236 lines
7.9 KiB
Python
236 lines
7.9 KiB
Python
# -*- coding: utf-8 -*- #
|
|
# Copyright 2022 Google LLC. All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
"""Command to query activities."""
|
|
|
|
from __future__ import absolute_import
|
|
from __future__ import division
|
|
from __future__ import unicode_literals
|
|
|
|
from googlecloudsdk.api_lib.policy_intelligence import policy_troubleshooter
|
|
from googlecloudsdk.calliope import base
|
|
|
|
_DETAILED_HELP = {
|
|
'brief': """Troubleshoot the IAM Policy.
|
|
""",
|
|
'DESCRIPTION': """\
|
|
Performs a check on whether a principal is granted a
|
|
permission on a resource and how that access is determined according to
|
|
the resource's effective IAM policy interpretation.
|
|
""",
|
|
'EXAMPLES': """\
|
|
To troubleshoot a permission of a principal on a resource, run:
|
|
|
|
$ {command} //cloudresourcemanager.googleapis.com/projects/project-id \
|
|
--principal-email=my-iam-account@somedomain.com \
|
|
--permission=resourcemanager.projects.get
|
|
|
|
See https://cloud.google.com/iam/help/allow-policies/overview for more
|
|
information about IAM policies.
|
|
""",
|
|
}
|
|
|
|
_DETAILED_HELP = {
|
|
'brief': """Troubleshoot IAM allow and deny policies.
|
|
""",
|
|
'DESCRIPTION': """\
|
|
Uses a resource's effective IAM allow policy and IAM deny policy to
|
|
check whether a principal has a specific permission on the resource.
|
|
""",
|
|
'EXAMPLES': """\
|
|
The following command checks whether the principal ``my-user@example.com''
|
|
has the permission ``resourcemanager.projects.get'' on the project
|
|
``my-project'':
|
|
|
|
$ {command} //cloudresourcemanager.googleapis.com/projects/my-project
|
|
--principal-email=my-user@example.com
|
|
--permission=resourcemanager.projects.get
|
|
|
|
The following command checks whether the principal ``my-user@example.com''
|
|
has the ``compute.images.get'' permission on the project
|
|
``my-project''. The command also provides additional context that lets
|
|
Troubleshooter evaluate conditional role bindings:
|
|
|
|
$ {command} //cloudresourcemanager.googleapis.com/projects/my-project \
|
|
--principal-email=my-user@example.com \
|
|
--permission=compute.images.get \
|
|
--resource-name=//compute.googleapis.com/projects/my-project/zones/images/my-image'\
|
|
--resource-service='compute.googleapis.com' \
|
|
--resource-type='compute.googleapis.com/Image' \
|
|
--destination-ip='192.2.2.2'--destination-port=8080 --request-time='2023-01-01T00:00:00Z'
|
|
""",
|
|
}
|
|
|
|
|
|
def _Args(parser):
|
|
"""Parses arguments for the commands."""
|
|
parser.add_argument(
|
|
'resource',
|
|
metavar='RESOURCE',
|
|
type=str,
|
|
help="""Full resource name that access is checked against.
|
|
For a list of full resource name formats, see: https://cloud.google.com/iam/docs/resource-names.
|
|
""",
|
|
)
|
|
parser.add_argument(
|
|
'--principal-email',
|
|
required=True,
|
|
metavar='EMAIL',
|
|
type=str,
|
|
help="""Email address that identifies the principal to check. Only Google Accounts and
|
|
service accounts are supported.
|
|
""",
|
|
)
|
|
parser.add_argument(
|
|
'--permission',
|
|
required=True,
|
|
metavar='PERMISSION',
|
|
type=str,
|
|
help="""IAM permission to check. The permssion can be in the `v1` or `v2`
|
|
format. For example, `resourcemanager.projects.get` or
|
|
`cloudresourcemanager.googleapis.com/projects.get`.
|
|
For a list of permissions, see https://cloud.google.com/iam/docs/permissions-reference and https://cloud.google.com/iam/docs/deny-permissions-support
|
|
""",
|
|
)
|
|
parser.add_argument(
|
|
'--resource-service',
|
|
required=False,
|
|
type=str,
|
|
help="""The resource service value to use when checking conditional bindings.
|
|
For accepted values, see: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-service
|
|
""",
|
|
)
|
|
parser.add_argument(
|
|
'--resource-type',
|
|
required=False,
|
|
type=str,
|
|
help="""The resource type value to use when checking conditional bindings.
