5-app-infra/4-data-governance/policy-library/policies/templates/gcp_iam_custom_role_permissions_v1.yaml [15:132]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apiVersion: templates.gatekeeper.sh/v1alpha1
kind: ConstraintTemplate
metadata:
  name: gcp-iam-custom-role-permissions-v1
spec:
  crd:
    spec:
      names:
        kind: GCPIAMCustomRolePermissionsConstraintV1
      validation:
        openAPIV3Schema:
          required: ["mode", "permissions"]
          properties:
            mode:
              description: "Enforcement mode, defaults to allowlist"
              type: string
              enum: [denylist, allowlist]
            title:
              description: "The custom role title to scan for, found on the IAM Roles
                page. E.g. 'My Custom Role for BigQuery'. Default will scan all role
                titles."
              type: string
            permissions:
              description: "Permissions to either allow or deny for the given custom
                role, depending on mode; Wildcards (*) supported. E.g. 'bigquery.datasets.*'
                will search for any permissions that start with bigquery.datasets,
                such as bigquery.datasets.get E.g. 'bigquery.**' will search for any
                permissions that start with bigquery, such as bigquery.savedqueries.get,
                bigquery.config.get E.g. '*' will search for any permissions"
              type: array
              items:
                type: string
  targets:
    validation.gcp.forsetisecurity.org:
      rego: |
        #
        # Copyright 2021 Google LLC
        #
        # Licensed under the Apache License, Version 2.0 (the "License");
        # you may not use this file except in compliance with the License.
        # You may obtain a copy of the License at
        #
        #     https://www.apache.org/licenses/LICENSE-2.0
        #
        # Unless required by applicable law or agreed to in writing, software
        # distributed under the License is distributed on an "AS IS" BASIS,
        # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
        # See the License for the specific language governing permissions and
        # limitations under the License.
        #

        package templates.gcp.GCPIAMCustomRolePermissionsConstraintV1

        import data.validator.gcp.lib as lib

        deny[{
        	"msg": message,
        	"details": metadata,
        }] {
        	constraint := input.constraint
        	lib.get_constraint_params(constraint, params)
        	asset := input.asset

        	asset.asset_type == "iam.googleapis.com/Role"

        	asset_permissions := asset.resource.data.includedPermissions[_]
        	asset_title := asset.resource.data.title

        	params_title := lib.get_default(params, "title", "*")

        	check_asset_title(asset_title, params_title)

        	mode := lib.get_default(params, "mode", "allowlist")

        	matches_found = [m | m = config_pattern(params.permissions[_]); glob.match(m, [], asset_permissions)]
        	target_match_count(mode, desired_count)
        	count(matches_found) != desired_count

        	message := sprintf("Role %v grants permission %v", [asset.name, asset_permissions])

        	metadata := {
        		"resource": asset.name,
        		"role_title": asset_title,
        		"permission": asset_permissions,
        	}
        }

        ###########################
        # Rule Utilities
        ###########################

        # Determine the overlap between matches under test and constraint
        target_match_count(mode) = 0 {
        	mode == "denylist"
        }

        target_match_count(mode) = 1 {
        	mode == "allowlist"
        }

        check_asset_title(asset_title, params_title) {
        	params_title == "*"
        }

        check_asset_title(asset_title, params_title) {
        	params_title != "*"
        	lower(asset_title) == lower(params_title)
        }

        # If the member in constraint is written as a single "*", turn it into super
        # glob "**". Otherwise, we won't be able to match everything.
        config_pattern(old_pattern) = "**" {
        	old_pattern == "*"
        }

        config_pattern(old_pattern) = old_pattern {
        	old_pattern != "*"
        }
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



policy-library/policies/templates/gcp_iam_custom_role_permissions_v1.yaml [15:132]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apiVersion: templates.gatekeeper.sh/v1alpha1
kind: ConstraintTemplate
metadata:
  name: gcp-iam-custom-role-permissions-v1
spec:
  crd:
    spec:
      names:
        kind: GCPIAMCustomRolePermissionsConstraintV1
      validation:
        openAPIV3Schema:
          required: ["mode", "permissions"]
          properties:
            mode:
              description: "Enforcement mode, defaults to allowlist"
              type: string
              enum: [denylist, allowlist]
            title:
              description: "The custom role title to scan for, found on the IAM Roles
                page. E.g. 'My Custom Role for BigQuery'. Default will scan all role
                titles."
              type: string
            permissions:
              description: "Permissions to either allow or deny for the given custom
                role, depending on mode; Wildcards (*) supported. E.g. 'bigquery.datasets.*'
                will search for any permissions that start with bigquery.datasets,
                such as bigquery.datasets.get E.g. 'bigquery.**' will search for any
                permissions that start with bigquery, such as bigquery.savedqueries.get,
                bigquery.config.get E.g. '*' will search for any permissions"
              type: array
              items:
                type: string
  targets:
    validation.gcp.forsetisecurity.org:
      rego: |
        #
        # Copyright 2021 Google LLC
        #
        # Licensed under the Apache License, Version 2.0 (the "License");
        # you may not use this file except in compliance with the License.
        # You may obtain a copy of the License at
        #
        #     https://www.apache.org/licenses/LICENSE-2.0
        #
        # Unless required by applicable law or agreed to in writing, software
        # distributed under the License is distributed on an "AS IS" BASIS,
        # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
        # See the License for the specific language governing permissions and
        # limitations under the License.
        #

        package templates.gcp.GCPIAMCustomRolePermissionsConstraintV1

        import data.validator.gcp.lib as lib

        deny[{
        	"msg": message,
        	"details": metadata,
        }] {
        	constraint := input.constraint
        	lib.get_constraint_params(constraint, params)
        	asset := input.asset

        	asset.asset_type == "iam.googleapis.com/Role"

        	asset_permissions := asset.resource.data.includedPermissions[_]
        	asset_title := asset.resource.data.title

        	params_title := lib.get_default(params, "title", "*")

        	check_asset_title(asset_title, params_title)

        	mode := lib.get_default(params, "mode", "allowlist")

        	matches_found = [m | m = config_pattern(params.permissions[_]); glob.match(m, [], asset_permissions)]
        	target_match_count(mode, desired_count)
        	count(matches_found) != desired_count

        	message := sprintf("Role %v grants permission %v", [asset.name, asset_permissions])

        	metadata := {
        		"resource": asset.name,
        		"role_title": asset_title,
        		"permission": asset_permissions,
        	}
        }

        ###########################
        # Rule Utilities
        ###########################

        # Determine the overlap between matches under test and constraint
        target_match_count(mode) = 0 {
        	mode == "denylist"
        }

        target_match_count(mode) = 1 {
        	mode == "allowlist"
        }

        check_asset_title(asset_title, params_title) {
        	params_title == "*"
        }

        check_asset_title(asset_title, params_title) {
        	params_title != "*"
        	lower(asset_title) == lower(params_title)
        }

        # If the member in constraint is written as a single "*", turn it into super
        # glob "**". Otherwise, we won't be able to match everything.
        config_pattern(old_pattern) = "**" {
        	old_pattern == "*"
        }

        config_pattern(old_pattern) = old_pattern {
        	old_pattern != "*"
        }
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



