Cloud Capture - Security

variable "project_id" {
  type        = string
  description = "The GCP project that holds the GKE clusters Cloud Capture will snapshot."
}

variable "kosli_aws_account_id" {
  type        = string
  description = <<-EOT
    The AWS account in which Cloud Capture runs, supplied by Kosli. It differs
    per customer because more than one Kosli account serves customers. There
    is no default and no value you can derive yourself.
  EOT

  validation {
    condition     = can(regex("^[0-9]{12}$", var.kosli_aws_account_id))
    error_message = "Must be the 12-digit AWS account id issued to you by Kosli."
  }
}

variable "kosli_role_name" {
  type        = string
  description = <<-EOT
    The name of the IAM role, in the Kosli AWS account, that Cloud Capture
    uses when working for your organization. Supplied by Kosli. Each Kosli
    organization has its own role, so this value is the counterpart of the
    AWS external ID: only jobs run on your behalf can obtain a token from
    your project.
  EOT

  validation {
    condition     = can(regex("^[A-Za-z0-9+=,.@_-]{1,64}$", var.kosli_role_name))
    error_message = "Must be the IAM role name issued to you by Kosli."
  }
}

# Cloud Capture runs in AWS. Workload Identity Federation lets it exchange its
# own short-lived AWS credentials for a short-lived Google token, so no service
# account key is ever created, stored or shared.
resource "google_iam_workload_identity_pool" "kosli_capture" {
  project                   = var.project_id
  workload_identity_pool_id = "kosli-capture"
  display_name              = "Cloud Capture"
  description               = <<-EOT
    Read-only access for Cloud Capture SDLC compliance evidence collection.
    Managed by Infrastructure Manager; do not edit in place.
  EOT
}

resource "google_iam_workload_identity_pool_provider" "kosli_aws" {
  project                            = var.project_id
  workload_identity_pool_id          = google_iam_workload_identity_pool.kosli_capture.workload_identity_pool_id
  workload_identity_pool_provider_id = "kosli-aws"
  display_name                       = "Cloud Capture (AWS)"

  aws {
    account_id = var.kosli_aws_account_id
  }

  attribute_mapping = {
    "google.subject"     = "assertion.arn"
    "attribute.account"  = "assertion.account"
    "attribute.aws_role" = "assertion.arn.extract('assumed-role/{role}/')"
  }

  # Two checks, mirroring the AWS trust policy. The account check is the
  # counterpart of the trust policy principal: only credentials issued by the
  # Kosli account are accepted, however the token reaches Google. The role
  # check is the counterpart of the external ID: within that account, only the
  # Kosli-side role dedicated to your organization is accepted. A Cloud Capture
  # job for another customer runs under a different role and is refused here.
  attribute_condition = join(" && ", [
    "attribute.account == \"${var.kosli_aws_account_id}\"",
    "attribute.aws_role == \"${var.kosli_role_name}\"",
  ])
}

resource "google_service_account" "kosli_capture" {
  project      = var.project_id
  account_id   = "kosli-capture"
  display_name = "Cloud Capture"
  description  = "Impersonated by Cloud Capture to snapshot GKE clusters. Managed by Infrastructure Manager."
}

# Only the Kosli-side role for your organization may impersonate the service
# account. The pool's attribute condition already refuses every other identity;
# naming the role here as well keeps the binding correct even if that condition
# is later loosened.
resource "google_service_account_iam_member" "kosli_impersonation" {
  service_account_id = google_service_account.kosli_capture.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.kosli_capture.name}/attribute.aws_role/${var.kosli_role_name}"
}

# Kosli needs these two values to connect. Infrastructure Manager shows them
# with `gcloud infra-manager deployments describe`.
output "kosli_capture_provider" {
  description = "Full resource name of the workload identity provider; give this to Kosli."
  value       = google_iam_workload_identity_pool_provider.kosli_aws.name
}

output "kosli_capture_service_account" {
  description = "Email of the service account Cloud Capture impersonates; give this to Kosli."
  value       = google_service_account.kosli_capture.email
}

# How Capture finds what to snapshot. Discovery lists the GKE clusters in the
# project and reads each cluster's labels, endpoint and CA certificate from
# the same clusters.get call.
#
# Worth knowing for a security review: GKE checks the container.* permissions
# below when Cloud Capture calls the Kubernetes API, so this role is also the
# Kubernetes RBAC. None of it returns application data. pods.list is the
# widest - a pod spec holds the container image, the command, and any
# environment variables written into the spec itself in plain text. Values
# taken from a Secret or ConfigMap are named there rather than resolved, and
# this role grants no access to Secrets or ConfigMaps, so what comes back is
# the reference and not the secret.
resource "google_project_iam_custom_role" "kosli_capture" {
  project     = var.project_id
  role_id     = "kosliCapture"
  title       = "Cloud Capture"
  description = "Read-only GKE inventory for Cloud Capture SDLC compliance evidence collection."

  permissions = [
    # Discovery
    "container.clusters.get",
    "container.clusters.list",

    # Snapshot: the Kubernetes API calls that kosli snapshot k8s makes
    "container.namespaces.get",
    "container.namespaces.list",
    "container.pods.get",
    "container.pods.list",
  ]
}

resource "google_project_iam_member" "kosli_capture" {
  project = var.project_id
  role    = google_project_iam_custom_role.kosli_capture.id
  member  = google_service_account.kosli_capture.member
}

gcloud infra-manager deployments apply \
    projects/<your-gcp-project>/locations/<your-gcp-region>/deployments/kosli-capture \
    --service-account=projects/<your-gcp-project>/serviceAccounts/<deployer>@<your-gcp-project>.iam.gserviceaccount.com \
    --local-source=. \
    --input-values=project_id=<your-gcp-project>,kosli_aws_account_id=<value from Kosli>,kosli_role_name=<value from Kosli>