|
|
For accepted values, see: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-type
|
|
""",
|
|
)
|
|
parser.add_argument(
|
|
'--resource-name',
|
|
required=False,
|
|
type=str,
|
|
help="""The resource name value to use when checking conditional bindings.
|
|
For accepted values, see: https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-name.
|
|
""",
|
|
)
|
|
parser.add_argument(
|
|
'--request-time',
|
|
required=False,
|
|
type=str,
|
|
help="""The request timestamp to use when checking conditional bindings. This string must adhere to UTC format
|
|
(RFC 3339). For example,2021-01-01T00:00:00Z. For more information, see:
|
|
https://tools.ietf.org/html/rfc3339
|
|
""",
|
|
)
|
|
parser.add_argument(
|
|
'--destination-ip',
|
|
required=False,
|
|
type=str,
|
|
help="""The request destination IP address to use when checking conditional bindings. For example, `198.1.1.1`.
|
|
""",
|
|
)
|
|
parser.add_argument(
|
|
'--destination-port',
|
|
required=False,
|
|
type=int,
|
|
help="""The request destination port to use when checking conditional bindings. For example, 8080.
|
|
""",
|
|
)
|
|
|
|
|
|
def _Run(policy_troubleshooter_api, args):
|
|
"""Troubleshoot the IAM Policies."""
|
|
destination_context = policy_troubleshooter_api.GetPolicyTroubleshooterPeer(
|
|
destination_ip=args.destination_ip,
|
|
destination_port=args.destination_port,
|
|
)
|
|
request_context = policy_troubleshooter_api.GetPolicyTroubleshooterRequest(
|
|
request_time=args.request_time
|
|
)
|
|
resource_context = policy_troubleshooter_api.GetPolicyTroubleshooterResource(
|
|
resource_name=args.resource_name,
|
|
resource_service=args.resource_service,
|
|
resource_type=args.resource_type,
|
|
)
|
|
condition_context = (
|
|
policy_troubleshooter_api.GetPolicyTroubleshooterConditionContext(
|
|
destination=destination_context,
|
|
request=request_context,
|
|
resource=resource_context,
|
|
)
|
|
)
|
|
access_tuple = policy_troubleshooter_api.GetPolicyTroubleshooterAccessTuple(
|
|
condition_context=condition_context,
|
|
full_resource_name=args.resource,
|
|
principal_email=args.principal_email,
|
|
permission=args.permission,
|
|
)
|
|
return policy_troubleshooter_api.TroubleshootIAMPolicies(access_tuple)
|
|
|
|
|
|
@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
|
|
@base.Hidden
|
|
class TroubleshootAlpha(base.Command):
|
|
"""Troubleshoot the IAM Policies."""
|
|
|
|
detailed_help = _DETAILED_HELP
|
|
|
|
@staticmethod
|
|
def Args(parser):
|
|
"""Parses arguments for the commands."""
|
|
_Args(parser)
|
|
|
|
def Run(self, args):
|
|
return _Run(
|
|
policy_troubleshooter.PolicyTroubleshooterApi(self.ReleaseTrack()), args
|
|
)
|
|
|
|
|
|
@base.ReleaseTracks(base.ReleaseTrack.BETA)
|
|
@base.Hidden
|
|
class TroubleshootBeta(base.Command):
|
|
"""Troubleshoot IAM allow and deny policies."""
|
|
|
|
detailed_help = _DETAILED_HELP
|
|
|
|
@staticmethod
|
|
def Args(parser):
|
|
"""Parses arguments for the commands."""
|
|
_Args(parser)
|
|
|
|
def Run(self, args):
|
|
return _Run(
|
|
policy_troubleshooter.PolicyTroubleshooterApi(self.ReleaseTrack()), args
|
|
)
|
|
|
|
|
|
@base.ReleaseTracks(base.ReleaseTrack.GA)
|
|
class Troubleshoot(base.Command):
|
|
"""Troubleshoot IAM allow and deny policies."""
|
|
|
|
detailed_help = _DETAILED_HELP
|
|
|
|
@staticmethod
|
|
def Args(parser):
|
|
"""Parses arguments for the commands."""
|
|
_Args(parser)
|
|
|
|
def Run(self, args):
|
|
return _Run(
|
|
policy_troubleshooter.PolicyTroubleshooterApi(self.ReleaseTrack()), args
|
|
)
|