastructure/org-policies/providers.tf | 23 ++++++ .../org-policies/terraform.tfvars.sample | 24 ++++++ infrastructure/org-policies/variables.tf | 20 +++++ 7 files changed, 191 insertions(+) create mode 100644 infrastructure/org-policies/README create mode 100644 infrastructure/org-policies/main.tf create mode 100644 infrastructure/org-policies/org-policies.tf create mode 100644 infrastructure/org-policies/project-services.tf create mode 100644 infrastructure/org-policies/providers.tf create mode 100644 infrastructure/org-policies/terraform.tfvars.sample create mode 100644 infrastructure/org-policies/variables.tf diff --git a/infrastructure/org-policies/README b/infrastructure/org-policies/README new file mode 100644 index 0000000..e69de29 diff --git a/infrastructure/org-policies/main.tf b/infrastructure/org-policies/main.tf new file mode 100644 index 0000000..4082def --- /dev/null +++ b/infrastructure/org-policies/main.tf @@ -0,0 +1,25 @@ +# Copyright 2023 Google LLC All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +terraform { + required_providers { + google = { + source = "hashicorp/google" + version = "4.56.0" + user_project_override = true + } + } + + required_version = ">= 1.3" +} diff --git a/infrastructure/org-policies/org-policies.tf b/infrastructure/org-policies/org-policies.tf new file mode 100644 index 0000000..cf188be --- /dev/null +++ b/infrastructure/org-policies/org-policies.tf @@ -0,0 +1,78 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + + +module "gcp_org_policy_v2_requireShieldedVm" { + source = "terraform-google-modules/org-policy/google//modules/org_policy_v2" + version = "~> 5.2.0" + + policy_root = "project" + policy_root_id = var.project + rules = [{ + enforcement = false + allow = [] + deny = [] + conditions = [] + }] + constraint = "compute.requireShieldedVm" + policy_type = "boolean" +} + +module "gcp_org_policy_v2_disableServiceAccountKeyCreation" { + source = "terraform-google-modules/org-policy/google//modules/org_policy_v2" + version = "~> 5.2.0" + + policy_root = "project" + policy_root_id = var.project + rules = [{ + enforcement = false + allow = [] + deny = [] + conditions = [] + }] + constraint = "iam.disableServiceAccountKeyCreation" + policy_type = "boolean" +} + +module "gcp_org_policy_v2_vmCanIpForward" { + source = "terraform-google-modules/org-policy/google//modules/org_policy_v2" + version = "~> 5.2.0" + + policy_root = "project" + policy_root_id = var.project + rules = [{ + enforcement = false + allow = [] + deny = [] + conditions = [] + }] + constraint = "compute.vmCanIpForward" + policy_type = "list" +} + +module "gcp_org_policy_v2_vmExternalIpAccess" { + source = "terraform-google-modules/org-policy/google//modules/org_policy_v2" + version = "~> 5.2.0" + + policy_root = "project" + policy_root_id = var.project + rules = [{ + enforcement = false + allow = [] + deny = [] + conditions = [] + }] + constraint = "compute.vmExternalIpAccess" + policy_type = "list" +} diff --git a/infrastructure/org-policies/project-services.tf b/infrastructure/org-policies/project-services.tf new file mode 100644 index 0000000..02c5c11 --- /dev/null +++ b/infrastructure/org-policies/project-services.tf @@ -0,0 +1,21 @@ +# Copyright 2023 Google LLC All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +resource "google_project_services" "project" { + project = var.project + services = ["iam.googleapis.com", + "cloudresourcemanager.googleapis.com", + "orgpolicy.googleapis.com" + ] +} \ No newline at end of file diff --git a/infrastructure/org-policies/providers.tf b/infrastructure/org-policies/providers.tf new file mode 100644 index 0000000..0b8e839 --- /dev/null +++ b/infrastructure/org-policies/providers.tf @@ -0,0 +1,23 @@ +# Copyright 2023 Google LLC All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +provider "google" { + project = var.project + user_project_override = true +} + +provider "google-beta" { + project = var.project + user_project_override = true +} \ No newline at end of file diff --git a/infrastructure/org-policies/terraform.tfvars.sample b/infrastructure/org-policies/terraform.tfvars.sample new file mode 100644 index 0000000..90137aa --- /dev/null +++ b/infrastructure/org-policies/terraform.tfvars.sample @@ -0,0 +1,24 @@ +# Copyright 2023 Google LLC All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + + +# Replace PROJECT_ID value shown below with your specific GCP Project ID. +# This the Project ID that Org Policy changes will be applied to. +project = "PROJECT_ID" + +# GCP APIs to enable +gcp_project_services = [ + "cloudresourcemanager.googleapis.com", + "orgpolicy.googleapis.com" +] \ No newline at end of file diff --git a/infrastructure/org-policies/variables.tf b/infrastructure/org-policies/variables.tf new file mode 100644 index 0000000..0884392 --- /dev/null +++ b/infrastructure/org-policies/variables.tf @@ -0,0 +1,20 @@ +# Copyright 2023 Google LLC All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +### Project Variables ### + +variable "project" { + type = string + description = "GCP Project ID" +} \ No newline at end of file From 38bd3c3fb5957205b4da6436656964f01ed9069b Mon Sep 17 00:00:00 2001 From: Ben Huston Date: Tue, 11 Apr 2023 12:09:07 +0000 Subject: [PATCH 2/3] Add checks to guarantee resource creation order --- infrastructure/org-policies/main.tf | 1 - infrastructure/org-policies/org-policies.tf | 8 ++++++ .../org-policies/project-services.tf | 26 +++++++++++++++---- infrastructure/org-policies/variables.tf | 8 +++++- 4 files changed, 36 insertions(+), 7 deletions(-) diff --git a/infrastructure/org-policies/main.tf b/infrastructure/org-policies/main.tf index 4082def..fce033c 100644 --- a/infrastructure/org-policies/main.tf +++ b/infrastructure/org-policies/main.tf @@ -17,7 +17,6 @@ terraform { google = { source = "hashicorp/google" version = "4.56.0" - user_project_override = true } } diff --git a/infrastructure/org-policies/org-policies.tf b/infrastructure/org-policies/org-policies.tf index cf188be..3c8e414 100644 --- a/infrastructure/org-policies/org-policies.tf +++ b/infrastructure/org-policies/org-policies.tf @@ -27,6 +27,8 @@ module "gcp_org_policy_v2_requireShieldedVm" { }] constraint = "compute.requireShieldedVm" policy_type = "boolean" + + depends_on = [google_project_service.project] } module "gcp_org_policy_v2_disableServiceAccountKeyCreation" { @@ -43,6 +45,8 @@ module "gcp_org_policy_v2_disableServiceAccountKeyCreation" { }] constraint = "iam.disableServiceAccountKeyCreation" policy_type = "boolean" + + depends_on = [google_project_service.project] } module "gcp_org_policy_v2_vmCanIpForward" { @@ -59,6 +63,8 @@ module "gcp_org_policy_v2_vmCanIpForward" { }] constraint = "compute.vmCanIpForward" policy_type = "list" + + depends_on = [google_project_service.project] } module "gcp_org_policy_v2_vmExternalIpAccess" { @@ -75,4 +81,6 @@ module "gcp_org_policy_v2_vmExternalIpAccess" { }] constraint = "compute.vmExternalIpAccess" policy_type = "list" + + depends_on = [google_project_service.project] } diff --git a/infrastructure/org-policies/project-services.tf b/infrastructure/org-policies/project-services.tf index 02c5c11..75b0151 100644 --- a/infrastructure/org-policies/project-services.tf +++ b/infrastructure/org-policies/project-services.tf @@ -12,10 +12,26 @@ # See the License for the specific language governing permissions and # limitations under the License. -resource "google_project_services" "project" { +resource "google_project_service" "project" { project = var.project - services = ["iam.googleapis.com", - "cloudresourcemanager.googleapis.com", - "orgpolicy.googleapis.com" - ] + for_each = toset(var.gcp_project_services) + service = each.value + + timeouts { + create = "30m" + update = "40m" + } + + # Ensure service is truly active before continuing onward + provisioner "local-exec" { + command = < Date: Tue, 11 Apr 2023 14:08:35 +0000 Subject: [PATCH 3/3] Add troubleshooting README --- infrastructure/org-policies/README | 0 infrastructure/org-policies/README.md | 108 ++++++++++++++++++++++++++ 2 files changed, 108 insertions(+) delete mode 100644 infrastructure/org-policies/README create mode 100644 infrastructure/org-policies/README.md diff --git a/infrastructure/org-policies/README b/infrastructure/org-policies/README deleted file mode 100644 index e69de29..0000000 diff --git a/infrastructure/org-policies/README.md b/infrastructure/org-policies/README.md new file mode 100644 index 0000000..1b61826 --- /dev/null +++ b/infrastructure/org-policies/README.md @@ -0,0 +1,108 @@ +# Troubleshooting Org Policy Issues + +Have you encountered any error messages related to `compute.requireShieldedVm`, `iam.disableServiceAccountKeyCreation`, `compute.vmCanIpForward`, or `compute.vmExternalIpAccess` when following the instructions in this repo's [quickstart guide](https://github.com/googleforgames/global-multiplayer-demo/blob/main/README.md)? If so, please try the steps outlined in this README to update your GCP Org Policies in a manner that meets this demo's minimum requirements. + +**BELOW:** Example error arising from a conflict with default Org Policy settings. +```shell +│ Error: Error creating service account key: googleapi: Error 400: Key creation is not allowed on this service account. +│ Details: +│ [ +│ { +│ "@type": "type.googleapis.com/google.rpc.PreconditionFailure", +│ "violations": [ +│ { +│ "description": "Key creation is not allowed on this service account.", +│ "subject": "projects/gameops-001/serviceAccounts/allocation-endpoint-esp-sa@gameops-001.iam.gserviceaccount.com?configvalue=allocation-endpoint-esp-sa%40gameops-001.iam.gserviceaccount.com", +│ "type": "constraints/iam.disableServiceAccountKeyCreation" +│ } +│ ] +│ } +│ ] +│ , failedPrecondition +│ +│ with google_service_account_key.ae_sa_key, +│ on allocation-endpoint.tf line 54, in resource "google_service_account_key" "ae_sa_key": +│ 54: resource "google_service_account_key" "ae_sa_key" { +│ omitted... +``` +### Double-check the prerequisites + +Please read this repo's [primary README](https://github.com/googleforgames/global-multiplayer-demo/blob/main/README.md) and ensure that all its main prerequisites have been met, such as creating a GCP Project + +### Set up your environment + +Navigate to this repo's `infrastructure/org-policies` subdirectory and then please run the following commands. + +```shell +# Set your GCP Project ID +export PROJECT_ID= +gcloud config set project ${PROJECT_ID} + +# Add this value to your default tfvars file +sed -i 's/PROJECT_ID/${PROJECT_ID}/g' terraform.tfvars.sample +cp terraform.tfvars.sample terraform.tfvar + +# Set your GCP Organization ID +export ORGANIZATION_ID= + +# Enter the email address that you use to authenticate with GCP +export GCP_EMAIL_ADRESS= +``` + +### Authenticate your user identity and generate Application Default Credentials (ADC) + +Run the following command to simultanously authenticate you as an end user with Google Cloud and to obtain a set of Application Default Credentials. Later on in this README, Terraform will perform a `user_project_override` and leverage your user identity to provision GCP org policies. This is neccessary because org policies are a protected resource that (usually) cannot be edited with standard ADC credentials. + +```shell +gcloud auth login --no-launch-browser --brief --update-adc --quiet +``` + +### Update any missing org-level GCP IAM permissions + +If you are already a super user in your GCP organization, run the following commands to ensure that you have the IAM permissions neccessary to edit GCP Org Policy resources. + +```shell +gcloud organizations add-iam-policy-binding ${ORGANIZATION_ID} --condition=None --member="user:${GCP_EMAIL_ADRESS}" --role="roles/orgpolicy.PolicyAdmin" +``` + +If you do not have such elevated permissions, please share this README with your platform administrator and request that they either (1) grant you this IAM permission, or (2) run the provisioning steps in this guide on your behalf. + +### Apply project-scoped overrides to your default GCP org policies + +Now that you are authenticated and have the neccessary IAM permissions in place, run the following commands to create a few project-scoped overrides to your default org policies. + +```shell +terraform init +terraform apply +``` +More specifically, this step will edit the four [organization policy constraints](https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints) listed below. + +- `compute.requireShieldedVm` +- `iam.disableServiceAccountKeyCreation` +- `compute.vmCanIpForward` +- `compute.vmExternalIpAccess` + +### Final Step + +Once you have completed this README, return to this repo's [quickstart guide](https://github.com/googleforgames/global-multiplayer-demo/blob/main/README.md) and try running through its instructions once again. With any luck, your org policy issues will be resolved and you will be able to successfully finish provisioning the demo. + +**BELOW:** Example output shown when Terraform successfully updates the organization policy constraints. +```shell +...omitted +google_project_service.project["cloudresourcemanager.googleapis.com"]: Creation complete after 7s [id=planet-scale-demo-044/cloudresourcemanager.googleapis.com] +module.gcp_org_policy_v2_vmCanIpForward.google_org_policy_policy.project_policy[0]: Creating... +module.gcp_org_policy_v2_disableServiceAccountKeyCreation.google_org_policy_policy.project_policy_boolean[0]: Creating... +module.gcp_org_policy_v2_vmExternalIpAccess.google_org_policy_policy.project_policy[0]: Creating... +module.gcp_org_policy_v2_requireShieldedVm.google_org_policy_policy.project_policy_boolean[0]: Creating... +module.gcp_org_policy_v2_vmCanIpForward.google_org_policy_policy.project_policy[0]: Creation complete after 3s [id=projects/planet-scale-demo-044/policies/compute.vmCanIpForward] +module.gcp_org_policy_v2_vmExternalIpAccess.google_org_policy_policy.project_policy[0]: Creation complete after 3s [id=projects/planet-scale-demo-044/policies/compute.vmExternalIpAccess] +module.gcp_org_policy_v2_requireShieldedVm.google_org_policy_policy.project_policy_boolean[0]: Creation complete after 4s [id=projects/planet-scale-demo-044/policies/compute.requireShieldedVm] +module.gcp_org_policy_v2_disableServiceAccountKeyCreation.google_org_policy_policy.project_policy_boolean[0]: Creation complete after 4s [id=projects/planet-scale-demo-044/policies/iam.disableServiceAccountKeyCreation] +Apply complete! Resources: 6 added, 0 changed, 0 destroyed. +``` + +## Licence + +Apache 2.0 + +This is not an officially supported Google product