diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index 299c3f715e..f49253fb45 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -4,6 +4,9 @@ All notable changes to the **Prowler API** are documented in this file. ## [v1.9.0] (Prowler UNRELEASED) +### Added +- Support GCP Service Account key. [(#7824)](https://github.com/prowler-cloud/prowler/pull/7824) + ### Changed - Renamed field encrypted_password to password for M365 provider [(#7784)](https://github.com/prowler-cloud/prowler/pull/7784) diff --git a/api/src/backend/api/migrations/0026_provider_secret_gcp_service_account.py b/api/src/backend/api/migrations/0026_provider_secret_gcp_service_account.py new file mode 100644 index 0000000000..3857dbbd75 --- /dev/null +++ b/api/src/backend/api/migrations/0026_provider_secret_gcp_service_account.py @@ -0,0 +1,14 @@ +from django.db import migrations + + +class Migration(migrations.Migration): + dependencies = [ + ("api", "0025_findings_uid_index_parent"), + ] + + operations = [ + migrations.RunSQL( + "ALTER TYPE provider_secret_type ADD VALUE IF NOT EXISTS 'service_account';", + reverse_sql=migrations.RunSQL.noop, + ), + ] diff --git a/api/src/backend/api/models.py b/api/src/backend/api/models.py index a427bcf9c9..28b0845a3a 100644 --- a/api/src/backend/api/models.py +++ b/api/src/backend/api/models.py @@ -850,6 +850,7 @@ class ProviderSecret(RowLevelSecurityProtectedModel): class TypeChoices(models.TextChoices): STATIC = "static", _("Key-value pairs") ROLE = "role", _("Role assumption") + SERVICE_ACCOUNT = "service_account", _("GCP Service Account Key") id = models.UUIDField(primary_key=True, default=uuid4, editable=False) inserted_at = models.DateTimeField(auto_now_add=True, editable=False) diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml index 8431129344..c7c20b5d56 100644 --- a/api/src/backend/api/specs/v1.yaml +++ b/api/src/backend/api/specs/v1.yaml @@ -9137,10 +9137,12 @@ components: enum: - static - role + - service_account type: string description: |- * `static` - Key-value pairs * `role` - Role assumption + * `service_account` - GCP Service Account Key readOnly: true secret: oneOf: @@ -9269,6 +9271,14 @@ components: - client_id - client_secret - refresh_token + - type: object + title: GCP Service Account Key + properties: + service_account_key: + type: object + description: The service account key for GCP. + required: + - service_account_key - type: object title: Kubernetes Static Credentials properties: @@ -10317,10 +10327,12 @@ components: enum: - static - role + - service_account type: string description: |- * `static` - Key-value pairs * `role` - Role assumption + * `service_account` - GCP Service Account Key required: - secret_type relationships: @@ -10384,10 +10396,12 @@ components: enum: - static - role + - service_account type: string description: |- * `static` - Key-value pairs * `role` - Role assumption + * `service_account` - GCP Service Account Key secret: oneOf: - type: object @@ -10514,6 +10528,14 @@ components: - client_id - client_secret - refresh_token + - type: object + title: GCP Service Account Key + properties: + service_account_key: + type: object + description: The service account key for GCP. + required: + - service_account_key - type: object title: Kubernetes Static Credentials properties: @@ -10592,10 +10614,12 @@ components: enum: - static - role + - service_account type: string description: |- * `static` - Key-value pairs * `role` - Role assumption + * `service_account` - GCP Service Account Key secret: oneOf: - type: object @@ -10723,6 +10747,14 @@ components: - client_id - client_secret - refresh_token + - type: object + title: GCP Service Account Key + properties: + service_account_key: + type: object + description: The service account key for GCP. + required: + - service_account_key - type: object title: Kubernetes Static Credentials properties: @@ -10817,10 +10849,12 @@ components: enum: - static - role + - service_account type: string description: |- * `static` - Key-value pairs * `role` - Role assumption + * `service_account` - GCP Service Account Key readOnly: true secret: oneOf: @@ -10948,6 +10982,14 @@ components: - client_id - client_secret - refresh_token + - type: object + title: GCP Service Account Key + properties: + service_account_key: + type: object + description: The service account key for GCP. + required: + - service_account_key - type: object title: Kubernetes Static Credentials properties: diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py index 677f9437a6..f6c2c56c38 100644 --- a/api/src/backend/api/tests/test_views.py +++ b/api/src/backend/api/tests/test_views.py @@ -1679,6 +1679,26 @@ class TestProviderSecretViewSet: "refresh_token": "refresh-token", }, ), + # GCP with Service Account Key secret + ( + Provider.ProviderChoices.GCP.value, + ProviderSecret.TypeChoices.SERVICE_ACCOUNT, + { + "service_account_key": { + "type": "service_account", + "project_id": "project-id", + "private_key_id": "private-key-id", + "private_key": "private-key", + "client_email": "client-email", + "client_id": "client-id", + "auth_uri": "auth-uri", + "token_uri": "token-uri", + "auth_provider_x509_cert_url": "auth-provider-x509-cert-url", + "client_x509_cert_url": "client-x509-cert-url", + "universe_domain": "universe-domain", + }, + }, + ), # Kubernetes with STATIC secret ( Provider.ProviderChoices.KUBERNETES.value, diff --git a/api/src/backend/api/v1/serializer_utils/providers.py b/api/src/backend/api/v1/serializer_utils/providers.py index a6ecea67d0..0a1e999fe2 100644 --- a/api/src/backend/api/v1/serializer_utils/providers.py +++ b/api/src/backend/api/v1/serializer_utils/providers.py @@ -154,6 +154,17 @@ from rest_framework_json_api import serializers }, "required": ["client_id", "client_secret", "refresh_token"], }, + { + "type": "object", + "title": "GCP Service Account Key", + "properties": { + "service_account_key": { + "type": "object", + "description": "The service account key for GCP.", + } + }, + "required": ["service_account_key"], + }, { "type": "object", "title": "Kubernetes Static Credentials", diff --git a/api/src/backend/api/v1/serializers.py b/api/src/backend/api/v1/serializers.py index 4ba2154327..7beb311d5f 100644 --- a/api/src/backend/api/v1/serializers.py +++ b/api/src/backend/api/v1/serializers.py @@ -1159,6 +1159,8 @@ class BaseWriteProviderSecretSerializer(BaseWriteSerializer): ) elif secret_type == ProviderSecret.TypeChoices.ROLE: serializer = AWSRoleAssumptionProviderSecret(data=secret) + elif secret_type == ProviderSecret.TypeChoices.SERVICE_ACCOUNT: + serializer = GCPServiceAccountProviderSecret(data=secret) else: raise serializers.ValidationError( {"secret_type": f"Secret type not supported: {secret_type}"} @@ -1212,6 +1214,13 @@ class GCPProviderSecret(serializers.Serializer): resource_name = "provider-secrets" +class GCPServiceAccountProviderSecret(serializers.Serializer): + service_account_key = serializers.JSONField() + + class Meta: + resource_name = "provider-secrets" + + class KubernetesProviderSecret(serializers.Serializer): kubeconfig_content = serializers.CharField()