Crea un informe de validación de IaC de muestra

Prepare el entorno

1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
2. Install the Google Cloud CLI.

3. To initialize the gcloud CLI, run the following command:

   gcloud init

4. Create or select a Google Cloud project.

   • Create a Google Cloud project:

     gcloud projects create PROJECT_ID

     Replace PROJECT_ID with a name for the Google Cloud project you are creating.

   • Select the Google Cloud project that you created:

     gcloud config set project PROJECT_ID

     Replace PROJECT_ID with your Google Cloud project name.

5. Make sure that billing is enabled for your Google Cloud project.

6. Enable the Security posture service and Security Command Center management APIs:

   gcloud services enable securityposture.googleapis.com  securitycentermanagement.googleapis.com

7. Install the Google Cloud CLI.

8. To initialize the gcloud CLI, run the following command:

   gcloud init

9. Create or select a Google Cloud project.

   • Create a Google Cloud project:

     gcloud projects create PROJECT_ID

     Replace PROJECT_ID with a name for the Google Cloud project you are creating.

   • Select the Google Cloud project that you created:

     gcloud config set project PROJECT_ID

     Replace PROJECT_ID with your Google Cloud project name.

10. Make sure that billing is enabled for your Google Cloud project.

11. Enable the Security posture service and Security Command Center management APIs:

    gcloud services enable securityposture.googleapis.com  securitycentermanagement.googleapis.com

12. Copia el número del proyecto. Necesitarás el número de proyecto para establecer el recurso de destino mientras implementas la postura.

    gcloud projects describe PROJECT_ID

13. Inicializa Terraform mediante este comando:

    terraform init

Crea e implementa una postura

1. En Cloud Shell, inicia el editor de Cloud Shell. Para iniciar el editor, haz clic en Abrir editor en la barra de herramientas de la ventana de Cloud Shell.

2. Crea un archivo YAML llamado example-standard.yaml.

3. Pega el siguiente código en tu archivo:

   name: organizations/ORGANIZATION_ID/locations/global/postures/example-standard
   state: ACTIVE
   policySets:
   - policySetId: policySet1
   policies:
   - constraint:
     orgPolicyConstraintCustom:
       customConstraint:
         actionType: ALLOW
         condition: "resource.initialNodeCount == 3"
         description: Set initial node count to be exactly 3.
         displayName: fixedNodeCount
         methodTypes:
         - CREATE
         name: organizations/ORGANIZATION_ID/customConstraints/custom.fixedNodeCount
         resourceTypes:
         - container.googleapis.com/NodePool
       policyRules:
       - enforce: true
   policyId: fixedNodeCount
   - constraint:
     securityHealthAnalyticsCustomModule:
       config:
         customOutput: {}
         description: Set MTU for a network to be exactly 1000.
         predicate:
           expression: "!(resource.mtu == 1000)"
         recommendation: Only create networks whose MTU is 1000.
         resourceSelector:
           resourceTypes:
           - compute.googleapis.com/Network
         severity: HIGH
       displayName: fixedMTU
       moduleEnablementState: ENABLED
   policyId: fixedMTU
   - constraint:
     securityHealthAnalyticsModule:
       moduleEnablementState: ENABLED
       moduleName: BUCKET_POLICY_ONLY_DISABLED
   policyId: bucket_policy_only_disabled
   - constraint:
     securityHealthAnalyticsModule:
       moduleEnablementState: ENABLED
       moduleName: BUCKET_LOGGING_DISABLED
   policyId: bucket_logging_disabled

   Reemplaza ORGANIZATION_ID por el ID de tu organización.

4. En Cloud Shell, crea la postura:

   gcloud scc postures create organizations/ORGANIZATION_ID/locations/global/postures/example-standard --posture-from-file=example-standard.yaml
   

5. Copia el ID de revisión de la postura que genera el comando.

6. Implementa la postura en tu proyecto:

   gcloud scc posture-deployments create organizations/ORGANIZATION_ID/locations/global/postureDeployments/example-standard \
   --posture-name=organizations/ORGANIZATION_ID/locations/global/postures/example-standard \
   --posture-revision-id="POSTURE_REVISION_ID" \
   --target-resource=projects/PROJECT_NUMBER
   

   Reemplaza lo siguiente:

   • ORGANIZATION_ID: Es el ID de tu organización.
   • POSTURE REVISION_ID: El ID de revisión de postura que copiaste.
   • PROJECT_NUMBER: Es el número de tu proyecto.

