ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 13:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): support GCP Service Account key (#7824)

Browse Source 
Co-authored-by: Sergio Garcia <38561120+garcitm@users.noreply.github.com>
Co-authored-by: Víctor Fernández Poyatos <victor@prowler.com>
This commit is contained in:
Sergio Garcia
2025-05-26 15:42:39 +02:00
committed by GitHub
parent 3658e85cfc
commit be1e3e942b
7 changed files with 100 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/CHANGELOG.md
+3
View File
@@ -4,6 +4,9 @@ All notable changes to the **Prowler API** are documented in this file.
## [v1.9.0] (Prowler UNRELEASED)
### Added
- Support GCP Service Account key. [(#7824)](https://github.com/prowler-cloud/prowler/pull/7824)
### Changed
- Renamed field encrypted_password to password for M365 provider [(#7784)](https://github.com/prowler-cloud/prowler/pull/7784)
api/src/backend/api/migrations/0026_provider_secret_gcp_service_account.py
+14
View File
@@ -0,0 +1,14 @@
from django.db import migrations
class Migration(migrations.Migration):
dependencies = [
("api", "0025_findings_uid_index_parent"),
]
operations = [
migrations.RunSQL(
"ALTER TYPE provider_secret_type ADD VALUE IF NOT EXISTS 'service_account';",
reverse_sql=migrations.RunSQL.noop,
),
]
api/src/backend/api/models.py
+1
View File
@@ -850,6 +850,7 @@ class ProviderSecret(RowLevelSecurityProtectedModel):
class TypeChoices(models.TextChoices):
STATIC = "static", _("Key-value pairs")
ROLE = "role", _("Role assumption")
SERVICE_ACCOUNT = "service_account", _("GCP Service Account Key")
id = models.UUIDField(primary_key=True, default=uuid4, editable=False)
inserted_at = models.DateTimeField(auto_now_add=True, editable=False)
api/src/backend/api/specs/v1.yaml
+42
View File
@@ -9137,10 +9137,12 @@ components:
enum:
- static
- role
- service_account
type: string
description: |-
* `static` - Key-value pairs
* `role` - Role assumption
* `service_account` - GCP Service Account Key
readOnly: true
secret:
oneOf:
@@ -9269,6 +9271,14 @@ components:
- client_id
- client_secret
- refresh_token
- type: object
title: GCP Service Account Key
properties:
service_account_key:
type: object
description: The service account key for GCP.
required:
- service_account_key
- type: object
title: Kubernetes Static Credentials
properties:
@@ -10317,10 +10327,12 @@ components:
enum:
- static
- role
- service_account
type: string
description: |-
* `static` - Key-value pairs
* `role` - Role assumption
* `service_account` - GCP Service Account Key
required:
- secret_type
relationships:
@@ -10384,10 +10396,12 @@ components:
enum:
- static
- role
- service_account
type: string
description: |-
* `static` - Key-value pairs
* `role` - Role assumption
* `service_account` - GCP Service Account Key
secret:
oneOf:
- type: object
@@ -10514,6 +10528,14 @@ components:
- client_id
- client_secret
- refresh_token
- type: object
title: GCP Service Account Key
properties:
service_account_key:
type: object
description: The service account key for GCP.
required:
- service_account_key
- type: object
title: Kubernetes Static Credentials
properties:
@@ -10592,10 +10614,12 @@ components:
enum:
- static
- role
- service_account
type: string
description: |-
* `static` - Key-value pairs
* `role` - Role assumption
* `service_account` - GCP Service Account Key
secret:
oneOf:
- type: object
@@ -10723,6 +10747,14 @@ components:
- client_id
- client_secret
- refresh_token
- type: object
title: GCP Service Account Key
properties:
service_account_key:
type: object
description: The service account key for GCP.
required:
- service_account_key
- type: object
title: Kubernetes Static Credentials
properties:
@@ -10817,10 +10849,12 @@ components:
enum:
- static
- role
- service_account
type: string
description: |-
* `static` - Key-value pairs
* `role` - Role assumption
* `service_account` - GCP Service Account Key
readOnly: true
secret:
oneOf:
@@ -10948,6 +10982,14 @@ components:
- client_id
- client_secret
- refresh_token
- type: object
title: GCP Service Account Key
properties:
service_account_key:
type: object
description: The service account key for GCP.
required:
- service_account_key
- type: object
title: Kubernetes Static Credentials
properties:
api/src/backend/api/tests/test_views.py
+20
View File
@@ -1679,6 +1679,26 @@ class TestProviderSecretViewSet:
"refresh_token": "refresh-token",
},
),
# GCP with Service Account Key secret
(
Provider.ProviderChoices.GCP.value,
ProviderSecret.TypeChoices.SERVICE_ACCOUNT,
{
"service_account_key": {
"type": "service_account",
"project_id": "project-id",
"private_key_id": "private-key-id",
"private_key": "private-key",
"client_email": "client-email",
"client_id": "client-id",
"auth_uri": "auth-uri",
"token_uri": "token-uri",
"auth_provider_x509_cert_url": "auth-provider-x509-cert-url",
"client_x509_cert_url": "client-x509-cert-url",
"universe_domain": "universe-domain",
},
},
),
# Kubernetes with STATIC secret
(
Provider.ProviderChoices.KUBERNETES.value,
api/src/backend/api/v1/serializer_utils/providers.py
+11
View File
@@ -154,6 +154,17 @@ from rest_framework_json_api import serializers
},
"required": ["client_id", "client_secret", "refresh_token"],
},
{
"type": "object",
"title": "GCP Service Account Key",
"properties": {
"service_account_key": {
"type": "object",
"description": "The service account key for GCP.",
}
},
"required": ["service_account_key"],
},
{
"type": "object",
"title": "Kubernetes Static Credentials",
api/src/backend/api/v1/serializers.py
+9
View File
@@ -1159,6 +1159,8 @@ class BaseWriteProviderSecretSerializer(BaseWriteSerializer):
)
elif secret_type == ProviderSecret.TypeChoices.ROLE:
serializer = AWSRoleAssumptionProviderSecret(data=secret)
elif secret_type == ProviderSecret.TypeChoices.SERVICE_ACCOUNT:
serializer = GCPServiceAccountProviderSecret(data=secret)
else:
raise serializers.ValidationError(
{"secret_type": f"Secret type not supported: {secret_type}"}
@@ -1212,6 +1214,13 @@ class GCPProviderSecret(serializers.Serializer):
resource_name = "provider-secrets"
class GCPServiceAccountProviderSecret(serializers.Serializer):
service_account_key = serializers.JSONField()
class Meta:
resource_name = "provider-secrets"
class KubernetesProviderSecret(serializers.Serializer):
kubeconfig_content = serializers.CharField()