Cloud Capture - Security

variable "project_id" {
  type        = string
  description = "The GCP project that holds the GKE clusters Cloud Capture will snapshot."
}

variable "kosli_aws_account_id" {
  type        = string
  description = <<-EOT
    The AWS account in which Cloud Capture runs, supplied by Kosli. It differs
    per tenant because more than one Kosli account serves tenants. There
    is no default and no value you can derive yourself.
  EOT

  validation {
    condition     = can(regex("^[0-9]{12}$", var.kosli_aws_account_id))
    error_message = "Must be the 12-digit AWS account id issued to you by Kosli."
  }
}

variable "kosli_role_name" {
  type        = string
  description = <<-EOT
    The name of the IAM role, in the Kosli AWS account, that Cloud Capture
    uses when working for your organization. Supplied by Kosli. Each Kosli
    organization has its own role, and the workload identity pool accepts
    only this one, so only Cloud Capture jobs run on behalf of your
    organization can obtain a token from your project. In the AWS setup,
    the external ID plays the same part.
  EOT

  validation {
    condition     = can(regex("^[A-Za-z0-9+=,.@_-]{1,64}$", var.kosli_role_name))
    error_message = "Must be the IAM role name issued to you by Kosli."
  }
}

# Cloud Capture runs in AWS. Workload Identity Federation lets it exchange its
# own short-lived AWS credentials for a short-lived Google token, so no service
# account key is ever created, stored or shared.
resource "google_iam_workload_identity_pool" "kosli_capture" {
  project                   = var.project_id
  workload_identity_pool_id = "kosli-capture"
  display_name              = "Cloud Capture"
  description               = <<-EOT
    Read-only access for Cloud Capture SDLC compliance evidence collection.
    Managed by Infrastructure Manager; do not edit in place.
  EOT
}

resource "google_iam_workload_identity_pool_provider" "kosli_aws" {
  project                            = var.project_id
  workload_identity_pool_id          = google_iam_workload_identity_pool.kosli_capture.workload_identity_pool_id
  workload_identity_pool_provider_id = "kosli-aws"
  display_name                       = "Cloud Capture (AWS)"

  aws {
    account_id = var.kosli_aws_account_id
  }

  attribute_mapping = {
    "google.subject"     = "assertion.arn"
    "attribute.account"  = "assertion.account"
    "attribute.aws_role" = "assertion.arn.extract('assumed-role/{role}/')"
  }

  # Two checks before the pool issues a token. The account check accepts only
  # credentials issued by the Kosli AWS account, however the token reaches
  # Google. The role check accepts, within that account, only the Kosli-side
  # role dedicated to your organization. A Cloud Capture job for another tenant
  # runs under a different role and is refused here. In the AWS setup, these
  # checks correspond to the trust policy principal and the external ID.
  attribute_condition = join(" && ", [
    "attribute.account == \"${var.kosli_aws_account_id}\"",
    "attribute.aws_role == \"${var.kosli_role_name}\"",
  ])
}

resource "google_service_account" "kosli_capture" {
  project      = var.project_id
  account_id   = "kosli-capture"
  display_name = "Cloud Capture"
  description  = "Impersonated by Cloud Capture to snapshot GKE clusters. Managed by Infrastructure Manager."
}

# Only the Kosli-side role for your organization may impersonate the service
# account. The pool's attribute condition already refuses every other identity;
# naming the role here as well keeps the binding correct even if that condition
# is later loosened.
resource "google_service_account_iam_member" "kosli_impersonation" {
  service_account_id = google_service_account.kosli_capture.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.kosli_capture.name}/attribute.aws_role/${var.kosli_role_name}"
}

# Kosli needs these two values to connect. Infrastructure Manager records them
# on the deployment's latest revision, under applyResults.outputs.
output "kosli_capture_provider" {
  description = "Full resource name of the workload identity provider; give this to Kosli."
  value       = google_iam_workload_identity_pool_provider.kosli_aws.name
}

output "kosli_capture_service_account" {
  description = "Email of the service account Cloud Capture impersonates; give this to Kosli."
  value       = google_service_account.kosli_capture.email
}

# Cloud Capture reads pods through the Cloud Asset API, so it must be enabled
# in the project.
resource "google_project_service" "cloudasset" {
  project            = var.project_id
  service            = "cloudasset.googleapis.com"
  disable_on_destroy = false
}

# How Capture finds what to snapshot. Discovery lists the GKE clusters in the
# project and reads each cluster's labels from the same clusters.get call.
#
# Worth knowing for a security review: Cloud Capture reads pods from Cloud
# Asset Inventory rather than from each cluster's Kubernetes API, so it needs
# no Kubernetes RBAC and no network access to any cluster control plane. None
# of it returns application data. listContainerPod is the widest - a pod spec
# holds the container image, the command, and any environment variables
# written into the spec itself in plain text. Values taken from a Secret or
# ConfigMap are named there rather than resolved, so what comes back is the
# reference and not the secret. This role lists pod assets only; the broader
# roles/cloudasset.viewer would also list k8s.io/Secret assets.
resource "google_project_iam_custom_role" "kosli_capture" {
  project     = var.project_id
  role_id     = "kosliCapture"
  title       = "Cloud Capture"
  description = "Read-only GKE inventory for Cloud Capture SDLC compliance evidence collection."

  permissions = [
    # Discovery
    "container.clusters.get",
    "container.clusters.list",

    # Snapshot: the Cloud Asset Inventory calls that kosli snapshot gke makes.
    # serviceusage.services.use lets the Cloud Asset API calls use this
    # project as their quota project.
    "cloudasset.assets.listContainerPod",
    "serviceusage.services.use",
  ]
}

resource "google_project_iam_member" "kosli_capture" {
  project = var.project_id
  role    = google_project_iam_custom_role.kosli_capture.id
  member  = google_service_account.kosli_capture.member
}

gcloud infra-manager deployments apply \
    projects/<your-gcp-project>/locations/<your-gcp-region>/deployments/kosli-capture \
    --service-account=projects/<your-gcp-project>/serviceAccounts/<deployer>@<your-gcp-project>.iam.gserviceaccount.com \
    --local-source=. \
    --input-values=project_id=<your-gcp-project>,kosli_aws_account_id=<value from Kosli>,kosli_role_name=<value from Kosli>