Skip to content

CMEK_WIRING.md

Latest commit

 

History

History
368 lines (283 loc) · 15.5 KB

CMEK_WIRING.md

File metadata and controls

368 lines (283 loc) · 15.5 KB
Raw

Generated by Merlin Studio (https://app.merlin-studio.cloud). Licensed under the Apache License, Version 2.0 (https://www.apache.org/licenses/LICENSE-2.0).

CMEK Wiring — Post-Deployment Service Agent IAM Bindings

Generated by Architex Landing Zone Wizard. Run these commands AFTER terraform apply creates the workload projects, since service agents require project numbers.

Prerequisites

  1. All workload projects must exist (run project factory stage first)
  2. You need roles/cloudkms.admin on the security project
  3. Set these variables:
export KMS_PROJECT="acme-corp-sec-core-0"
export KEYRING_EUROPE_WEST1="kr-europe-west1"
export LOCATION_EUROPE_WEST1="europe-west1"
export KEYRING_EUROPE_WEST4="kr-europe-west4"
export LOCATION_EUROPE_WEST4="europe-west4"

Project: app-dev-0

# Get project number:
export PROJECT_NUMBER_app_dev_0=$(gcloud projects describe acme-corp-app-dev-0 --format="value(projectNumber)")

# Cloud Functions source and build artifacts
gcloud kms keys add-iam-policy-binding cloudfunctions \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_app_dev_0@gcf-admin-robot.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Run container images and revisions
gcloud kms keys add-iam-policy-binding cloudrun \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_app_dev_0@serverless-robot-prod.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: app-int-0

# Get project number:
export PROJECT_NUMBER_app_int_0=$(gcloud projects describe acme-corp-app-int-0 --format="value(projectNumber)")

# Cloud Functions source and build artifacts
gcloud kms keys add-iam-policy-binding cloudfunctions \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_app_int_0@gcf-admin-robot.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Run container images and revisions
gcloud kms keys add-iam-policy-binding cloudrun \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_app_int_0@serverless-robot-prod.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: app-prd-0

# Get project number:
export PROJECT_NUMBER_app_prd_0=$(gcloud projects describe acme-corp-app-prd-0 --format="value(projectNumber)")

# Cloud Functions source and build artifacts
gcloud kms keys add-iam-policy-binding cloudfunctions \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_app_prd_0@gcf-admin-robot.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Run container images and revisions
gcloud kms keys add-iam-policy-binding cloudrun \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_app_prd_0@serverless-robot-prod.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: app-stg-0

# Get project number:
export PROJECT_NUMBER_app_stg_0=$(gcloud projects describe acme-corp-app-stg-0 --format="value(projectNumber)")

# Cloud Functions source and build artifacts
gcloud kms keys add-iam-policy-binding cloudfunctions \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_app_stg_0@gcf-admin-robot.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Run container images and revisions
gcloud kms keys add-iam-policy-binding cloudrun \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_app_stg_0@serverless-robot-prod.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: dp-dev-0

# Get project number:
export PROJECT_NUMBER_dp_dev_0=$(gcloud projects describe acme-corp-dp-dev-0 --format="value(projectNumber)")

# BigQuery datasets and tables
gcloud kms keys add-iam-policy-binding bigquery \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:bq-$PROJECT_NUMBER_dp_dev_0@bigquery-encryption.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Firestore databases
gcloud kms keys add-iam-policy-binding firestore \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_dev_0@gcp-sa-firestore.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Pub/Sub message encryption
gcloud kms keys add-iam-policy-binding pubsub \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_dev_0@gcp-sa-pubsub.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud SQL instances
gcloud kms keys add-iam-policy-binding cloudsql \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_dev_0@gcp-sa-cloud-sql.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Storage buckets and objects
gcloud kms keys add-iam-policy-binding storage \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_dev_0@gs-project-accounts.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: dp-int-0

# Get project number:
export PROJECT_NUMBER_dp_int_0=$(gcloud projects describe acme-corp-dp-int-0 --format="value(projectNumber)")

# BigQuery datasets and tables
gcloud kms keys add-iam-policy-binding bigquery \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:bq-$PROJECT_NUMBER_dp_int_0@bigquery-encryption.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Firestore databases
gcloud kms keys add-iam-policy-binding firestore \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_int_0@gcp-sa-firestore.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Pub/Sub message encryption
gcloud kms keys add-iam-policy-binding pubsub \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_int_0@gcp-sa-pubsub.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud SQL instances
gcloud kms keys add-iam-policy-binding cloudsql \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_int_0@gcp-sa-cloud-sql.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Storage buckets and objects
gcloud kms keys add-iam-policy-binding storage \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_int_0@gs-project-accounts.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: dp-prd-0

