Closed jondkelley closed 4 months ago
github-actions[bot]
commented
4 months ago Hi there @jondkelley :wave:!
Thank you for opening an issue. Our team will triage this as soon as we can. Please take a moment to review the troubleshooting steps which lists common error messages and their resolution steps.
sethvargo
commented
4 months ago Before trying to debug further, can you please make sure you're using the correct version of "auth"? All the examples in the readme are v2, but you're using v1:
- uses: 'google-github-actions/auth@v1'
+ uses: 'google-github-actions/auth@v2'
jondkelley
commented
4 months ago Added
- uses: 'google-github-actions/auth@v1'
+ uses: 'google-github-actions/auth@v2'still getting the same error. :(
sethvargo
commented
4 months ago I think you're conflating the steps of "Direct Workload Identity Federation" and "Workload Identity Federation through a Service Account". If you're using Direct WIF, then you need to grant the WIF pool permissions on the secret. If you're using WIF via SA, you must grant the SA permissions on the secret.
It looks like you followed the setup instructions for Direct WIF, but then you're telling the auth action to use the WIF via SA method. You need to remove the service_account input:
- name: Authenticate to Google Cloud
id: 'auth'
uses: 'google-github-actions/auth@v2'
with:
project_id: 'com-org-dev-760a2504'
workload_identity_provider: 'projects/123456123456/locations/global/workloadIdentityPools/github2/providers/org-github'
- service_account: 'githubactionspoc2-dev@com-org-dev-760a2504.iam.gserviceaccount.com'As explained in the README:
TL;DR
Following (Preferred) Direct Workload Identity Federation it doesn't work
failed to access secret "projects/123456123456/secrets/GITHUB_POC_SECRET/versions/latest": permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).Expected behavior
Successful behavior.
Observed behavior
Run google-github-actions/get-secretmanager-secrets@v2.1.3
Error: google-github-actions/get-secretmanager-secrets failed with: failed to access secret "projects/123456123456/secrets/GITHUB_POC_SECRET/versions/latest": permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).Action YAML
Log output
Additional information
Direct Workload Identity Federation requires additional permissions, not sure what is missing.
IAM Logs
{ "protoPayload": { "@type": "type.googleapis.com/google.cloud.audit.AuditLog", "status": { "code": 7, "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist)." }, "authenticationInfo": { "serviceAccountDelegationInfo": [ {} ], "principalSubject": "principal://iam.googleapis.com/projects/123456123456/locations/global/workloadIdentityPools/github2/subject/repo:org/citest-python:ref:refs/heads/main" }, "requestMetadata": { "callerIp": "40.79.245.146", "callerSuppliedUserAgent": "google-api-nodejs-client/9.10.0,gzip(gfe)", "requestAttributes": { "time": "2024-06-14T16:10:10.779381134Z", "auth": {} }, "destinationAttributes": {} }, "serviceName": "iamcredentials.googleapis.com", "methodName": "GenerateAccessToken", "authorizationInfo": [ { "permission": "iam.serviceAccounts.getAccessToken", "resourceAttributes": {}, "permissionType": "ADMIN_READ" } ], "resourceName": "projects/-/serviceAccounts/113057325249898657053", "request": { "name": "projects/-/serviceAccounts/githubactionspoc2-dev@com-org-dev-760a2504.iam.gserviceaccount.com", "@type": "type.googleapis.com/google.iam.credentials.v1.GenerateAccessTokenRequest" }, "metadata": { "identityDelegationChain": [ "projects/-/serviceAccounts/githubactionspoc2-dev@com-org-dev-760a2504.iam.gserviceaccount.com" ] } }, "insertId": "chid3oe15e1a", "resource": { "type": "service_account", "labels": { "email_id": "githubactionspoc2-dev@com-org-dev-760a2504.iam.gserviceaccount.com", "project_id": "com-org-dev-760a2504", "unique_id": "113057325249898657053" } }, "timestamp": "2024-06-14T16:10:10.764276225Z", "severity": "ERROR", "logName": "projects/com-org-dev-760a2504/logs/cloudaudit.googleapis.com%2Fdata_access", "operation": { "id": "13097961325791772796", "producer": "iamcredentials.googleapis.com", "first": true, "last": true }, "receiveTimestamp": "2024-06-14T16:10:11.571327922Z" }How to reproduce
Environment Variables Used
Step 1: Create a Service Account
This command creates a new service account with the name specified by the SVC_ACC environment variable in the project specified by the PROJECT_ID environment variable.
