search

terraform-google-modules / terraform-google-sql-db

Creates a Cloud SQL database instance
https://registry.terraform.io/modules/terraform-google-modules/sql-db/google
Apache License 2.0
263 stars 422 forks source link

feat: Follow least privilege principal for backup service account #597

Closed ps-occrp closed 4 months ago

ps-occrp commented 4 months ago

Follow least privilege principal for backup service account

ps-occrp commented 4 months ago

Based on this roles/cloudsql.viewer role is sufficient for export workflows but for backup workflows roles/cloudsql.editor role needs to be used. In any case admin role on all instances is against best practices.

PS: IMHO GCP should create role dedicated for backup/export operation, if someone know a place where I can report/request it please let me know.

imrannayer commented 4 months ago

/gcbrun

ps-occrp commented 4 months ago

@imrannayer can you paste gcbrun logs?

imrannayer commented 4 months ago

@ps-occrp 

TestMsSqlFailoverReplica 2024-04-23T01:46:14Z command.go:185: 
TestMsSqlFailoverReplica 2024-04-23T01:46:14Z command.go:185: Error: Error waiting for Create Service Networking Connection: Error code 7, message: Required 'compute.globalAddresses.list' permission for 'projects/950554355066'
TestMsSqlFailoverReplica 2024-04-23T01:46:14Z command.go:185: Help Token: AWUw39Wc57_3oV2J97Ll90vNGw4ZrDQA7nq0XMPl40TadheOshi4NGrNrzRzRaLF6jYF3aqJF1zPtoRltZf7K024h7BJgn8Q0UwX3bNn2TG2VE7R
TestMsSqlFailoverReplica 2024-04-23T01:46:14Z command.go:185: 
TestMsSqlFailoverReplica 2024-04-23T01:46:14Z command.go:185:   with google_service_networking_connection.vpc_connection,
TestMsSqlFailoverReplica 2024-04-23T01:46:14Z command.go:185:   on network.tf line 56, in resource "google_service_networking_connection" "vpc_connection":
TestMsSqlFailoverReplica 2024-04-23T01:46:14Z command.go:185:   56: resource "google_service_networking_connection" "vpc_connection" {
TestMsSqlFailoverReplica 2024-04-23T01:46:14Z command.go:185: 
TestMsSqlFailoverReplica 2024-04-23T01:46:14Z retry.go:99: Returning due to fatal error: FatalError{Underlying: error while running command: exit status 1; 
Error: Error waiting for Create Service Networking Connection: Error code 7, message: Required 'compute.globalAddresses.list' permission for 'projects/950554355066'
Help Token: AWUw39Wc57_3oV2J97Ll90vNGw4ZrDQA7nq0XMPl40TadheOshi4NGrNrzRzRaLF6jYF3aqJF1zPtoRltZf7K024h7BJgn8Q0UwX3bNn2TG2VE7R

  with google_service_networking_connection.vpc_connection,
  on network.tf line 56, in resource "google_service_networking_connection" "vpc_connection":
  56: resource "google_service_networking_connection" "vpc_connection" {
}
    apply.go:34: 
            Error Trace:    /builder/home/go/pkg/mod/github.com/gruntwork-io/terratest@v0.46.13/modules/terraform/apply.go:34
                                        /builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/blueprint-test@v0.13.2/pkg/tft/terraform.go:517
                                        /builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/blueprint-test@v0.13.2/pkg/tft/terraform.go:539
                                        /builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/blueprint-test@v0.13.2/pkg/tft/terraform.go:569
                                        /builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/blueprint-test@v0.13.2/pkg/utils/stages.go:31
                                        /builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/blueprint-test@v0.13.2/pkg/tft/terraform.go:569
            Error:          Received unexpected error:
                            FatalError{Underlying: error while running command: exit status 1; 
                            Error: Error waiting for Create Service Networking Connection: Error code 7, message: Required 'compute.globalAddresses.list' permission for 'projects/950554355066'
                            Help Token: AWUw39Wc57_3oV2J97Ll90vNGw4ZrDQA7nq0XMPl40TadheOshi4NGrNrzRzRaLF6jYF3aqJF1zPtoRltZf7K024h7BJgn8Q0UwX3bNn2TG2VE7R

                              with google_service_networking_connection.vpc_connection,
                              on network.tf line 56, in resource "google_service_networking_connection" "vpc_connection":
                              56: resource "google_service_networking_connection" "vpc_connection" {
                            }
            Test:           TestMsSqlFailoverReplica
2024/04/23 01:46:14 RUN_STAGE env var set to apply
2024/04/23 01:46:14 Skipping stage teardown
--- FAIL: TestMsSqlFailoverReplica (123.24s)
ps-occrp commented 4 months ago

This does not look like issue related to my change

imrannayer commented 4 months ago

/gcbrun

ps-occrp commented 4 months ago

@imrannayer can you please merge this?

imrannayer commented 4 months ago

@ps-occrp will these examples verify the change you made?

https://github.com/terraform-google-modules/terraform-google-sql-db/tree/master/examples/mysql-backup-create-service-account

https://github.com/terraform-google-modules/terraform-google-sql-db/tree/master/examples/postgresql-backup-provided-service-account

ps-occrp commented 4 months ago

@imrannayer First example with MySQL will verify it but second one with Postgres will not verify it.

imrannayer commented 4 months ago

@ps-occrp is it possible to update postgres example so the test can verify it?

ps-occrp commented 4 months ago

@imrannayer I can update it but I don't think it makes sense, mysql example is creating service account and using it and in that case this PR is involved. Postgresql example uses existing service account. This provides complete coverage, if I update postgresql example to not use existing service account and create new service account than test coverage will reduce.

imrannayer commented 4 months ago

/gcbrun

imrannayer commented 4 months ago

/gcbrun

ps-occrp commented 4 months ago

@imrannayer can this be merged?

imrannayer commented 4 months ago

/gcbrun