Examples with WsmIamRole bio.terra.workspace.service.iam.model.WsmIamRole used on opensource projects

Example 1 with WsmIamRole

use of bio.terra.workspace.service.iam.model.WsmIamRole in project terra-workspace-manager by DataBiosphere.

the class CreateGcpContextFlightV2Test method assertPolicyGroupsSynced.

/**
 * Asserts that Sam groups are granted their appropriate IAM roles on a GCP project.
 */
private void assertPolicyGroupsSynced(UUID workspaceId, Project project) throws Exception {
    Map<WsmIamRole, String> roleToSamGroup = Arrays.stream(WsmIamRole.values()).collect(Collectors.toMap(Function.identity(), role -> "group:" + SamRethrow.onInterrupted(() -> mockSamService.syncWorkspacePolicy(workspaceId, role, userAccessUtils.defaultUserAuthRequest()), "syncWorkspacePolicy")));
    Policy currentPolicy = crl.getCloudResourceManagerCow().projects().getIamPolicy(project.getProjectId(), new GetIamPolicyRequest()).execute();
    for (WsmIamRole role : WsmIamRole.values()) {
        // Don't check MANAGER role, which isn't synced to GCP.
        if (role.equals(WsmIamRole.MANAGER)) {
            continue;
        }
        assertRoleBindingInPolicy(role, roleToSamGroup.get(role), currentPolicy, project.getProjectId());
    }
}

Example 2 with WsmIamRole

use of bio.terra.workspace.service.iam.model.WsmIamRole in project terra-workspace-manager by DataBiosphere.

the class SamService method defaultWorkspacePolicies.

/**
 * Builds a policy list with a single provided owner and empty reader, writer and application
 * policies.
 *
 * <p>This is a helper function for building the policy section of a request to create a workspace
 * resource in Sam. The provided user is granted the OWNER role and empty policies for reader,
 * writer, and application are also included.
 *
 * <p>The empty policies are included because Sam requires all policies on a workspace to be
 * provided at creation time. Although policy membership can be modified later, policy creation
 * must happen at the same time as workspace resource creation.
 */
private Map<String, AccessPolicyMembershipV2> defaultWorkspacePolicies(String ownerEmail) {
    Map<String, AccessPolicyMembershipV2> policyMap = new HashMap<>();
    policyMap.put(WsmIamRole.OWNER.toSamRole(), new AccessPolicyMembershipV2().addRolesItem(WsmIamRole.OWNER.toSamRole()).addMemberEmailsItem(ownerEmail));
    // For all non-owner/manager roles, we create empty policies which can be modified later.
    for (WsmIamRole workspaceRole : WsmIamRole.values()) {
        if (workspaceRole != WsmIamRole.OWNER && workspaceRole != WsmIamRole.MANAGER) {
            policyMap.put(workspaceRole.toSamRole(), new AccessPolicyMembershipV2().addRolesItem(workspaceRole.toSamRole()));
        }
    }
    // We always give WSM's service account the 'manager' role for admin control of workspaces.
    String wsmSa = GcpUtils.getWsmSaEmail();
    policyMap.put(WsmIamRole.MANAGER.toSamRole(), new AccessPolicyMembershipV2().addRolesItem(WsmIamRole.MANAGER.toSamRole()).addMemberEmailsItem(wsmSa));
    return policyMap;
}

Example 3 with WsmIamRole

use of bio.terra.workspace.service.iam.model.WsmIamRole in project terra-workspace-manager by DataBiosphere.

the class CreateGcpContextFlightTest method assertPolicyGroupsSynced.