# Get project number:
export PROJECT_NUMBER_dp_prd_0=$(gcloud projects describe acme-corp-dp-prd-0 --format="value(projectNumber)")

# BigQuery datasets and tables
gcloud kms keys add-iam-policy-binding bigquery \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:bq-$PROJECT_NUMBER_dp_prd_0@bigquery-encryption.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Firestore databases
gcloud kms keys add-iam-policy-binding firestore \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_prd_0@gcp-sa-firestore.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Pub/Sub message encryption
gcloud kms keys add-iam-policy-binding pubsub \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_prd_0@gcp-sa-pubsub.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud SQL instances
gcloud kms keys add-iam-policy-binding cloudsql \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_prd_0@gcp-sa-cloud-sql.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Storage buckets and objects
gcloud kms keys add-iam-policy-binding storage \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_prd_0@gs-project-accounts.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: dp-stg-0

# Get project number:
export PROJECT_NUMBER_dp_stg_0=$(gcloud projects describe acme-corp-dp-stg-0 --format="value(projectNumber)")

# BigQuery datasets and tables
gcloud kms keys add-iam-policy-binding bigquery \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:bq-$PROJECT_NUMBER_dp_stg_0@bigquery-encryption.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Firestore databases
gcloud kms keys add-iam-policy-binding firestore \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_stg_0@gcp-sa-firestore.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Pub/Sub message encryption
gcloud kms keys add-iam-policy-binding pubsub \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_stg_0@gcp-sa-pubsub.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud SQL instances
gcloud kms keys add-iam-policy-binding cloudsql \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_stg_0@gcp-sa-cloud-sql.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Storage buckets and objects
gcloud kms keys add-iam-policy-binding storage \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_dp_stg_0@gs-project-accounts.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: gke-dev-0

# Get project number:
export PROJECT_NUMBER_gke_dev_0=$(gcloud projects describe acme-corp-gke-dev-0 --format="value(projectNumber)")

# GKE cluster secrets, etcd encryption, boot disks
gcloud kms keys add-iam-policy-binding gke \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_dev_0@container-engine-robot.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Additional agent for gke
gcloud kms keys add-iam-policy-binding gke \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_dev_0@compute-system.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Logging log buckets
gcloud kms keys add-iam-policy-binding logging \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_dev_0@gcp-sa-logging.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: gke-int-0

# Get project number:
export PROJECT_NUMBER_gke_int_0=$(gcloud projects describe acme-corp-gke-int-0 --format="value(projectNumber)")

# GKE cluster secrets, etcd encryption, boot disks
gcloud kms keys add-iam-policy-binding gke \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_int_0@container-engine-robot.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Additional agent for gke
gcloud kms keys add-iam-policy-binding gke \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_int_0@compute-system.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Logging log buckets
gcloud kms keys add-iam-policy-binding logging \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_int_0@gcp-sa-logging.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: gke-prd-0

# Get project number:
export PROJECT_NUMBER_gke_prd_0=$(gcloud projects describe acme-corp-gke-prd-0 --format="value(projectNumber)")

# GKE cluster secrets, etcd encryption, boot disks
gcloud kms keys add-iam-policy-binding gke \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_prd_0@container-engine-robot.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Additional agent for gke
gcloud kms keys add-iam-policy-binding gke \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_prd_0@compute-system.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Logging log buckets
gcloud kms keys add-iam-policy-binding logging \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_prd_0@gcp-sa-logging.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Project: gke-stg-0

# Get project number:
export PROJECT_NUMBER_gke_stg_0=$(gcloud projects describe acme-corp-gke-stg-0 --format="value(projectNumber)")

# GKE cluster secrets, etcd encryption, boot disks
gcloud kms keys add-iam-policy-binding gke \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_stg_0@container-engine-robot.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Additional agent for gke
gcloud kms keys add-iam-policy-binding gke \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_stg_0@compute-system.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Cloud Logging log buckets
gcloud kms keys add-iam-policy-binding logging \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT \
  --member="serviceAccount:service-$PROJECT_NUMBER_gke_stg_0@gcp-sa-logging.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Verification

After running the above commands, verify IAM bindings:

gcloud kms keys get-iam-policy <KEY_NAME> \
  --keyring=kr-europe-west1 --location=europe-west1 --project=$KMS_PROJECT

Check that each service agent has roles/cloudkms.cryptoKeyEncrypterDecrypter.