Skip to content

Commit a18b203

Browse files
aarturmaarturm
authored
feat: Add permissions for SFB recommended groups (#446)
* Added group and firecall permissions according to SFB on orgnization level. * 1-org README.md updated with new variables * Corrected permissions for firewall billing admin user * Corrected permissions for firewall billing admin user * Variable description and comments updates * Added group and firecall permissions according to SFB on orgnization level. * 1-org README.md updated with new variables * Corrected permissions for firewall billing admin user * Corrected permissions for firewall billing admin user * Variable description and comments updates
1 parent f609ecd commit a18b203

File tree

3 files changed

+176
-0
lines changed

3 files changed

+176
-0
lines changed

‎1-org/envs/shared/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,15 @@
2121
| enable\_hub\_and\_spoke | Enable Hub-and-Spoke architecture. | `bool` | `false` | no |
2222
| enable\_os\_login\_policy | Enable OS Login Organization Policy. | `bool` | `false` | no |
2323
| folder\_prefix | Name prefix to use for folders created. Should be the same in all steps. | `string` | `"fldr"` | no |
24+
| gcp\_audit\_viewer | Members are part of an audit team and view audit logs in the logging project. | `string` | `null` | no |
25+
| gcp\_billing\_admin\_user | Identity that has billing administrator permissions | `string` | `null` | no |
26+
| gcp\_billing\_creator\_user | Identity that can create billing accounts. | `string` | `null` | no |
27+
| gcp\_global\_secrets\_admin | G Suite or Cloud Identity group that members are responsible for putting secrets into Secrets Manager. | `string` | `null` | no |
28+
| gcp\_network\_viewer | G Suite or Cloud Identity group that members are part of the networking team and review network configurations | `string` | `null` | no |
29+
| gcp\_org\_admin\_user | Identity that has organization administrator permissions. | `string` | `null` | no |
30+
| gcp\_platform\_viewer | G Suite or Cloud Identity group that have the ability to view resource information across the Google Cloud organization. | `string` | `null` | no |
31+
| gcp\_scc\_admin | G Suite or Cloud Identity group that can administer Security Command Center. | `string` | `null` | no |
32+
| gcp\_security\_reviewer | G Suite or Cloud Identity group that members are part of the security team responsible for reviewing cloud security. | `string` | `null` | no |
2433
| interconnect\_project\_alert\_pubsub\_topic | The name of the Cloud Pub/Sub topic where budget related messages will be published, in the form of `projects/{project_id}/topics/{topic_id}` for the Dedicated Interconnect project. | `string` | `null` | no |
2534
| interconnect\_project\_alert\_spent\_percents | A list of percentages of the budget to alert on when threshold is exceeded for the Dedicated Interconnect project. | `list(number)` | <pre>[<br> 0.5,<br> 0.75,<br> 0.9,<br> 0.95<br>]</pre> | no |
2635
| interconnect\_project\_budget\_amount | The amount to use as the budget for the Dedicated Interconnect project. | `number` | `1000` | no |

