Skip to content

Commit 9bf4e87

Browse files
kunzesesce-taid
kunzese
authored and
sce-taid
committed
feat: use different service accounts for each ABFS component to permit separation of concerns
feat: rework overly permissive firewall rules BREAKING CHANGE: the name of the server's service account was changed from `sa-abfs` to `abfs-server`. If you already deployed an older version it is adviced to set `server_service_account_name = "sa-abfs"` in your `terraform.tfvars`. PiperOrigin-RevId: 818568538
1 parent b8934d1 commit 9bf4e87

File tree

7 files changed

+204
-102
lines changed

7 files changed

+204
-102
lines changed

‎examples/simple/.terraform.lock.hcl‎

Lines changed: 66 additions & 28 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/simple/abfs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ module "abfs_server" {
2727

2828
project_id = data.google_project.project.project_id
2929
zone = var.zone
30-
service_account_email = local.abfs_service_account_email
30+
service_account_email = local.server_service_account.email
3131
subnetwork = module.abfs_vpc.subnets["${var.region}/abfs-subnet"].name
3232
abfs_docker_image_uri = var.abfs_docker_image_uri
3333
abfs_license = var.abfs_license
@@ -42,7 +42,7 @@ module "abfs_uploaders" {
4242

4343
project_id = data.google_project.project.project_id
4444
zone = var.zone
45-
service_account_email = local.abfs_service_account_email
45+
service_account_email = local.uploader_service_account.email
4646
subnetwork = module.abfs_vpc.subnets["${var.region}/abfs-subnet"].name
4747
abfs_docker_image_uri = var.abfs_docker_image_uri
4848
abfs_gerrit_uploader_count = var.abfs_gerrit_uploader_count

‎examples/simple/compute.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ resource "google_compute_instance" "abfs_client" {
5555
provisioning_model = var.abfs_client_config.preemptible ? "SPOT" : "STANDARD"
5656
}
5757
service_account {
58-
email = local.abfs_service_account_email
58+
email = local.client_service_account.email
5959
scopes = var.abfs_client_config.scopes
6060
}
6161
shielded_instance_config {

‎examples/simple/iam.tf‎

Lines changed: 83 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -13,52 +13,107 @@
1313
# limitations under the License.
1414

1515
locals {
16-
# go/keep-sorted start
17-
abfs_iam_roles = [
18-
"roles/artifactregistry.reader",
19-
"roles/logging.logWriter",
20-
"roles/monitoring.metricWriter",
21-
"roles/monitoring.viewer",
22-
"roles/spanner.databaseUser",
23-
"roles/stackdriver.resourceMetadata.writer",
24-
"roles/storage.objectAdmin",
25-
]
26-
abfs_service_account_email = local.create_service_account ? google_service_account.abfs[0].email : data.google_service_account.abfs[0].email
27-
abfs_service_account_unique_id = local.create_service_account ? google_service_account.abfs[0].unique_id : data.google_service_account.abfs[0].unique_id
28-
create_service_account = var.abfs_service_account_id == ""
29-
# go/keep-sorted end
16+
create_server_service_account = var.server_service_account_id == ""
17+
server_service_account = local.create_server_service_account ? google_service_account.server[0] : data.google_service_account.server[0]
18+
19+
create_uploader_service_account = var.uploader_service_account_id == ""
20+
uploader_service_account = local.create_uploader_service_account ? google_service_account.uploader[0] : data.google_service_account.uploader[0]
21+
22+
create_client_service_account = var.client_service_account_id == ""
23+
client_service_account = var.create_client_instance_resource ? (local.create_client_service_account ? google_service_account.client[0] : data.google_service_account.client[0]) : null
24+
}
25+
26+
# Service Account - Server
27+
28+
moved {
29+
from = google_service_account.abfs[0]
30+
to = google_service_account.server[0]
31+
}
32+
33+
data "google_service_account" "server" {
34+
count = local.create_server_service_account ? 0 : 1
35+
36+
project = data.google_project.project.project_id
37+
account_id = var.server_service_account_id
38+
}
39+
40+
resource "google_service_account" "server" {
41+
count = local.create_server_service_account ? 1 : 0
42+
43+
project = data.google_project.project.project_id
44+
account_id = var.server_service_account_name
45+
display_name = "Service Account for ABFS Server"
46+
47+
lifecycle {
48+
# Prevent the service account that may have been granted an ABFS license from being deleted.
49+
prevent_destroy = true
50+
}
51+
}
52+
53+
# Service Account - Uploader
54+
55+
data "google_service_account" "uploader" {
56+
count = local.create_uploader_service_account ? 0 : 1
57+
58+
project = data.google_project.project.project_id
59+
account_id = var.uploader_service_account_id
60+
}
61+
62+
resource "google_service_account" "uploader" {
63+
count = local.create_uploader_service_account ? 1 : 0
64+
65+
project = data.google_project.project.project_id
66+
account_id = var.uploader_service_account_name
67+
display_name = "Service Account for ABFS Uploader"
68+
69+
lifecycle {
70+
# Prevent the service account that may have been granted an ABFS license from being deleted.
71+
prevent_destroy = true
72+
}
3073
}
3174