Crea el archivo Terraform y realiza la validación

1. En Cloud Shell, inicia el editor de Cloud Shell.

2. Crea un archivo Terraform llamado main.tf.

3. Pega el siguiente código en tu archivo:

   terraform {
     required_providers {
       google = {
         source  = "hashicorp/google"
       }
     }
   }
   
   provider "google" {
     region  = "us-central1"
     zone    = "us-central1-c"
   }
   
   resource "google_compute_network" "example_network"{
     name                            = "example-network-1"
     delete_default_routes_on_create = false
     auto_create_subnetworks         = false
     routing_mode                    = "REGIONAL"
     mtu                             = 100
     project                         = "PROJECT_ID"
   }
   
   resource "google_container_node_pool" "example_node_pool" {
     name               = "example-node-pool-1"
     cluster            = "example-cluster-1"
     project            = "PROJECT_ID"
     initial_node_count = 2
   
     node_config {
       preemptible  = true
       machine_type = "e2-medium"
     }
   }
   
   resource "google_storage_bucket" "example_bucket" {
     name          = "example-bucket-1"
     location      = "EU"
     force_destroy = true
   
     project = "PROJECT_ID"
   
     uniform_bucket_level_access = false
   }
   

   Reemplaza PROJECT_ID por el ID del proyecto que creaste.

4. En Cloud Shell, crea el archivo de plan de Terraform y conviértelo al formato JSON:

   terraform plan -out main.plan
   terraform show -json main.plan > mainplan.json
   

5. Crea el informe de validación de IaC para mainplan.json:

   gcloud scc iac-validation-reports create organizations/ORGANIZATION_ID/locations/global --tf-plan-file=mainplan.json
   

   Este comando muestra un informe de validación de IaC que describe los siguientes incumplimientos:

   • El mtu de example_network no es 1,000.
   • El initial_node_count para example_node_pool no es 3.
   • El example_bucket no tiene habilitado el acceso uniforme a nivel del bucket.
   • example_bucket no tiene habilitado el registro.

Resuelve incumplimientos

1. En Cloud Shell, inicia el editor de Cloud Shell.

2. Actualiza el archivo main.tf con los siguientes cambios:

   terraform {
     required_providers {
       google = {
         source  = "hashicorp/google"
       }
     }
   }
   
   provider "google" {
     region  = "us-central1"
     zone    = "us-central1-c"
   }
   
   resource "google_compute_network" "example_network"{
     name                            = "example-network-1"
     delete_default_routes_on_create = false
     auto_create_subnetworks         = false
     routing_mode                    = "REGIONAL"
     mtu                             = 1000
     project                         = "PROJECT_ID"
   }
   
   resource "google_container_node_pool" "example_node_pool" {
     name               = "example-node-pool-1"
     cluster            = "example-cluster-1"
     project            = "PROJECT_ID"
     initial_node_count = 3
   
     node_config {
       preemptible  = true
       machine_type = "e2-medium"
     }
   }
   
   resource "google_storage_bucket" "example_bucket" {
     name          = "example-bucket-1"
     location      = "EU"
     force_destroy = true
   
     project = "PROJECT_ID"
     uniform_bucket_level_access = true
   
     logging {
       log_bucket   = "my-unique-logging-bucket" // Create a separate bucket for logs
       log_object_prefix = "tf-logs/"             // Optional prefix for better structure
     }
   }
   

   Reemplaza PROJECT_ID por el ID del proyecto que creaste.

3. En Cloud Shell, crea el archivo de plan de Terraform y conviértelo al formato JSON:

   terraform plan -out main.plan
   terraform show -json main.plan > mainplan.json
   

4. Vuelve a crear el informe de validación de IaC para mainplan.json:

   gcloud scc iac-validation-reports create organizations/ORGANIZATION_ID/locations/global --tf-plan-file=mainplan.json