use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-workspace-manager by DataBiosphere.
the class GcpCloudSyncStep method doStep.
@Override
public StepResult doStep(FlightContext flightContext) throws InterruptedException, RetryException {
String gcpProjectId = flightContext.getWorkingMap().get(GCP_PROJECT_ID, String.class);
FlightMap workingMap = flightContext.getWorkingMap();
// Read Sam groups for each workspace role.
Map<WsmIamRole, String> workspaceRoleGroupsMap = workingMap.get(WorkspaceFlightMapKeys.IAM_GROUP_EMAIL_MAP, new TypeReference<>() {
});
try {
Policy currentPolicy = resourceManagerCow.projects().getIamPolicy(gcpProjectId, new GetIamPolicyRequest()).execute();
List<Binding> newBindings = new ArrayList<>();
// Add all existing bindings to ensure we don't accidentally clobber existing permissions.
newBindings.addAll(currentPolicy.getBindings());
// Add appropriate project-level roles for each WSM IAM role.
workspaceRoleGroupsMap.forEach((role, email) -> newBindings.add(bindingForRole(role, email, gcpProjectId)));
Policy newPolicy = new Policy().setVersion(currentPolicy.getVersion()).setBindings(newBindings).setEtag(currentPolicy.getEtag());
SetIamPolicyRequest iamPolicyRequest = new SetIamPolicyRequest().setPolicy(newPolicy);
logger.info("Setting new Cloud Context IAM policy: " + iamPolicyRequest.toPrettyString());
resourceManagerCow.projects().setIamPolicy(gcpProjectId, iamPolicyRequest).execute();
} catch (IOException e) {
throw new RetryableCrlException("Error setting IAM permissions", e);
}
return StepResult.getStepResultSuccess();
}
use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-workspace-manager by DataBiosphere.
the class GrantWsmRoleAdminStep method doStep.
@Override
public StepResult doStep(FlightContext context) throws InterruptedException, RetryException {
String wsmSaEmail = GcpUtils.getWsmSaEmail(crlService.getApplicationCredentials());
String projectId = context.getWorkingMap().get(WorkspaceFlightMapKeys.GCP_PROJECT_ID, String.class);
try {
Policy policy = crlService.getCloudResourceManagerCow().projects().getIamPolicy(projectId, new GetIamPolicyRequest()).execute();
Binding bindingToAdd = new Binding().setMembers(Collections.singletonList("serviceAccount:" + wsmSaEmail)).setRole("roles/iam.roleAdmin");
List<Binding> bindingList = policy.getBindings();
bindingList.add(bindingToAdd);
policy.setBindings(bindingList);
SetIamPolicyRequest iamPolicyRequest = new SetIamPolicyRequest().setPolicy(policy);
crlService.getCloudResourceManagerCow().projects().setIamPolicy(projectId, iamPolicyRequest).execute();
} catch (IOException e) {
throw new InternalServerErrorException("Error while granting WSM SA the Role Admin role", e);
}
return StepResult.getStepResultSuccess();
}
use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-cli by DataBiosphere.
the class Workspace method grantBreakGlass.
/**
* Grant break-glass access to a user of this workspace. The Editor and Project IAM Admin roles
* are granted to the user's proxy group.
*
* @param granteeEmail email of the workspace user requesting break-glass access
* @param userProjectsAdminCredentials credentials for a SA that has permission to set IAM policy
* on workspace projects in this WSM deployment (e.g. WSM application SA)
* @return the proxy group email of the workspace user that was granted break-glass access
*/
public String grantBreakGlass(String granteeEmail, ServiceAccountCredentials userProjectsAdminCredentials) {
// fetch the user's proxy group email from SAM
String granteeProxyGroupEmail = SamService.fromContext().getProxyGroupEmail(granteeEmail);
logger.debug("granteeProxyGroupEmail: {}", granteeProxyGroupEmail);
// grant the Editor role to the user's proxy group email on the workspace project
CloudResourceManagerCow resourceManagerCow = CrlUtils.createCloudResourceManagerCow(userProjectsAdminCredentials);
try {
Policy policy = resourceManagerCow.projects().getIamPolicy(googleProjectId, new GetIamPolicyRequest()).execute();
List<Binding> updatedBindings = Optional.ofNullable(policy.getBindings()).orElse(new ArrayList<>());
updatedBindings.add(new Binding().setRole("roles/editor").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
updatedBindings.add(new Binding().setRole("roles/resourcemanager.projectIamAdmin").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
policy.setBindings(updatedBindings);
resourceManagerCow.projects().setIamPolicy(googleProjectId, new SetIamPolicyRequest().setPolicy(policy)).execute();
} catch (IOException ioEx) {
throw new SystemException("Error granting the Editor and Project IAM Admin roles to the user's proxy group.", ioEx);
}
return granteeProxyGroupEmail;
}
use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-resource-buffer by DataBiosphere.
the class SetIamPolicyStep method doStep.
@Override
public StepResult doStep(FlightContext flightContext) throws RetryException {
// Skip if IAM binding is not set.
if (gcpProjectConfig.getIamBindings() == null || gcpProjectConfig.getIamBindings().isEmpty()) {
return StepResult.getStepResultSuccess();
}
String projectId = flightContext.getWorkingMap().get(GOOGLE_PROJECT_ID, String.class);
try {
Policy policy = rmCow.projects().getIamPolicy(projectId, new GetIamPolicyRequest()).execute();
gcpProjectConfig.getIamBindings().stream().map(iamBinding -> new Binding().setRole(iamBinding.getRole()).setMembers(iamBinding.getMembers())).forEach(policy.getBindings()::add);
rmCow.projects().setIamPolicy(projectId, new SetIamPolicyRequest().setPolicy(policy)).execute();
} catch (IOException e) {
logger.info("Error when setting IAM policy", e);
return new StepResult(StepStatus.STEP_RESULT_FAILURE_RETRY, e);
}
return StepResult.getStepResultSuccess();
}
use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-workspace-manager by DataBiosphere.
the class CreateGcpContextFlightTest method assertPolicyGroupsSynced.
/**
* Asserts that Sam groups are granted their appropriate IAM roles on a GCP project.
*/
private void assertPolicyGroupsSynced(UUID workspaceId, Project project) throws Exception {
Map<WsmIamRole, String> roleToSamGroup = Arrays.stream(WsmIamRole.values()).filter(role -> !role.equals(WsmIamRole.MANAGER)).collect(Collectors.toMap(Function.identity(), role -> "group:" + SamRethrow.onInterrupted(() -> mockSamService.syncWorkspacePolicy(workspaceId, role, userAccessUtils.defaultUserAuthRequest()), "syncWorkspacePolicy")));
Policy currentPolicy = crl.getCloudResourceManagerCow().projects().getIamPolicy(project.getProjectId(), new GetIamPolicyRequest()).execute();
for (WsmIamRole role : WsmIamRole.values()) {
// Don't check MANAGER role, which isn't synced to GCP.
if (role.equals(WsmIamRole.MANAGER)) {
continue;
}
assertRoleBindingInPolicy(role, roleToSamGroup.get(role), currentPolicy, project.getProjectId());
}
}
Aggregations