/**
 * Asserts that Sam groups are granted their appropriate IAM roles on a GCP project.
 */
private void assertPolicyGroupsSynced(UUID workspaceId, Project project) throws Exception {
    Map<WsmIamRole, String> roleToSamGroup = Arrays.stream(WsmIamRole.values()).filter(role -> !role.equals(WsmIamRole.MANAGER)).collect(Collectors.toMap(Function.identity(), role -> "group:" + SamRethrow.onInterrupted(() -> mockSamService.syncWorkspacePolicy(workspaceId, role, userAccessUtils.defaultUserAuthRequest()), "syncWorkspacePolicy")));
    Policy currentPolicy = crl.getCloudResourceManagerCow().projects().getIamPolicy(project.getProjectId(), new GetIamPolicyRequest()).execute();
    for (WsmIamRole role : WsmIamRole.values()) {
        // Don't check MANAGER role, which isn't synced to GCP.
        if (role.equals(WsmIamRole.MANAGER)) {
            continue;
        }
        assertRoleBindingInPolicy(role, roleToSamGroup.get(role), currentPolicy, project.getProjectId());
    }
}

Example 4 with WsmIamRole

use of bio.terra.workspace.service.iam.model.WsmIamRole in project terra-workspace-manager by DataBiosphere.

the class GcpCloudSyncStep method doStep.

@Override
public StepResult doStep(FlightContext flightContext) throws InterruptedException, RetryException {
    String gcpProjectId = flightContext.getWorkingMap().get(GCP_PROJECT_ID, String.class);
    FlightMap workingMap = flightContext.getWorkingMap();
    // Read Sam groups for each workspace role.
    Map<WsmIamRole, String> workspaceRoleGroupsMap = workingMap.get(WorkspaceFlightMapKeys.IAM_GROUP_EMAIL_MAP, new TypeReference<>() {
    });
    try {
        Policy currentPolicy = resourceManagerCow.projects().getIamPolicy(gcpProjectId, new GetIamPolicyRequest()).execute();
        List<Binding> newBindings = new ArrayList<>();
        // Add all existing bindings to ensure we don't accidentally clobber existing permissions.
        newBindings.addAll(currentPolicy.getBindings());
        // Add appropriate project-level roles for each WSM IAM role.
        workspaceRoleGroupsMap.forEach((role, email) -> newBindings.add(bindingForRole(role, email, gcpProjectId)));
        Policy newPolicy = new Policy().setVersion(currentPolicy.getVersion()).setBindings(newBindings).setEtag(currentPolicy.getEtag());
        SetIamPolicyRequest iamPolicyRequest = new SetIamPolicyRequest().setPolicy(newPolicy);
        logger.info("Setting new Cloud Context IAM policy: " + iamPolicyRequest.toPrettyString());
        resourceManagerCow.projects().setIamPolicy(gcpProjectId, iamPolicyRequest).execute();
    } catch (IOException e) {
        throw new RetryableCrlException("Error setting IAM permissions", e);
    }
    return StepResult.getStepResultSuccess();
}

Example 5 with WsmIamRole

use of bio.terra.workspace.service.iam.model.WsmIamRole in project terra-workspace-manager by DataBiosphere.

the class UpdateDbGcpCloudContextStep method doStep.

@Override
public StepResult doStep(FlightContext flightContext) throws InterruptedException {
    FlightUtils.validateRequiredEntries(flightContext.getWorkingMap(), GCP_PROJECT_ID, IAM_GROUP_EMAIL_MAP);
    String projectId = flightContext.getWorkingMap().get(GCP_PROJECT_ID, String.class);
    Map<WsmIamRole, String> workspaceRoleGroupsMap = flightContext.getWorkingMap().get(WorkspaceFlightMapKeys.IAM_GROUP_EMAIL_MAP, new TypeReference<>() {
    });
    GcpCloudContext context = new GcpCloudContext(projectId, workspaceRoleGroupsMap.get(WsmIamRole.OWNER), workspaceRoleGroupsMap.get(WsmIamRole.WRITER), workspaceRoleGroupsMap.get(WsmIamRole.READER), workspaceRoleGroupsMap.get(WsmIamRole.APPLICATION));
    gcpCloudContextService.createGcpCloudContextFinish(workspaceId, context, flightContext.getFlightId());
    CloudContextHolder cch = new CloudContextHolder();
    cch.setGcpCloudContext(context);
    FlightUtils.setResponse(flightContext, cch, HttpStatus.OK);
    return StepResult.getStepResultSuccess();
}