‎1-org/envs/shared/iam.tf‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,116 @@ resource "google_organization_iam_member" "billing_viewer" {
8787
role = "roles/billing.viewer"
8888
member = "group:${var.billing_data_users}"
8989
}
90+
91+
/******************************************
92+
Groups permissions according to SFB (Section 6.2 - Users and groups) - IAM
93+
*****************************************/
94+
95+
resource "google_organization_iam_member" "organization_viewer" {
96+
count = var.gcp_platform_viewer != null && var.parent_folder == "" ? 1 : 0
97+
org_id = var.org_id
98+
role = "roles/viewer"
99+
member = "group:${var.gcp_platform_viewer}"
100+
}
101+
102+
resource "google_folder_iam_member" "organization_viewer" {
103+
count = var.gcp_platform_viewer != null && var.parent_folder != "" ? 1 : 0
104+
folder = "folders/${var.parent_folder}"
105+
role = "roles/viewer"
106+
member = "group:${var.gcp_platform_viewer}"
107+
}
108+
109+
resource "google_organization_iam_member" "security_reviewer" {
110+
count = var.gcp_security_reviewer != null && var.parent_folder == "" ? 1 : 0
111+
org_id = var.org_id
112+
role = "roles/iam.securityReviewer"
113+
member = "group:${var.gcp_security_reviewer}"
114+
}
115+
116+
resource "google_folder_iam_member" "security_reviewer" {
117+
count = var.gcp_security_reviewer != null && var.parent_folder != "" ? 1 : 0
118+
folder = "folders/${var.parent_folder}"
119+
role = "roles/iam.securityReviewer"
120+
member = "group:${var.gcp_security_reviewer}"
121+
}
122+
123+
resource "google_organization_iam_member" "network_viewer" {
124+
count = var.gcp_network_viewer != null && var.parent_folder == "" ? 1 : 0
125+
org_id = var.org_id
126+
role = "roles/compute.networkViewer"
127+
member = "group:${var.gcp_network_viewer}"
128+
}
129+
130+
resource "google_folder_iam_member" "network_viewer" {
131+
count = var.gcp_network_viewer != null && var.parent_folder != "" ? 1 : 0
132+
folder = "folders/${var.parent_folder}"
133+
role = "roles/compute.networkViewer"
134+
member = "group:${var.gcp_network_viewer}"
135+
}
136+
137+
resource "google_project_iam_member" "audit_log_viewer" {
138+
count = var.gcp_audit_viewer != null ? 1 : 0
139+
project = module.org_audit_logs.project_id
140+
role = "roles/logging.viewer"
141+
member = "group:${var.gcp_audit_viewer}"
142+
}
143+
144+
resource "google_project_iam_member" "audit_private_logviewer" {
145+
count = var.gcp_audit_viewer != null ? 1 : 0
146+
project = module.org_audit_logs.project_id
147+
role = "roles/logging.privateLogViewer"
148+
member = "group:${var.gcp_audit_viewer}"
149+
}
150+
151+
resource "google_project_iam_member" "audit_bq_data_viewer" {
152+
count = var.gcp_audit_viewer != null ? 1 : 0
153+
project = module.org_audit_logs.project_id
154+
role = "roles/bigquery.dataViewer"
155+
member = "group:${var.gcp_audit_viewer}"
156+
}
157+
158+
resource "google_project_iam_member" "scc_admin" {
159+
count = var.gcp_scc_admin != null ? 1 : 0
160+
project = module.scc_notifications.project_id
161+
role = "roles/securitycenter.adminEditor"
162+
member = "group:${var.gcp_scc_admin}"
163+
}
164+
165+
resource "google_project_iam_member" "global_secrets_admin" {
166+
count = var.gcp_global_secrets_admin != null ? 1 : 0
167+
project = module.org_secrets.project_id
168+
role = "roles/secretmanager.admin"
169+
member = "group:${var.gcp_global_secrets_admin}"
170+
}
171+
172+
/******************************************
173+
Privileged accounts permissions according to SFB (Section 6.3 - Privileged identities)
174+
*****************************************/
175+
176+
resource "google_organization_iam_member" "org_admin_user" {
177+
count = var.gcp_org_admin_user != null && var.parent_folder == "" ? 1 : 0
178+
org_id = var.org_id
179+
role = "roles/resourcemanager.organizationAdmin"
180+
member = "user:${var.gcp_org_admin_user}"
181+
}
182+
183+
resource "google_folder_iam_member" "org_admin_user" {
184+
count = var.gcp_org_admin_user != null && var.parent_folder != "" ? 1 : 0
185+
folder = "folders/${var.parent_folder}"
186+
role = "roles/resourcemanager.folderAdmin"
187+
member = "user:${var.gcp_org_admin_user}"
188+
}
189+
190+
resource "google_organization_iam_member" "billing_creator_user" {
191+
count = var.gcp_billing_creator_user != null && var.parent_folder == "" ? 1 : 0
192+
org_id = var.org_id
193+
role = "roles/billing.creator"
194+
member = "user:${var.gcp_billing_creator_user}"
195+
}
196+
197+
resource "google_billing_account_iam_member" "billing_admin_user" {
198+
count = var.gcp_billing_admin_user != null ? 1 : 0
199+
billing_account_id = var.billing_account
200+
role = "roles/billing.admin"
201+
member = "user:${var.gcp_billing_admin_user}"
202+
}

‎1-org/envs/shared/variables.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,3 +291,57 @@ variable "folder_prefix" {
291291
type = string
292292
default = "fldr"
293293
}
294+
295+
variable "gcp_platform_viewer" {
296+
description = "G Suite or Cloud Identity group that have the ability to view resource information across the Google Cloud organization."
297+
type = string
298+
default = null
299+
}
300+
301+
variable "gcp_security_reviewer" {
302+
description = "G Suite or Cloud Identity group that members are part of the security team responsible for reviewing cloud security."
303+
type = string
304+
default = null
305+
}
306+
307+
variable "gcp_network_viewer" {
308+
description = "G Suite or Cloud Identity group that members are part of the networking team and review network configurations"
309+
type = string
310+
default = null
311+
}
312+
313+
variable "gcp_scc_admin" {
314+
description = "G Suite or Cloud Identity group that can administer Security Command Center."
315+
type = string
316+
default = null
317+
}
318+
319+
variable "gcp_audit_viewer" {
320+
description = "Members are part of an audit team and view audit logs in the logging project."
321+
type = string
322+
default = null
323+
}
324+
325+
variable "gcp_global_secrets_admin" {
326+
description = "G Suite or Cloud Identity group that members are responsible for putting secrets into Secrets Manager."
327+
type = string
328+
default = null
329+
}
330+
331+
variable "gcp_org_admin_user" {
332+
description = "Identity that has organization administrator permissions."
333+
type = string
334+
default = null
335+
}
336+
337+
variable "gcp_billing_creator_user" {
338+
description = "Identity that can create billing accounts."
339+
type = string
340+
default = null
341+
}
342+
343+
variable "gcp_billing_admin_user" {
344+
description = "Identity that has billing administrator permissions"
345+
type = string
346+
default = null
347+
}

0 commit comments

Comments
 (0)