Skip to content

Commit 2956474

Browse files
PengyuanZhaoPengyuanZhao
authored
chore: add AWS/GCP missing permissions (#1790)
* chore: agentless missing permissions * chore: gcp missiong permissions
1 parent 9a7d8a8 commit 2956474

File tree

4 files changed

+55
-195
lines changed

4 files changed

+55
-195
lines changed

‎integration/gcp_generation_test.go‎

Lines changed: 0 additions & 192 deletions
Original file line numberDiff line numberDiff line change
@@ -785,198 +785,6 @@ func TestGenerationGcpWithExistingTerraform(t *testing.T) {
785785
assert.Empty(t, data)
786786
}
787787

788-
// Test integrations with folders to include/exclude
789-
func TestGenerationGcpFolders(t *testing.T) {
790-
os.Setenv("LW_NOCACHE", "true")
791-
defer os.Setenv("LW_NOCACHE", "")
792-
var final string
793-
794-
tfResult := runGcpGenerateTest(t,
795-
func(c *expect.Console) {
796-
expectsCliOutput(t, c, []MsgRspHandler{
797-
MsgRsp{cmd.QuestionGcpProjectID, projectId},
798-
MsgRsp{cmd.QuestionGcpOrganizationIntegration, "y"},
799-
MsgRsp{cmd.QuestionGcpOrganizationID, organizationId},
800-
MsgRsp{cmd.QuestionGcpEnableAgentless, "n"},
801-
MsgRsp{cmd.QuestionGcpEnableConfiguration, "y"},
802-
MsgRsp{cmd.QuestionGcpConfigurationIntegrationName, ""},
803-
MsgRsp{cmd.QuestionGcpEnableAuditLog, "y"},
804-
MsgRsp{cmd.QuestionGcpUseExistingSink, "n"},
805-
MsgRsp{cmd.QuestionGcpAuditLogIntegrationName, ""},
806-
MsgRsp{cmd.QuestionGcpCustomFilter, ""},
807-
MsgRsp{cmd.QuestionGcpCustomizeProjects, ""},
808-
MsgRsp{cmd.QuestionGcpServiceAccountCredsPath, ""},
809-
MsgRsp{cmd.QuestionUseExistingServiceAccount, "n"},
810-
MsgRsp{cmd.QuestionGcpCustomizeOutputLocation, ""},
811-
MsgRsp{cmd.QuestionRunTfPlan, "n"},
812-
})
813-
final, _ = c.ExpectEOF()
814-
},
815-
"generate",
816-
"cloud-account",
817-
"gcp",
818-
"--folders_to_include", "folder/abc",
819-
"--folders_to_include", "folder/def",
820-
"--folders_to_include", "folder/abc",
821-
"--folders_to_exclude", "folder/abc",
822-
"--folders_to_exclude", "folder/def",
823-
)
824-
825-
assertTerraformSaved(t, final)
826-
827-
buildTf, _ := gcp.NewTerraform(false, true, true, true,
828-
gcp.WithProjectId(projectId),
829-
gcp.WithOrganizationIntegration(true),
830-
gcp.WithOrganizationId(organizationId),
831-
gcp.WithFoldersToExclude([]string{"folder/abc", "folder/def"}),
832-
gcp.WithFoldersToInclude([]string{"folder/abc", "folder/abc", "folder/def"}),
833-
).Generate()
834-
assert.Equal(t, buildTf, tfResult)
835-
}
836-
837-
// Test integrations with shorthand flags to include/exclude folders
838-
func TestGenerationGcpFoldersShorthand(t *testing.T) {
839-
os.Setenv("LW_NOCACHE", "true")
