Package: scalesec-gcp-workload-identity
Scalesec GCP Workload Identity FederationThis package provides a python module to federate access from AWS to GCP using Workload Identity. View ourblogfor additional details.PrerequisitesA GCP service account (environment variable "GCP_SERVICE_ACCOUNT_EMAIL")An AWS IAM role (environment variable "AWS_ROLE_NAME")AWS credentials (environment variable "AWS_PROFILE")python3.xQuick start# Create venv and install packagemakesetupsource.venv/bin/activate
pipinstallscalesec-gcp-workload-identity# Rename example .envmv.env.example.env# Enter your own environment variablescat<<EOF >.env# GCPexport GCP_PROJECT_NUMBER=export GCP_PROJECT_ID=# gcp workload identity pool idexport GCP_WORKLOAD_ID=export GCP_WORKLOAD_PROVIDER=export GCP_SERVICE_ACCOUNT_EMAIL=# awsexport AWS_REGION=export AWS_ACCOUNT_ID=export AWS_ROLE_NAME=# Non-required varsexport TOKEN_LIFETIME=export TOKEN_SCOPES=EOF# Source the environment variables so they are exposedsource.env# set up GCP credentialsgcloudauthlogin# Configure the default projectgcloudconfigsetproject$GCP_PROJECT_ID# Enable the STS service in the projectgcloudservicesenablests.googleapis.com# Enable the IAM credentials servicegcloudservicesenableiamcredentials.googleapis.com# The following commands use the .env values# Create the GCP Workload Identity Poolgcloudbetaiamworkload-identity-poolscreate"$GCP_WORKLOAD_ID"\--location="global"\--description="$GCP_WORKLOAD_ID"\--display-name="$GCP_WORKLOAD_ID"# Create the GCP Workload Identity AWS Providergcloudbetaiamworkload-identity-poolsproviderscreate-aws"$GCP_WORKLOAD_PROVIDER"\--location="global"\--workload-identity-pool="$GCP_WORKLOAD_ID"\--account-id="$AWS_ACCOUNT_ID"# Add the appropriate IAM binding to a pre-existing service accountgcloudiamservice-accountsadd-iam-policy-binding$GCP_SERVICE_ACCOUNT_EMAIL\--roleroles/iam.workloadIdentityUser\--member"principalSet://iam.googleapis.com/projects/$GCP_PROJECT_NUMBER/locations/global/workloadIdentityPools/$GCP_WORKLOAD_ID/attribute.aws_role/arn:aws:sts::${AWS_ACCOUNT_ID}:assumed-role/$AWS_ROLE_NAME"Using the moduleSet your AWS credentialsexportAWS_PROFILE=xyzGetting a Service Account token is now simple:fromscalesec_gcp_workload_identity.mainimportTokenServicefromosimportgetenv# The arguments to TokenService can be ingested# from the environment if they were exported above.# Otherwise, pass in your own argumentstoken_service=TokenService(gcp_project_number=getenv('GCP_PROJECT_NUMBER'),gcp_workload_id=getenv('GCP_WORKLOAD_ID'),gcp_workload_provider=getenv('GCP_WORKLOAD_PROVIDER'),gcp_service_account_email=getenv('GCP_SERVICE_ACCOUNT_EMAIL'),aws_account_id=getenv('AWS_ACCOUNT_ID'),aws_role_name=getenv('AWS_ROLE_NAME'),aws_region=getenv('AWS_REGION'),gcp_token_lifetime=getenv('TOKEN_LIFETIME'),# Not requiredgcp_token_scopes=getenv('TOKEN_SCOPES')# Not required)sa_token,expiry_date=token_service.get_token()Token expirationThe default expiration for a service account token is 1h in GCP. This behavior can be changed by overriding the environment variableTOKEN_LIFETIMEin the.envfile. By default, GCP does not allow tokens to have an expiry over 1 hour and an organization policymustbe updated for this change to take affect. The organization policy is callediam.allowServiceAccountCredentialLifetimeExtensionand it accepts a list of service accounts that are allowed to have an > 1 hr token.# To configure the organization policygcloudorg-policiesset-policypolicy.yaml# An example policy.json:name:projects/1234567890/policies/iam.allowServiceAccountCredentialLifetimeExtension
spec:etag:BwXBMNmIrQg=rules:-values:allowedValues:-your-sa@yourproject.iam.gserviceaccount.comToken scopesThe default scope for the service account token ishttps://www.googleapis.com/auth/cloud-platform. This behaviour can be overridden to enable a different set of scopes by using the environment variableTOKEN_SCOPESin the.envfile with a comma-separated list of GCP scopes.Testing# make a venvmakesetupEdit.envwith your values# install depsmakedev# run pytestmaketestLocal LintingTo test that your code will pass the lint and code quality GitHub action:Clone the repository locallyMake your updatesFrom the root of the repository, execute:pylint--rcfile.github/workflows/configs/.pylintrcscalesec_gcp_workload_identitytestsexamplesExamplesWe have providedexampleson how to use the service account access token generated by this module. Access tokens are mainly used via an API call or usingcurlon the CLI.Restricting Identity Pool ProvidersBy default, any GCP user with theroles/iam.workloadIdentityPoolAdminorroles/ownerrole is able to create a workload identity pool in your GCP organization. There are two organization policies available to help you lockdown which outside providers can have pools in your organization.constraints/iam.workloadIdentityPoolProviders- Accepts a list of URIs such ashttps://sts.amazonaws.comorhttps://sts.windows.net/$AZURE_TENANT_ID. For example:# Allows all AWS accounts but no Azure or OIDCgcloudbetaresource-managerorg-policiesallowconstraints/iam.workloadIdentityPoolProviders\https://sts.amazonaws.com--organization=$ORG_ID# Allows only a specific Azure tenant but no AWS or OIDCgcloudbetaresource-managerorg-policiesallowconstraints/iam.workloadIdentityPoolProviders\https://sts.windows.net/$AZURE_TENANT_ID--organization=$ORG_IDconstraints/iam.workloadIdentityPoolAwsAccounts- Specifically focused on AWS, this constraint accepts a list of AWS account IDs. If this orgnanization policy is used,constraints/iam.workloadIdentityPoolProvidersmust either allowhttps://sts.amazonaws.comor be set to default (allow all). For example:# Only allows a specific AWS accountgcloudbetaresource-managerorg-policiesallowconstraints/iam.workloadIdentityPoolAwsAccounts\$AWS_ACCOUNT_ID--organization=$ORG_IDUpload to PyPiSet your token/credentials in ~/.pypircmake dist VERSION=1.x.xFeedbackFeedback is welcome and encouraged via a GitHub issue. Please open an issue for any bugs, feature requests, or general improvements you would like to see. Thank you in advance!