Search in sources :

Example 11 with GetIamPolicyRequest

use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-workspace-manager by DataBiosphere.

the class GcpCloudSyncStep method doStep.

@Override
public StepResult doStep(FlightContext flightContext) throws InterruptedException, RetryException {
    String gcpProjectId = flightContext.getWorkingMap().get(GCP_PROJECT_ID, String.class);
    FlightMap workingMap = flightContext.getWorkingMap();
    // Read Sam groups for each workspace role.
    Map<WsmIamRole, String> workspaceRoleGroupsMap = workingMap.get(WorkspaceFlightMapKeys.IAM_GROUP_EMAIL_MAP, new TypeReference<>() {
    });
    try {
        Policy currentPolicy = resourceManagerCow.projects().getIamPolicy(gcpProjectId, new GetIamPolicyRequest()).execute();
        List<Binding> newBindings = new ArrayList<>();
        // Add all existing bindings to ensure we don't accidentally clobber existing permissions.
        newBindings.addAll(currentPolicy.getBindings());
        // Add appropriate project-level roles for each WSM IAM role.
        workspaceRoleGroupsMap.forEach((role, email) -> newBindings.add(bindingForRole(role, email, gcpProjectId)));
        Policy newPolicy = new Policy().setVersion(currentPolicy.getVersion()).setBindings(newBindings).setEtag(currentPolicy.getEtag());
        SetIamPolicyRequest iamPolicyRequest = new SetIamPolicyRequest().setPolicy(newPolicy);
        logger.info("Setting new Cloud Context IAM policy: " + iamPolicyRequest.toPrettyString());
        resourceManagerCow.projects().setIamPolicy(gcpProjectId, iamPolicyRequest).execute();
    } catch (IOException e) {
        throw new RetryableCrlException("Error setting IAM permissions", e);
    }
    return StepResult.getStepResultSuccess();
}
Also used : Policy(com.google.api.services.cloudresourcemanager.v3.model.Policy) Binding(com.google.api.services.cloudresourcemanager.v3.model.Binding) SetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.SetIamPolicyRequest) ArrayList(java.util.ArrayList) IOException(java.io.IOException) GetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest) RetryableCrlException(bio.terra.workspace.service.workspace.exceptions.RetryableCrlException) FlightMap(bio.terra.stairway.FlightMap) WsmIamRole(bio.terra.workspace.service.iam.model.WsmIamRole)

Example 12 with GetIamPolicyRequest

use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-workspace-manager by DataBiosphere.

the class GrantWsmRoleAdminStep method doStep.

@Override
public StepResult doStep(FlightContext context) throws InterruptedException, RetryException {
    String wsmSaEmail = GcpUtils.getWsmSaEmail(crlService.getApplicationCredentials());
    String projectId = context.getWorkingMap().get(WorkspaceFlightMapKeys.GCP_PROJECT_ID, String.class);
    try {
        Policy policy = crlService.getCloudResourceManagerCow().projects().getIamPolicy(projectId, new GetIamPolicyRequest()).execute();
        Binding bindingToAdd = new Binding().setMembers(Collections.singletonList("serviceAccount:" + wsmSaEmail)).setRole("roles/iam.roleAdmin");
        List<Binding> bindingList = policy.getBindings();
        bindingList.add(bindingToAdd);
        policy.setBindings(bindingList);
        SetIamPolicyRequest iamPolicyRequest = new SetIamPolicyRequest().setPolicy(policy);
        crlService.getCloudResourceManagerCow().projects().setIamPolicy(projectId, iamPolicyRequest).execute();
    } catch (IOException e) {
        throw new InternalServerErrorException("Error while granting WSM SA the Role Admin role", e);
    }
    return StepResult.getStepResultSuccess();
}
Also used : Policy(com.google.api.services.cloudresourcemanager.v3.model.Policy) Binding(com.google.api.services.cloudresourcemanager.v3.model.Binding) SetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.SetIamPolicyRequest) InternalServerErrorException(bio.terra.common.exception.InternalServerErrorException) IOException(java.io.IOException) GetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest)

Example 13 with GetIamPolicyRequest

use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-cli by DataBiosphere.

the class Workspace method grantBreakGlass.

