Creare un report di convalida IaC di esempio

Prepara l'ambiente

1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
2. Install the Google Cloud CLI.

3. To initialize the gcloud CLI, run the following command:

   gcloud init

4. Create or select a Google Cloud project.

   • Create a Google Cloud project:

     gcloud projects create PROJECT_ID

     Replace PROJECT_ID with a name for the Google Cloud project you are creating.

   • Select the Google Cloud project that you created:

     gcloud config set project PROJECT_ID

     Replace PROJECT_ID with your Google Cloud project name.

5. Make sure that billing is enabled for your Google Cloud project.

6. Enable the Security posture service and Security Command Center management APIs:

   gcloud services enable securityposture.googleapis.com  securitycentermanagement.googleapis.com

7. Install the Google Cloud CLI.

8. To initialize the gcloud CLI, run the following command:

   gcloud init

9. Create or select a Google Cloud project.

   • Create a Google Cloud project:

     gcloud projects create PROJECT_ID

     Replace PROJECT_ID with a name for the Google Cloud project you are creating.

   • Select the Google Cloud project that you created:

     gcloud config set project PROJECT_ID

     Replace PROJECT_ID with your Google Cloud project name.

10. Make sure that billing is enabled for your Google Cloud project.

11. Enable the Security posture service and Security Command Center management APIs:

    gcloud services enable securityposture.googleapis.com  securitycentermanagement.googleapis.com

12. Copia il numero del progetto. Ti servirà il numero di progetto per impostare la risorsa di destinazione durante il deployment della postura.

    gcloud projects describe PROJECT_ID

13. Inizializza Terraform:

    terraform init

Crea ed esegui il deployment di una postura

1. In Cloud Shell, avvia Cloud Shell Editor. Per avviare l'editor, fai clic su Apri editor nella barra degli strumenti della finestra di Cloud Shell.

2. Crea un file YAML denominato example-standard.yaml.

3. Incolla il seguente codice nel file:

   name: organizations/ORGANIZATION_ID/locations/global/postures/example-standard
   state: ACTIVE
   policySets:
   - policySetId: policySet1
   policies:
   - constraint:
     orgPolicyConstraintCustom:
       customConstraint:
         actionType: ALLOW
         condition: "resource.initialNodeCount == 3"
         description: Set initial node count to be exactly 3.
         displayName: fixedNodeCount
         methodTypes:
         - CREATE
         name: organizations/ORGANIZATION_ID/customConstraints/custom.fixedNodeCount
         resourceTypes:
         - container.googleapis.com/NodePool
       policyRules:
       - enforce: true
   policyId: fixedNodeCount
   - constraint:
     securityHealthAnalyticsCustomModule:
       config:
         customOutput: {}
         description: Set MTU for a network to be exactly 1000.
         predicate:
           expression: "!(resource.mtu == 1000)"
         recommendation: Only create networks whose MTU is 1000.
         resourceSelector:
           resourceTypes:
           - compute.googleapis.com/Network
         severity: HIGH
       displayName: fixedMTU
       moduleEnablementState: ENABLED
   policyId: fixedMTU
   - constraint:
     securityHealthAnalyticsModule:
       moduleEnablementState: ENABLED
       moduleName: BUCKET_POLICY_ONLY_DISABLED
   policyId: bucket_policy_only_disabled
   - constraint:
     securityHealthAnalyticsModule:
       moduleEnablementState: ENABLED
       moduleName: BUCKET_LOGGING_DISABLED
   policyId: bucket_logging_disabled

   Sostituisci ORGANIZATION_ID con l'ID della tua organizzazione.

4. In Cloud Shell, crea la postura:

   gcloud scc postures create organizations/ORGANIZATION_ID/locations/global/postures/example-standard --posture-from-file=example-standard.yaml
   

5. Copia l'ID revisione della postura generato dal comando.

6. Esegui il deployment della postura nel progetto:

   gcloud scc posture-deployments create organizations/ORGANIZATION_ID/locations/global/postureDeployments/example-standard \
   --posture-name=organizations/ORGANIZATION_ID/locations/global/postures/example-standard \
   --posture-revision-id="POSTURE_REVISION_ID" \
   --target-resource=projects/PROJECT_NUMBER
   

   Sostituisci quanto segue:

   • ORGANIZATION_ID: l'ID della tua organizzazione.
   • POSTURE REVISION_ID: l'ID revisione della postura che hai copiato.
   • PROJECT_NUMBER: il numero del progetto.