840-
defer os.Setenv("LW_NOCACHE", "")
841-
var final string
842-
843-
tfResult := runGcpGenerateTest(t,
844-
func(c *expect.Console) {
845-
expectsCliOutput(t, c, []MsgRspHandler{
846-
MsgRsp{cmd.QuestionGcpProjectID, projectId},
847-
MsgRsp{cmd.QuestionGcpOrganizationIntegration, "y"},
848-
MsgRsp{cmd.QuestionGcpOrganizationID, organizationId},
849-
MsgRsp{cmd.QuestionGcpEnableAgentless, "n"},
850-
MsgRsp{cmd.QuestionGcpEnableConfiguration, "y"},
851-
MsgRsp{cmd.QuestionGcpConfigurationIntegrationName, ""},
852-
MsgRsp{cmd.QuestionGcpEnableAuditLog, "y"},
853-
MsgRsp{cmd.QuestionGcpUseExistingSink, "n"},
854-
MsgRsp{cmd.QuestionGcpAuditLogIntegrationName, ""},
855-
MsgRsp{cmd.QuestionGcpCustomFilter, ""},
856-
MsgRsp{cmd.QuestionGcpCustomizeProjects, ""},
857-
MsgRsp{cmd.QuestionGcpServiceAccountCredsPath, ""},
858-
MsgRsp{cmd.QuestionUseExistingServiceAccount, "n"},
859-
MsgRsp{cmd.QuestionGcpCustomizeOutputLocation, ""},
860-
MsgRsp{cmd.QuestionRunTfPlan, "n"},
861-
})
862-
final, _ = c.ExpectEOF()
863-
},
864-
"generate",
865-
"cloud-account",
866-
"gcp",
867-
"-i", "folder/abc",
868-
"-i", "folder/abc",
869-
"-i", "folder/def",
870-
"-e", "folder/abc",
871-
"-e", "folder/def",
872-
)
873-
874-
assertTerraformSaved(t, final)
875-
876-
buildTf, _ := gcp.NewTerraform(false, true, true, true,
877-
gcp.WithProjectId(projectId),
878-
gcp.WithOrganizationIntegration(true),
879-
gcp.WithOrganizationId(organizationId),
880-
gcp.WithFoldersToExclude([]string{"folder/abc", "folder/def"}),
881-
gcp.WithFoldersToInclude([]string{"folder/abc", "folder/abc", "folder/def"}),
882-
).Generate()
883-
assert.Equal(t, buildTf, tfResult)
884-
}
885-
886-
// Test integrations with --include_root_projects
887-
func TestGenerationGcpIncludeRootProjects(t *testing.T) {
888-
os.Setenv("LW_NOCACHE", "true")
889-
defer os.Setenv("LW_NOCACHE", "")
890-
var final string
891-
892-
tfResult := runGcpGenerateTest(t,
893-
func(c *expect.Console) {
894-
expectsCliOutput(t, c, []MsgRspHandler{
895-
MsgRsp{cmd.QuestionGcpProjectID, projectId},
896-
MsgRsp{cmd.QuestionGcpOrganizationIntegration, "y"},
897-
MsgRsp{cmd.QuestionGcpOrganizationID, organizationId},
898-
MsgRsp{cmd.QuestionGcpEnableAgentless, "n"},
899-
MsgRsp{cmd.QuestionGcpEnableConfiguration, "y"},
900-
MsgRsp{cmd.QuestionGcpConfigurationIntegrationName, ""},
901-
MsgRsp{cmd.QuestionGcpEnableAuditLog, "y"},
902-
MsgRsp{cmd.QuestionGcpUseExistingSink, "n"},
903-
MsgRsp{cmd.QuestionGcpAuditLogIntegrationName, ""},
904-
MsgRsp{cmd.QuestionGcpCustomFilter, ""},
905-
MsgRsp{cmd.QuestionGcpCustomizeProjects, ""},
906-
MsgRsp{cmd.QuestionGcpServiceAccountCredsPath, ""},
