You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. Navigate to the Cloud Shell terminal in your GCP account using the following link: [https://console.cloud.google.com/welcome?cloudshell=true](https://console.cloud.google.com/welcome?cloudshell=true).
10
+
2. Click the `Open editor` button at the top of the terminal to navigate to your editor.
11
+
3. Create a file with `.sh` extension in the root directory i.e. `drata.sh`.
12
+
4. Copy the content of the `gcp-drata-script.sh` from this project and paste it in the newly created file.
13
+
5. Click the `Open terminal` button at the top of the editor to navigate back to your terminal, run the following commands.
14
+
1.`chmod +x drata.sh` to give it execution permissions.
15
+
2.`./drata.sh` to run the script.
16
+
6. After the process finishes, navigate back to your editor and download the `drata-key-file.json` file.
17
+
7. In the Drata app, go to the GCP connection drawer and select Upload File to upload the `drata-key-file.json` file.
printf"${prefix} [ERROR] Please run this script within a Google Cloud Console Shell,\n consult https://cloud.google.com/shell/docs/run-gcloud-commands for help\n"
18
+
exit
19
+
fi
20
+
21
+
printf"${prefix} Getting project info...🔎 \n\n"
22
+
23
+
# get account's default project
24
+
projectId=$(
25
+
gcloud config get-value project
26
+
)
27
+
if [ -z"${projectId}" ]
28
+
then
29
+
printf"${prefix} The default project is unset, please check the configuration...❌ \n\n"
30
+
exit;
31
+
fi
32
+
33
+
# validate if the projectId is valid
34
+
# get project name
35
+
projectName=$(
36
+
gcloud projects list --format="value(name)" --filter="id=$projectId"
37
+
)
38
+
39
+
# if, by mistake, the user set himself an invalid project, it won't be found
40
+
if [ -z"${projectName}" ]
41
+
then
42
+
printf"${prefix} Project '${projectId}' is not found, please check the configuration...❌ \n\n"
IFS='~';read -r -a ancestorsArray <<<"$projectAncestorsInfo"
56
+
57
+
# iterate ancestors to get the organization
58
+
forancestorin${ancestorsArray[@]};do
59
+
IFS=',';read -r -a ancestorValues <<<"$ancestor";
60
+
type=${ancestorValues[0]};
61
+
if [ $type=="organization" ];then
62
+
organizationId=${ancestorValues[1]};
63
+
fi
64
+
done
65
+
66
+
organizationName='No organization';
67
+
if [ -n"$organizationId" ];then
68
+
# get organization's name
69
+
organizationName=$(
70
+
gcloud organizations list --format="value(displayName)" --filter="name=organizations/$organizationId"
71
+
)
72
+
fi
73
+
74
+
printf"${prefix} Creating resources at ${organizationName}/${projectName}...🚀 \n"
75
+
76
+
# *****************************
77
+
# START CREATING RESOURCES ==>
78
+
# *****************************
79
+
80
+
# ===========================
81
+
# Custom Project Role
82
+
# ===========================
83
+
printf"\n${prefix} Checking custom role...\n";
84
+
# Verify if the role exists already
85
+
projectRoleInfo=$(
86
+
gcloud iam roles list --show-deleted --project=$projectId --filter="name=projects/${projectId}/roles/${projectRole}" --format="value[separator=','](name,deleted)"
87
+
);
88
+
if [ -z"${projectRoleInfo}" ]
89
+
then
90
+
gcloud iam roles create $projectRole --project=$projectId --title="Drata Read-Only Project Role" --description="Service Account for Drata Autopilot to get read access to all project resources" --stage="GA" --no-user-output-enabled;
91
+
else
92
+
# check if the role is on deleted state
93
+
IFS=',';read -r -a projectRoleArray <<<"$projectRoleInfo"
94
+
isRoleDeleted=${projectRoleArray[1]};
95
+
if [ -n"${isRoleDeleted}" ]
96
+
then
97
+
printf"${prefix} The role was deleted before, undeleting '${projectRole}' custom role to be available now...\n";
98
+
gcloud iam roles undelete $projectRole --project=$projectId --no-user-output-enabled
99
+
fi
100
+
fi
101
+
printf"${prefix} '${projectRole}' custom role has been created 🚀\n";
102
+
103
+
# Update permissions and stage
104
+
gcloud iam roles update $projectRole --project=$projectId --permissions="\
gcloud iam roles list --show-deleted --organization=$organizationId --filter="name=organizations/${organizationId}/roles/${organizationRole}" --format="value[separator=','](name,deleted)"
115
+
);
116
+
if [ -z"${organizationRoleInfo}" ]
117
+
then
118
+
gcloud iam roles create $organizationRole --organization=$organizationId --title="Drata Read-Only Organizational Role" --description="Service Account with read-only access for Drata Autopilot to get organizational IAM data." --stage="GA" --no-user-output-enabled
119
+
else
120
+
# check if the role is on deleted state
121
+
IFS=',';read -r -a organizationRoleArray <<<"$organizationRoleInfo"
122
+
isRoleDeleted=${organizationRoleArray[1]};
123
+
if [ -n"${isRoleDeleted}" ]
124
+
then
125
+
printf"${prefix} The role was deleted before, undeleting '${organizationRole}' custom role to be available now...\n";
126
+
gcloud iam roles undelete $organizationRole --organization=$organizationId --no-user-output-enabled
127
+
fi
128
+
fi
129
+
printf"${prefix} '${organizationRole}' organization role has been created 🚀\n";
130
+
131
+
# Update permissions and stage
132
+
gcloud iam roles update $organizationRole --organization=$organizationId --permissions="\
(gcloud iam service-accounts keys create ./drata-key-file.json --iam-account=${serviceAccountEmail} --project="$projectId" --no-user-output-enabled &&
155
+
printf"${prefix} Key file has been generated 🚀\n\n";)\
156
+
||printf"${prefix} Expected error, Please delete a key from the service account and run this script again. A max of 10 keys is supported per service account ❌\n\n"
157
+
158
+
# ===========================
159
+
# Assignments
160
+
# ===========================
161
+
# Assing project custom role
162
+
printf"${prefix} Assigning project custom role to service account...\n";
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments