mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-29 06:44:21 +00:00
docs(tutorials): improve quality redrive (#7915)
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com> Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com>
This commit is contained in:
45 files changed
+1305
-872
No files matched your search
@@ -1,18 +1,17 @@
|
||||
# GCP authentication
|
||||
# GCP Authentication in Prowler
|
||||
|
||||
Prowler will use by default your User Account credentials, you can configure it using:
|
||||
## Default Authentication
|
||||
|
||||
- `gcloud init` to use a new account
|
||||
- `gcloud config set account <account>` to use an existing account
|
||||
- `gcloud auth application-default login`
|
||||
By default, Prowler uses your User Account credentials. You can configure authentication as follows:
|
||||
|
||||
This will generate Application Default Credentials (ADC) that Prowler will use automatically.
|
||||
- `gcloud init` to use a new account, or
|
||||
- `gcloud config set account <account>` to use an existing account.
|
||||
|
||||
---
|
||||
Then, obtain your access credentials using: `gcloud auth application-default login`.
|
||||
|
||||
## Using a Service Account key file
|
||||
## Using Service Account Keys
|
||||
|
||||
Otherwise, you can generate and download Service Account keys in JSON format (refer to https://cloud.google.com/iam/docs/creating-managing-service-account-keys) and provide the location of the file with the following argument:
|
||||
Alternatively, Service Account keys can be generated and downloaded in JSON format. Follow the steps in the Google Cloud IAM guide (https://cloud.google.com/iam/docs/creating-managing-service-account-keys) to create and manage service account keys. Provide the path to the key file using:
|
||||
|
||||
```console
|
||||
prowler gcp --credentials-file path
|
||||
@@ -21,8 +20,6 @@ prowler gcp --credentials-file path
|
||||
???+ note
|
||||
`prowler` will scan the GCP project associated with the credentials.
|
||||
|
||||
---
|
||||
|
||||
## Using an access token
|
||||
|
||||
If you already have an access token (e.g., generated with `gcloud auth print-access-token`), you can run Prowler with:
|
||||
@@ -38,11 +35,9 @@ prowler gcp --project-ids <project-id>
|
||||
export GOOGLE_CLOUD_PROJECT=<project-id>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Credentials lookup order
|
||||
|
||||
Prowler follows the same search order as [Google authentication libraries](https://cloud.google.com/docs/authentication/application-default-credentials#search_order):
|
||||
Prowler follows the same credential search process as [Google authentication libraries](https://cloud.google.com/docs/authentication/application-default-credentials#search_order), checking credentials in this order:
|
||||
|
||||
1. [`GOOGLE_APPLICATION_CREDENTIALS` environment variable](https://cloud.google.com/docs/authentication/application-default-credentials#GAC)
|
||||
2. [`CLOUDSDK_AUTH_ACCESS_TOKEN` + optional `GOOGLE_CLOUD_PROJECT`](https://cloud.google.com/sdk/gcloud/reference/auth/print-access-token)
|
||||
@@ -56,12 +51,10 @@ Prowler follows the same search order as [Google authentication libraries](https
|
||||
???+ note
|
||||
Prowler will use the enabled Google Cloud APIs to get the information needed to perform the checks.
|
||||
|
||||
---
|
||||
|
||||
## Required Permissions
|
||||
|
||||
## Needed permissions
|
||||
|
||||
Prowler for Google Cloud needs the following permissions to be set:
|
||||
To ensure full functionality, Prowler for Google Cloud needs the following permissions to be set:
|
||||
|
||||
- **Reader (`roles/reader`) IAM role**: granted at the project / folder / org level in order to scan the target projects
|
||||
|
||||
@@ -78,12 +71,12 @@ The above settings must be associated to a user or service account.
|
||||
???+ note
|
||||
Prowler will use the enabled Google Cloud APIs to get the information needed to perform the checks.
|
||||
|
||||
## Impersonate Service Account
|
||||
## Impersonating a GCP Service Account in Prowler
|
||||
|
||||
If you want to impersonate a GCP service account, you can use the `--impersonate-service-account` argument:
|
||||
To impersonate a GCP service account, use the `--impersonate-service-account` argument followed by the service account email:
|
||||
|
||||
```console
|
||||
prowler gcp --impersonate-service-account <service-account-email>
|
||||
```
|
||||
|
||||
This argument will use the default credentials to impersonate the service account provided.
|
||||
This command leverages the default credentials to impersonate the specified service account.
|
||||
Reference in new issue
Block a user