907-
MsgRsp{cmd.QuestionUseExistingServiceAccount, "n"},
908-
MsgRsp{cmd.QuestionGcpCustomizeOutputLocation, ""},
909-
MsgRsp{cmd.QuestionRunTfPlan, "n"},
910-
})
911-
final, _ = c.ExpectEOF()
912-
},
913-
"generate",
914-
"cloud-account",
915-
"gcp",
916-
"--folders_to_exclude",
917-
"folder/abc",
918-
"--include_root_projects",
919-
)
920-
921-
assertTerraformSaved(t, final)
922-
923-
buildTf, _ := gcp.NewTerraform(false, true, true, true,
924-
gcp.WithProjectId(projectId),
925-
gcp.WithOrganizationIntegration(true),
926-
gcp.WithOrganizationId(organizationId),
927-
gcp.WithFoldersToExclude([]string{"folder/abc"}),
928-
gcp.WithIncludeRootProjects(true),
929-
).Generate()
930-
assert.Equal(t, buildTf, tfResult)
931-
}
932-
933-
// Test integrations with --include_root_projects=false
934-
func TestGenerationGcpIncludeRootProjectsFalse(t *testing.T) {
935-
os.Setenv("LW_NOCACHE", "true")
936-
defer os.Setenv("LW_NOCACHE", "")
937-
var final string
938-
939-
tfResult := runGcpGenerateTest(t,
940-
func(c *expect.Console) {
941-
expectsCliOutput(t, c, []MsgRspHandler{
942-
MsgRsp{cmd.QuestionGcpProjectID, projectId},
943-
MsgRsp{cmd.QuestionGcpOrganizationIntegration, "y"},
944-
MsgRsp{cmd.QuestionGcpOrganizationID, organizationId},
945-
MsgRsp{cmd.QuestionGcpEnableAgentless, "n"},
946-
MsgRsp{cmd.QuestionGcpEnableConfiguration, "y"},
947-
MsgRsp{cmd.QuestionGcpConfigurationIntegrationName, ""},
948-
MsgRsp{cmd.QuestionGcpEnableAuditLog, "y"},
949-
MsgRsp{cmd.QuestionGcpUseExistingSink, "n"},
950-
MsgRsp{cmd.QuestionGcpAuditLogIntegrationName, ""},
951-
MsgRsp{cmd.QuestionGcpCustomFilter, ""},
952-
MsgRsp{cmd.QuestionGcpCustomizeProjects, ""},
953-
MsgRsp{cmd.QuestionGcpServiceAccountCredsPath, ""},
954-
MsgRsp{cmd.QuestionUseExistingServiceAccount, "n"},
955-
MsgRsp{cmd.QuestionGcpCustomizeOutputLocation, ""},
956-
MsgRsp{cmd.QuestionRunTfPlan, "n"},
957-
})
958-
final, _ = c.ExpectEOF()
959-
},
960-
"generate",
961-
"cloud-account",
962-
"gcp",
963-
"--folders_to_exclude",
964-
"folder/abc",
965-
"--include_root_projects=false",
966-
)
967-
968-
assertTerraformSaved(t, final)
969-
970-
buildTf, _ := gcp.NewTerraform(false, true, true, true,
971-
gcp.WithProjectId(projectId),
972-
gcp.WithOrganizationIntegration(true),
973-
gcp.WithOrganizationId(organizationId),
974-
gcp.WithFoldersToExclude([]string{"folder/abc"}),
975-
gcp.WithIncludeRootProjects(false),
976-
).Generate()
977-
assert.Equal(t, buildTf, tfResult)
978-
}
979-
980788
// Test Audit Log with --google_workspace_filter and --k8s_filter
981789
func TestGenerationGcpAuditLogFiltersTrue(t *testing.T) {
982790
os.Setenv("LW_NOCACHE", "true")