/**
 * Grant break-glass access to a user of this workspace. The Editor and Project IAM Admin roles
 * are granted to the user's proxy group.
 *
 * @param granteeEmail email of the workspace user requesting break-glass access
 * @param userProjectsAdminCredentials credentials for a SA that has permission to set IAM policy
 *     on workspace projects in this WSM deployment (e.g. WSM application SA)
 * @return the proxy group email of the workspace user that was granted break-glass access
 */
public String grantBreakGlass(String granteeEmail, ServiceAccountCredentials userProjectsAdminCredentials) {
    // fetch the user's proxy group email from SAM
    String granteeProxyGroupEmail = SamService.fromContext().getProxyGroupEmail(granteeEmail);
    logger.debug("granteeProxyGroupEmail: {}", granteeProxyGroupEmail);
    // grant the Editor role to the user's proxy group email on the workspace project
    CloudResourceManagerCow resourceManagerCow = CrlUtils.createCloudResourceManagerCow(userProjectsAdminCredentials);
    try {
        Policy policy = resourceManagerCow.projects().getIamPolicy(googleProjectId, new GetIamPolicyRequest()).execute();
        List<Binding> updatedBindings = Optional.ofNullable(policy.getBindings()).orElse(new ArrayList<>());
        updatedBindings.add(new Binding().setRole("roles/editor").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
        updatedBindings.add(new Binding().setRole("roles/resourcemanager.projectIamAdmin").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
        policy.setBindings(updatedBindings);
        resourceManagerCow.projects().setIamPolicy(googleProjectId, new SetIamPolicyRequest().setPolicy(policy)).execute();
    } catch (IOException ioEx) {
        throw new SystemException("Error granting the Editor and Project IAM Admin roles to the user's proxy group.", ioEx);
    }
    return granteeProxyGroupEmail;
}
Also used : Policy(com.google.api.services.cloudresourcemanager.v3.model.Policy) Binding(com.google.api.services.cloudresourcemanager.v3.model.Binding) CloudResourceManagerCow(bio.terra.cloudres.google.cloudresourcemanager.CloudResourceManagerCow) SystemException(bio.terra.cli.exception.SystemException) SetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.SetIamPolicyRequest) IOException(java.io.IOException) GetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest)

Example 14 with GetIamPolicyRequest

use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-resource-buffer by DataBiosphere.

the class SetIamPolicyStep method doStep.

@Override
public StepResult doStep(FlightContext flightContext) throws RetryException {
    // Skip if IAM binding is not set.
    if (gcpProjectConfig.getIamBindings() == null || gcpProjectConfig.getIamBindings().isEmpty()) {
        return StepResult.getStepResultSuccess();
    }
    String projectId = flightContext.getWorkingMap().get(GOOGLE_PROJECT_ID, String.class);
    try {
        Policy policy = rmCow.projects().getIamPolicy(projectId, new GetIamPolicyRequest()).execute();
        gcpProjectConfig.getIamBindings().stream().map(iamBinding -> new Binding().setRole(iamBinding.getRole()).setMembers(iamBinding.getMembers())).forEach(policy.getBindings()::add);
        rmCow.projects().setIamPolicy(projectId, new SetIamPolicyRequest().setPolicy(policy)).execute();
    } catch (IOException e) {
        logger.info("Error when setting IAM policy", e);
        return new StepResult(StepStatus.STEP_RESULT_FAILURE_RETRY, e);
    }
    return StepResult.getStepResultSuccess();
}
Also used : StepResult(bio.terra.stairway.StepResult) Logger(org.slf4j.Logger) Step(bio.terra.stairway.Step) RetryException(bio.terra.stairway.exception.RetryException) com.google.api.services.cloudresourcemanager.v3.model(com.google.api.services.cloudresourcemanager.v3.model) GcpProjectConfig(bio.terra.buffer.generated.model.GcpProjectConfig) LoggerFactory(org.slf4j.LoggerFactory) CloudResourceManagerCow(bio.terra.cloudres.google.cloudresourcemanager.CloudResourceManagerCow) IOException(java.io.IOException) StepStatus(bio.terra.stairway.StepStatus) GOOGLE_PROJECT_ID(bio.terra.buffer.service.resource.FlightMapKeys.GOOGLE_PROJECT_ID) FlightContext(bio.terra.stairway.FlightContext) IOException(java.io.IOException) StepResult(bio.terra.stairway.StepResult)