Crea il file Terraform e convalidalo

1. In Cloud Shell, avvia Cloud Shell Editor.

2. Crea un file Terraform denominato main.tf.

3. Incolla il seguente codice nel file:

   terraform {
     required_providers {
       google = {
         source  = "hashicorp/google"
       }
     }
   }
   
   provider "google" {
     region  = "us-central1"
     zone    = "us-central1-c"
   }
   
   resource "google_compute_network" "example_network"{
     name                            = "example-network-1"
     delete_default_routes_on_create = false
     auto_create_subnetworks         = false
     routing_mode                    = "REGIONAL"
     mtu                             = 100
     project                         = "PROJECT_ID"
   }
   
   resource "google_container_node_pool" "example_node_pool" {
     name               = "example-node-pool-1"
     cluster            = "example-cluster-1"
     project            = "PROJECT_ID"
     initial_node_count = 2
   
     node_config {
       preemptible  = true
       machine_type = "e2-medium"
     }
   }
   
   resource "google_storage_bucket" "example_bucket" {
     name          = "example-bucket-1"
     location      = "EU"
     force_destroy = true
   
     project = "PROJECT_ID"
   
     uniform_bucket_level_access = false
   }
   

   Sostituisci PROJECT_ID con l'ID del progetto che hai creato.

4. In Cloud Shell, crea il file del piano Terraform e convertilo in formato JSON:

   terraform plan -out main.plan
   terraform show -json main.plan > mainplan.json
   

5. Crea il report di convalida IaC per mainplan.json:

   gcloud scc iac-validation-reports create organizations/ORGANIZATION_ID/locations/global --tf-plan-file=mainplan.json
   

   Questo comando restituisce un report di convalida IaC che descrive le seguenti violazioni:

   • Il valore mtu per example_network non è 1000.
   • Il valore initial_node_count per example_node_pool non è 3.
   • Per example_bucket non è stato attivato l'accesso uniforme a livello di bucket.
   • Il example_bucket non ha il logging abilitato.

Risolvere le violazioni

1. In Cloud Shell, avvia Cloud Shell Editor.

2. Aggiorna il file main.tf apportando le seguenti modifiche:

   terraform {
     required_providers {
       google = {
         source  = "hashicorp/google"
       }
     }
   }
   
   provider "google" {
     region  = "us-central1"
     zone    = "us-central1-c"
   }
   
   resource "google_compute_network" "example_network"{
     name                            = "example-network-1"
     delete_default_routes_on_create = false
     auto_create_subnetworks         = false
     routing_mode                    = "REGIONAL"
     mtu                             = 1000
     project                         = "PROJECT_ID"
   }
   
   resource "google_container_node_pool" "example_node_pool" {
     name               = "example-node-pool-1"
     cluster            = "example-cluster-1"
     project            = "PROJECT_ID"
     initial_node_count = 3
   
     node_config {
       preemptible  = true
       machine_type = "e2-medium"
     }
   }
   
   resource "google_storage_bucket" "example_bucket" {
     name          = "example-bucket-1"
     location      = "EU"
     force_destroy = true
   
     project = "PROJECT_ID"
     uniform_bucket_level_access = true
   
     logging {
       log_bucket   = "my-unique-logging-bucket" // Create a separate bucket for logs
       log_object_prefix = "tf-logs/"             // Optional prefix for better structure
     }
   }
   

   Sostituisci PROJECT_ID con l'ID del progetto che hai creato.

3. In Cloud Shell, crea il file del piano Terraform e convertilo in formato JSON:

   terraform plan -out main.plan
   terraform show -json main.plan > mainplan.json
   

4. Ricrea il report di convalida IaC per mainplan.json:

   gcloud scc iac-validation-reports create organizations/ORGANIZATION_ID/locations/global --tf-plan-file=mainplan.json