‎lwpreflight/aws/constants.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -547,6 +547,7 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
547547
"events:PutRule",
548548
"events:PutTargets",
549549
"events:RemoveTargets",
550+
"events:TagResource",
550551
"iam:AttachRolePolicy",
551552
"iam:CreatePolicy",
552553
"iam:CreateRole",
@@ -581,6 +582,7 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
581582
"logs:ListTagsLogGroup",
582583
"logs:PutLogEvents",
583584
"logs:PutRetentionPolicy",
585+
"logs:TagResource",
584586
"organizations:DescribeAccount",
585587
"organizations:DescribeOrganization",
586588
"organizations:ListAccounts",

‎lwpreflight/gcp/constants.go‎

Lines changed: 50 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,9 @@ var RequiredPermissions = map[IntegrationType][]string{
102102
"pubsub.topics.getIamPolicy",
103103
"pubsub.topics.list",
104104
"pubsub.topics.setIamPolicy",
105+
"resourcemanager.organizations.get",
106+
"resourcemanager.organizations.getIamPolicy",
107+
"resourcemanager.organizations.setIamPolicy",
105108
"resourcemanager.projects.get",
106109
"resourcemanager.projects.getIamPolicy",
107110
"resourcemanager.projects.setIamPolicy",
@@ -134,6 +137,9 @@ var RequiredPermissions = map[IntegrationType][]string{
134137
"iam.serviceAccounts.undelete",
135138
"iam.serviceAccounts.update",
136139
"monitoring.timeSeries.list",
140+
"resourcemanager.organizations.get",
141+
"resourcemanager.organizations.getIamPolicy",
142+
"resourcemanager.organizations.setIamPolicy",
137143
"resourcemanager.projects.get",
138144
"resourcemanager.projects.getIamPolicy",
139145
"resourcemanager.projects.list",
@@ -262,6 +268,21 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
262268
"essentialcontacts.contacts.list",
263269
"essentialcontacts.contacts.send",
264270
"essentialcontacts.contacts.update",
271+
"iam.roles.create",
272+
"iam.roles.delete",
273+
"iam.roles.get",
274+
"iam.roles.list",
275+
"iam.roles.undelete",
276+
"iam.roles.update",
277+
"iam.serviceAccountKeys.create",
278+
"iam.serviceAccountKeys.delete",
279+
"iam.serviceAccountKeys.get",
280+
"iam.serviceAccountKeys.list",
281+
"iam.serviceAccounts.actAs",
282+
"iam.serviceAccounts.create",
283+
"iam.serviceAccounts.delete",
284+
"iam.serviceAccounts.get",
285+
"iam.serviceAccounts.list",
265286
"logging.buckets.create",
266287
"logging.buckets.delete",
267288
"logging.buckets.get",
@@ -284,9 +305,9 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
284305
"logging.logMetrics.get",
285306
"logging.logMetrics.list",
286307
"logging.logMetrics.update",
287-
"logging.logs.list",
288308
"logging.logServiceIndexes.list",
289309
"logging.logServices.list",
310+
"logging.logs.list",
290311
"logging.notificationRules.create",
291312
"logging.notificationRules.delete",
292313
"logging.notificationRules.get",
@@ -310,6 +331,19 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
310331
"orgpolicy.constraints.list",
311332
"orgpolicy.policies.list",
312333
"orgpolicy.policy.get",
334+
"pubsub.subscriptions.create",
335+
"pubsub.subscriptions.delete",
336+
"pubsub.subscriptions.get",
337+
"pubsub.subscriptions.getIamPolicy",
338+
"pubsub.subscriptions.list",
339+
"pubsub.subscriptions.setIamPolicy",
340+
"pubsub.topics.attachSubscription",
341+
"pubsub.topics.create",
342+
"pubsub.topics.delete",
343+
"pubsub.topics.get",
344+
"pubsub.topics.getIamPolicy",
345+
"pubsub.topics.list",
346+
"pubsub.topics.setIamPolicy",
313347
"resourcemanager.folders.get",
314348
"resourcemanager.folders.getIamPolicy",
315349
"resourcemanager.folders.list",
@@ -321,6 +355,9 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
321355
"resourcemanager.projects.getIamPolicy",
322356
"resourcemanager.projects.list",
323357
"resourcemanager.projects.setIamPolicy",
358+
"serviceusage.quotas.get",
359+
"serviceusage.services.get",
360+
"serviceusage.services.list",
324361
},
325362
Config: {
326363
"billing.accounts.get",
@@ -342,6 +379,15 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
342379
"iam.roles.list",
343380
"iam.roles.undelete",
344381
"iam.roles.update",
382+
"iam.serviceAccountKeys.create",
383+
"iam.serviceAccountKeys.delete",
384+
"iam.serviceAccountKeys.get",
385+
"iam.serviceAccountKeys.list",
386+
"iam.serviceAccounts.actAs",
387+
"iam.serviceAccounts.create",
388+
"iam.serviceAccounts.delete",
389+
"iam.serviceAccounts.get",
390+
"iam.serviceAccounts.list",
345391
"orgpolicy.constraints.list",
346392
"orgpolicy.policies.list",
347393
"orgpolicy.policy.get",
@@ -356,6 +402,9 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
356402
"resourcemanager.projects.getIamPolicy",
357403
"resourcemanager.projects.list",
358404
"resourcemanager.projects.setIamPolicy",
405+
"serviceusage.quotas.get",
406+
"serviceusage.services.get",
407+
"serviceusage.services.list",
359408
},
360409
GkeAuditLog: {
361410
"iam.serviceAccountKeys.create",

‎lwpreflight/gcp/policy.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,10 @@ func FetchPolicies(p *Preflight) error {
4646
for _, m := range b.Members {
4747
if strings.Contains(strings.ToLower(m), strings.ToLower(p.caller.Email)) {
4848
role, err := iamSvc.Roles.Get(b.Role).Do()
49-
if err == nil {
50-
permissions = append(permissions, role.IncludedPermissions...)
49+
if err != nil {
50+
return err
5151
}
52+
permissions = append(permissions, role.IncludedPermissions...)
5253
roles[b.Role] = true
5354
break
5455
}

0 commit comments

Comments
 (0)