Example 15 with GetIamPolicyRequest

use of com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest in project terra-workspace-manager by DataBiosphere.

the class CreateGcpContextFlightTest method assertPolicyGroupsSynced.

/**
 * Asserts that Sam groups are granted their appropriate IAM roles on a GCP project.
 */
private void assertPolicyGroupsSynced(UUID workspaceId, Project project) throws Exception {
    Map<WsmIamRole, String> roleToSamGroup = Arrays.stream(WsmIamRole.values()).filter(role -> !role.equals(WsmIamRole.MANAGER)).collect(Collectors.toMap(Function.identity(), role -> "group:" + SamRethrow.onInterrupted(() -> mockSamService.syncWorkspacePolicy(workspaceId, role, userAccessUtils.defaultUserAuthRequest()), "syncWorkspacePolicy")));
    Policy currentPolicy = crl.getCloudResourceManagerCow().projects().getIamPolicy(project.getProjectId(), new GetIamPolicyRequest()).execute();
    for (WsmIamRole role : WsmIamRole.values()) {
        // Don't check MANAGER role, which isn't synced to GCP.
        if (role.equals(WsmIamRole.MANAGER)) {
            continue;
        }
        assertRoleBindingInPolicy(role, roleToSamGroup.get(role), currentPolicy, project.getProjectId());
    }
}
Also used : BeforeEach(org.junit.jupiter.api.BeforeEach) Arrays(java.util.Arrays) WsmIamRole(bio.terra.workspace.service.iam.model.WsmIamRole) SamService(bio.terra.workspace.service.iam.SamService) Autowired(org.springframework.beans.factory.annotation.Autowired) AuthenticatedUserRequest(bio.terra.workspace.service.iam.AuthenticatedUserRequest) CloudSyncRoleMapping(bio.terra.workspace.service.workspace.CloudSyncRoleMapping) Role(com.google.api.services.iam.v1.model.Role) Assertions.assertFalse(org.junit.jupiter.api.Assertions.assertFalse) GetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest) FlightState(bio.terra.stairway.FlightState) Duration(java.time.Duration) Map(java.util.Map) SpendUnauthorizedException(bio.terra.workspace.service.spendprofile.exceptions.SpendUnauthorizedException) CustomGcpIamRoleMapping(bio.terra.workspace.service.resource.controlled.cloud.gcp.CustomGcpIamRoleMapping) JobService(bio.terra.workspace.service.job.JobService) MockBean(org.springframework.boot.test.mock.mockito.MockBean) UserAccessUtils(bio.terra.workspace.connected.UserAccessUtils) NoBillingAccountException(bio.terra.workspace.service.workspace.exceptions.NoBillingAccountException) StairwayTestUtils(bio.terra.workspace.common.StairwayTestUtils) Binding(com.google.api.services.cloudresourcemanager.v3.model.Binding) UUID(java.util.UUID) SpendProfileId(bio.terra.workspace.service.spendprofile.SpendProfileId) Collectors(java.util.stream.Collectors) WorkspaceConnectedTestUtils(bio.terra.workspace.connected.WorkspaceConnectedTestUtils) CustomGcpIamRole(bio.terra.workspace.service.resource.controlled.cloud.gcp.CustomGcpIamRole) Test(org.junit.jupiter.api.Test) List(java.util.List) Matchers.containsInAnyOrder(org.hamcrest.Matchers.containsInAnyOrder) Assertions.assertTrue(org.junit.jupiter.api.Assertions.assertTrue) Optional(java.util.Optional) StepStatus(bio.terra.stairway.StepStatus) ArgumentMatchers.any(org.mockito.ArgumentMatchers.any) JobMapKeys(bio.terra.workspace.service.job.JobMapKeys) WorkspaceService(bio.terra.workspace.service.workspace.WorkspaceService) Policy(com.google.api.services.cloudresourcemanager.v3.model.Policy) Project(com.google.api.services.cloudresourcemanager.v3.model.Project) HashMap(java.util.HashMap) Function(java.util.function.Function) SamResource(bio.terra.workspace.service.iam.model.SamConstants.SamResource) SamRethrow(bio.terra.workspace.service.iam.SamRethrow) DisabledIfEnvironmentVariable(org.junit.jupiter.api.condition.DisabledIfEnvironmentVariable) MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat) Assertions.assertEquals(org.junit.jupiter.api.Assertions.assertEquals) FlightDebugInfo(bio.terra.stairway.FlightDebugInfo) CrlService(bio.terra.workspace.service.crl.CrlService) Nullable(javax.annotation.Nullable) SamSpendProfileAction(bio.terra.workspace.service.iam.model.SamConstants.SamSpendProfileAction) MissingSpendProfileException(bio.terra.workspace.service.workspace.exceptions.MissingSpendProfileException) FlightMap(bio.terra.stairway.FlightMap) Workspace(bio.terra.workspace.service.workspace.model.Workspace) IOException(java.io.IOException) BaseConnectedTest(bio.terra.workspace.common.BaseConnectedTest) SpendConnectedTestUtils(bio.terra.workspace.service.spendprofile.SpendConnectedTestUtils) WorkspaceStage(bio.terra.workspace.service.workspace.model.WorkspaceStage) Mockito(org.mockito.Mockito) FlightStatus(bio.terra.stairway.FlightStatus) Collections(java.util.Collections) Policy(com.google.api.services.cloudresourcemanager.v3.model.Policy) GetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest) WsmIamRole(bio.terra.workspace.service.iam.model.WsmIamRole)