32-
data "google_service_account" "abfs" {
33-
count = local.create_service_account ? 0 : 1
75+
# Service Account - Client
76+
77+
data "google_service_account" "client" {
78+
count = var.create_client_instance_resource && ! local.create_client_service_account ? 1 : 0
3479

3580
project = data.google_project.project.project_id
36-
account_id = var.abfs_service_account_id
81+
account_id = var.client_service_account_id
3782
}
3883

39-
resource "google_service_account" "abfs" {
40-
count = local.create_service_account ? 1 : 0
84+
resource "google_service_account" "client" {
85+
count = var.create_client_instance_resource && local.create_client_service_account ? 1 : 0
4186

4287
project = data.google_project.project.project_id
43-
account_id = var.abfs_service_account_name
44-
display_name = "Service Account for ABFS"
88+
account_id = var.client_service_account_name
89+
display_name = "Service Account for ABFS Client"
4590

4691
lifecycle {
4792
# Prevent the service account that may have been granted an ABFS license from being deleted.
4893
prevent_destroy = true
4994
}
5095
}
5196

52-
resource "google_project_iam_member" "abfs_iam" {
53-
for_each = toset(local.abfs_iam_roles)
97+
module "project-iam-bindings" {
98+
source = "terraform-google-modules/iam/google//modules/projects_iam"
99+
version = "8.1.0"
54100

55-
project = data.google_project.project.project_id
56-
role = each.value
57-
member = "serviceAccount:${local.abfs_service_account_email}"
101+
projects = [data.google_project.project.project_id]
102+
mode = "authoritative"
103+
104+
bindings = {
105+
"roles/logging.logWriter" = [local.server_service_account.member, local.uploader_service_account.member],
106+
"roles/monitoring.metricWriter" = [local.server_service_account.member, local.uploader_service_account.member],
107+
"roles/monitoring.viewer" = [local.server_service_account.member, local.uploader_service_account.member],
108+
"roles/spanner.databaseUser" = [local.server_service_account.member],
109+
"roles/stackdriver.resourceMetadata.writer" = [local.server_service_account.member, local.uploader_service_account.member],
110+
"roles/storage.objectAdmin" = [local.server_service_account.member],
111+
}
58112

59113
depends_on = [
60114
module.project-services,
61-
data.google_service_account.abfs,
62-
google_service_account.abfs
115+
local.server_service_account,
116+
local.uploader_service_account,
117+
local.client_service_account,
63118
]
64119
}

‎examples/simple/network.tf‎

Lines changed: 7 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -26,20 +26,6 @@ module "abfs_vpc" {
2626
routing_mode = "GLOBAL"
2727

2828
firewall_rules = [
29-
{
30-
description = "Allow egress to Google APIs via Private Google Access"
31-
direction = "EGRESS"
32-
name = "allow-egress-google-apis"
33-
priority = 1000
34-
ranges = ["199.36.153.8/30", "34.126.0.0/18"]
35-
target_service_accounts = [local.abfs_service_account_email]
36-
37-
allow = [
38-
{
39-
protocol = "tcp"
40-
}
41-
]
42-
},
4329
{
4430
name = "allow-ssh-tunnel-iap"
4531
description = "Allow ssh tunnel-through-iap to ABFS server VMs"
@@ -58,29 +44,21 @@ module "abfs_vpc" {
5844
]
5945
},
6046
{
61-
name = "allow-internal-ingress"
62-
description = "Allow all ingress between VMs using the ABFS service account"
47+
name = "abfs-server-allow-ingress"
48+
description = "Allow ingress from the ABFS uploaders and clients to the ABFS server"
6349
direction = "INGRESS"
6450
priority = 1000
6551

66-
ranges = ["0.0.0.0/0"]
67-
source_service_accounts = [local.abfs_service_account_email]
68-
target_service_accounts = [local.abfs_service_account_email]
52+
source_service_accounts = compact([local.uploader_service_account.email, var.create_client_instance_resource ? local.client_service_account.email : null])
53+
target_service_accounts = [local.server_service_account.email]
54+
6955
allow = [
70-
{
71-
protocol = "icmp"
72-
ports = []
73-
},
7456
{
7557
protocol = "tcp"
76-
ports = ["0-65535"]
77-
},
78-
{
79-
protocol = "udp"
80-
ports = ["0-65535"]
58+
ports = ["50051"]
8159
},
8260
]
83-
}
61+
},
8462
]
8563

8664
subnets = [

‎examples/simple/outputs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ output "license_information" {
1616
value = {
1717
project_id = data.google_project.project.project_id,
1818
project_number = data.google_project.project.number,
19-
service_account_email = local.abfs_service_account_email
20-
service_account_unique_id = local.abfs_service_account_unique_id
19+
service_account_email = local.server_service_account.email
20+
service_account_unique_id = local.server_service_account.unique_id
2121
}
2222
}
2323

0 commit comments

Comments
 (0)