Create Service Account
gcloud iam service-accounts create "$SVC_ACC" \ --project "${PROJECT_ID}"Step 2: Create a Workload Identity Pool
This command creates a new Workload Identity Pool named github2 with a display name GitHub Actions Pool in the specified project.
Create Workload Identity Pool
gcloud iam workload-identity-pools create "$IDENTITY_POOL" \ --project="${PROJECT_ID}" \ --location="global" \ --display-name="GitHub Actions Pool"Step 3: Describe the Workload Identity Pool
This command retrieves the name of the Workload Identity Pool named github in the specified project and outputs its value.
Describe Workload Identity Pool
gcloud iam workload-identity-pools describe "$IDENTITY_POOL" \ --project="${PROJECT_ID}" \ --location="global" \ --format="value(name)"Gives me projects/123456123456/locations/global/workloadIdentityPools/github2Step 4: Create an OIDC Provider
This command creates an OIDC provider within the specified Workload Identity Pool, mapping specific attributes from the GitHub OIDC token and setting an attribute condition for the repository owner.
Create OIDC Provider
gcloud iam workload-identity-pools providers create-oidc "$IDENTITY_PROVIDER" \ --project="${PROJECT_ID}" \ --location="global" \ --workload-identity-pool="$IDENTITY_POOL" \ --display-name="My GitHub repo Provider" \ --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \ --attribute-condition="assertion.repository_owner == 'myorg_in_github'" \ --issuer-uri="https://token.actions.githubusercontent.com"Step 5: Describe the OIDC Provider
This command retrieves the name of the OIDC provider created in the previous step and outputs its value.
Describe OIDC Provider
gcloud iam workload-identity-pools providers describe "$IDENTITY_PROVIDER" \ --project="${PROJECT_ID}" \ --location="global" \ --workload-identity-pool="$IDENTITY_POOL" \ --format="value(name)"Gives me projects/123456123456/locations/global/workloadIdentityPools/github2/providers/org-githubStep 6: Add IAM Policy Binding for Secret Access
These commands add IAM policy bindings to allow specific principals to access a secret in Google Secret Manager. The principals are identified by their attributes in the Workload Identity Pool.
Add IAM Policy Binding for Secret Access - Attempt 1
gcloud secrets add-iam-policy-binding "GITHUB_POC_SECRET" \ --project="${PROJECT_ID}" \ --role="roles/secretmanager.secretAccessor" \ --member="principalSet://iam.googleapis.com/projects/123456123456/locations/global/workloadIdentityPools/github2/attribute.repository_owner/my-github-org-name"Add IAM Policy Binding for Secret Access - Attempt 2
gcloud secrets add-iam-policy-binding "GITHUB_POC_SECRET" \ --project="${PROJECT_ID}" \ --role="roles/secretmanager.secretAccessor" \ --member="principalSet://iam.googleapis.com/projects/123456123456/locations/global/workloadIdentityPools/github2/attribute.repository/my-github-org-name/citest-python"Add IAM Policy Binding for Secret Access - Attempt 3
gcloud secrets add-iam-policy-binding "GITHUB_POC_SECRET" \ --project="${PROJECT_ID}" \ --role="roles/secretmanager.secretAccessor" \ --member="principalSet://iam.googleapis.com/projects/123456123456/locations/global/workloadIdentityPools/github2/attribute.repository/citest-python"Step 7: Try and fix the iam.serviceAccounts.getAccessToken error
Allow a service account to impersonate another service account, enabling actions that require specific permissions.
Add IAM Policy Binding to Project
gcloud projects add-iam-policy-binding com-org-dev-760a2504 \ --member="serviceAccount:githubactionspoc2-dev@com-org-dev-760a2504.iam.gserviceaccount.com" \ --role="roles/iam.serviceAccountTokenCreator"So far, nothing has worked. :(