Aggregations

IOException (java.io.IOException)10 Binding (com.google.api.services.cloudresourcemanager.v3.model.Binding)9 Policy (com.google.api.services.cloudresourcemanager.v3.model.Policy)9 GetIamPolicyRequest (com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest)8 SetIamPolicyRequest (com.google.api.services.cloudresourcemanager.v3.model.SetIamPolicyRequest)4 FlightMap (bio.terra.stairway.FlightMap)3 StepStatus (bio.terra.stairway.StepStatus)3 WsmIamRole (bio.terra.workspace.service.iam.model.WsmIamRole)3 CloudResourceManagerCow (bio.terra.cloudres.google.cloudresourcemanager.CloudResourceManagerCow)2 FlightDebugInfo (bio.terra.stairway.FlightDebugInfo)2 FlightState (bio.terra.stairway.FlightState)2 FlightStatus (bio.terra.stairway.FlightStatus)2 StepResult (bio.terra.stairway.StepResult)2 RetryException (bio.terra.stairway.exception.RetryException)2 BaseConnectedTest (bio.terra.workspace.common.BaseConnectedTest)2 StairwayTestUtils (bio.terra.workspace.common.StairwayTestUtils)2 UserAccessUtils (bio.terra.workspace.connected.UserAccessUtils)2 WorkspaceConnectedTestUtils (bio.terra.workspace.connected.WorkspaceConnectedTestUtils)2 CrlService (bio.terra.workspace.service.crl.CrlService)2 AuthenticatedUserRequest (bio.terra.workspace.service.iam.AuthenticatedUserRequest)2