mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-01-25 02:08:11 +00:00
chore(gcp): add script to enable APIs in GCP projects (#4117)
Co-authored-by: Pepe Fagoaga <pepe@prowler.com>
This commit is contained in:
@@ -14,4 +14,4 @@ cd ~ || exit
|
|||||||
python3.9 -m pip install prowler-cloud
|
python3.9 -m pip install prowler-cloud
|
||||||
prowler -v
|
prowler -v
|
||||||
# Run Prowler
|
# Run Prowler
|
||||||
prowler
|
prowler aws
|
||||||
|
Before Width: | Height: | Size: 125 KiB After Width: | Height: | Size: 125 KiB |
|
Before Width: | Height: | Size: 30 KiB After Width: | Height: | Size: 30 KiB |
47
contrib/gcp/enable_apis_in_projects.sh
Executable file
47
contrib/gcp/enable_apis_in_projects.sh
Executable file
@@ -0,0 +1,47 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# List of project IDs
|
||||||
|
PROJECT_IDS=(
|
||||||
|
"project-id-1"
|
||||||
|
"project-id-2"
|
||||||
|
"project-id-3"
|
||||||
|
# Add more project IDs as needed
|
||||||
|
)
|
||||||
|
|
||||||
|
# List of Prowler APIs to enable
|
||||||
|
APIS=(
|
||||||
|
"apikeys.googleapis.com"
|
||||||
|
"artifactregistry.googleapis.com"
|
||||||
|
"bigquery.googleapis.com"
|
||||||
|
"sqladmin.googleapis.com" # Cloud SQL
|
||||||
|
"storage.googleapis.com" # Cloud Storage
|
||||||
|
"compute.googleapis.com"
|
||||||
|
"dataproc.googleapis.com"
|
||||||
|
"dns.googleapis.com"
|
||||||
|
"containerregistry.googleapis.com" # GCR (Google Container Registry)
|
||||||
|
"container.googleapis.com" # GKE (Google Kubernetes Engine)
|
||||||
|
"iam.googleapis.com"
|
||||||
|
"cloudkms.googleapis.com" # KMS (Key Management Service)
|
||||||
|
"logging.googleapis.com"
|
||||||
|
)
|
||||||
|
|
||||||
|
# Function to enable APIs for a given project
|
||||||
|
enable_apis_for_project() {
|
||||||
|
local PROJECT_ID=$1
|
||||||
|
|
||||||
|
echo "Enabling APIs for project: ${PROJECT_ID}"
|
||||||
|
|
||||||
|
for API in "${APIS[@]}"; do
|
||||||
|
echo "Enabling API: $API for project: ${PROJECT_ID}"
|
||||||
|
if gcloud services enable "${API}" --project="${PROJECT_ID}"; then
|
||||||
|
echo "Successfully enabled API $API for project ${PROJECT_ID}."
|
||||||
|
else
|
||||||
|
echo "Failed to enable API $API for project ${PROJECT_ID}."
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
# Loop over each project and enable the APIs
|
||||||
|
for PROJECT_ID in "${PROJECT_IDS[@]}"; do
|
||||||
|
enable_apis_for_project "${PROJECT_ID}"
|
||||||
|
done
|
||||||
@@ -24,3 +24,23 @@ Prowler will follow the same credentials search as [Google authentication librar
|
|||||||
3. [The attached service account, returned by the metadata server](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa)
|
3. [The attached service account, returned by the metadata server](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa)
|
||||||
|
|
||||||
Those credentials must be associated to a user or service account with proper permissions to do all checks. To make sure, add the `Viewer` role to the member associated with the credentials.
|
Those credentials must be associated to a user or service account with proper permissions to do all checks. To make sure, add the `Viewer` role to the member associated with the credentials.
|
||||||
|
|
||||||
|
# GCP Service APIs
|
||||||
|
|
||||||
|
Prowler will use the Google Cloud APIs to get the information needed to perform the checks. Make sure that the following APIs are enabled in the project:
|
||||||
|
|
||||||
|
- apikeys.googleapis.com
|
||||||
|
- artifactregistry.googleapis.com
|
||||||
|
- bigquery.googleapis.com
|
||||||
|
- sqladmin.googleapis.com
|
||||||
|
- storage.googleapis.com
|
||||||
|
- compute.googleapis.com
|
||||||
|
- dataproc.googleapis.com
|
||||||
|
- dns.googleapis.com
|
||||||
|
- containerregistry.googleapis.com
|
||||||
|
- container.googleapis.com
|
||||||
|
- iam.googleapis.com
|
||||||
|
- cloudkms.googleapis.com
|
||||||
|
- logging.googleapis.com
|
||||||
|
|
||||||
|
You can enable them automatically using our script [enable_apis_in_projects.sh](https://github.com/prowler-cloud/prowler/blob/master/contrib/gcp/enable_apis_in_projects.sh)
|
||||||
|
|||||||
Reference in New Issue
Block a user