docs(tutorials): improve quality redrive (#7915)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com>
This commit is contained in:
authored and GitHub committed 2025-07-29 11:03:52 +02:00
1 parent 1bdcf2c7f1
commit 9ca1899ebf
45 files changed
+1305 -872

No files matched your search

+14 -21
View File
@@ -1,18 +1,17 @@
# GCP authentication
# GCP Authentication in Prowler
Prowler will use by default your User Account credentials, you can configure it using:
## Default Authentication
- `gcloud init` to use a new account
- `gcloud config set account <account>` to use an existing account
- `gcloud auth application-default login`
By default, Prowler uses your User Account credentials. You can configure authentication as follows:
This will generate Application Default Credentials (ADC) that Prowler will use automatically.
- `gcloud init` to use a new account, or
- `gcloud config set account <account>` to use an existing account.
---
Then, obtain your access credentials using: `gcloud auth application-default login`.
## Using a Service Account key file
## Using Service Account Keys
Otherwise, you can generate and download Service Account keys in JSON format (refer to https://cloud.google.com/iam/docs/creating-managing-service-account-keys) and provide the location of the file with the following argument:
Alternatively, Service Account keys can be generated and downloaded in JSON format. Follow the steps in the Google Cloud IAM guide (https://cloud.google.com/iam/docs/creating-managing-service-account-keys) to create and manage service account keys. Provide the path to the key file using:
```console
prowler gcp --credentials-file path
@@ -21,8 +20,6 @@ prowler gcp --credentials-file path
???+ note
`prowler` will scan the GCP project associated with the credentials.
---
## Using an access token
If you already have an access token (e.g., generated with `gcloud auth print-access-token`), you can run Prowler with:
@@ -38,11 +35,9 @@ prowler gcp --project-ids <project-id>
export GOOGLE_CLOUD_PROJECT=<project-id>
```
---
## Credentials lookup order
Prowler follows the same search order as [Google authentication libraries](https://cloud.google.com/docs/authentication/application-default-credentials#search_order):
Prowler follows the same credential search process as [Google authentication libraries](https://cloud.google.com/docs/authentication/application-default-credentials#search_order), checking credentials in this order:
1. [`GOOGLE_APPLICATION_CREDENTIALS` environment variable](https://cloud.google.com/docs/authentication/application-default-credentials#GAC)
2. [`CLOUDSDK_AUTH_ACCESS_TOKEN` + optional `GOOGLE_CLOUD_PROJECT`](https://cloud.google.com/sdk/gcloud/reference/auth/print-access-token)
@@ -56,12 +51,10 @@ Prowler follows the same search order as [Google authentication libraries](https
???+ note
Prowler will use the enabled Google Cloud APIs to get the information needed to perform the checks.
---
## Required Permissions
## Needed permissions
Prowler for Google Cloud needs the following permissions to be set:
To ensure full functionality, Prowler for Google Cloud needs the following permissions to be set:
- **Reader (`roles/reader`) IAM role**: granted at the project / folder / org level in order to scan the target projects
@@ -78,12 +71,12 @@ The above settings must be associated to a user or service account.
???+ note
Prowler will use the enabled Google Cloud APIs to get the information needed to perform the checks.
## Impersonate Service Account
## Impersonating a GCP Service Account in Prowler
If you want to impersonate a GCP service account, you can use the `--impersonate-service-account` argument:
To impersonate a GCP service account, use the `--impersonate-service-account` argument followed by the service account email:
```console
prowler gcp --impersonate-service-account <service-account-email>
```
This argument will use the default credentials to impersonate the service account provided.
This command leverages the default credentials to impersonate the specified service account.