search

GoogleCloudPlatform / security-response-automation

Take automated actions against threats and vulnerabilities.
Apache License 2.0
208 stars 52 forks source link

Error deploying cloud functions using end user credentials #184

Closed daniel-cit closed 4 years ago

daniel-cit commented 4 years ago

When you run terraform apply you get an error on the deploy of the cloud functions:

Error: Error waiting for Creating CloudFunctions Function: error while retrieving operation: googleapi: Error 403: Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the cloudfunctions.googleapis.com. We recommend configuring the billing/quota_project setting in gcloud or using a service account through the auth/impersonate_service_account setting. For more information about service accounts and how to use them in your application, see https://cloud.google.com/docs/authentication/., accessNotConfigured

There is an open issue on terraform github to fix this: https://github.com/terraform-providers/terraform-provider-google/issues/5885

Possible workarounds until the issue is fixed:

  1. Add clear information to the user that is applying the terraform script about the issue with a link to the terraform issue(https://github.com/terraform-providers/terraform-provider-google/issues/5885)
  2. Provide alternative instructions on how to use a service account to deploy SRA

if we provide instructions to use a service account, some changes in the terraform scripts are necessary.

The service account used on the deploy should not have Org Admin role, which is necessary to give the SRA service account the role "roles/securitycenter.findingSecurityMarksWriter". This role needs to be granted manually by the user.

related SRA issue: https://github.com/GoogleCloudPlatform/security-response-automation/issues/162