Restricting secret access to a certain user group

Question

Pulumi · Accepted Answer

To restrict access to secrets for a specific user group, you'll need to utilize Identity and Access Management (IAM) policies that define who has what kind of access to the resources. In this example, we'll use Google Cloud Platform (GCP) as a reference since it provides a robust and flexible IAM system that we can interact with using Pulumi.

We'll be focusing on Google Cloud Secret Manager, which allows you to store, manage, and access secrets like API keys or credentials. We'll create a secret and then set an IAM policy on that secret so that only members of a specified user group can access it.

Here's a step-by-step breakdown of what the Pulumi program will do:

1. Create a new secret in the Google Cloud Secret Manager.
2. Bind an IAM policy to the secret that restricts access to members of a specified Google group.

We'll use the `gcp.secretmanager.Secret` resource to create the secret and `gcp.secretmanager.SecretIamPolicy` to set the IAM policy on the secret. The IAM policy will be set such that only members of a predefined Google group can access it.

Below is the Pulumi TypeScript program that demonstrates this:

```typescript
import * as gcp from "@pulumi/gcp";

// Replace `your-google-group@example.com` with the email address of your Google group.
const userGroupEmail = "your-google-group@example.com";
// Replace `project-id` with your GCP project ID.
const projectId = "project-id";

// Create a new secret
const secret = new gcp.secretmanager.Secret("my-secret", {
    replication: {
        automatic: true,
    },
    project: projectId,
});

// Set IAM policy for the secret, binding the 'roles/secretmanager.secretAccessor' role to the user group
const secretIamPolicy = new gcp.secretmanager.SecretIamPolicy("my-secret-iam", {
    secretId: secret.id,
    project: projectId,
    bindings: [{
        role: "roles/secretmanager.secretAccessor",
        members: [`group:${userGroupEmail}`],
    }],
});

// Export the secret name and the IAM policy id
export const secretName = secret.name;
export const secretIamPolicyId = secretIamPolicy.id;
```

In the code above:

- We import the `gcp` module from the Pulumi library.
- We define the email address of the user group and the GCP project ID at the top for easier configuration.
- We create a new secret named `my-secret` using the `gcp.secretmanager.Secret` resource.
- We set an IAM policy on the secret so that only members of the specified Google group have the `roles/secretmanager.secretAccessor` role.
- We export the secret's name and the IAM policy's ID for reference.

Make sure to replace `your-google-group@example.com` with the actual email address of the group you're targeting. Also, set the correct GCP project ID.

After deploying this program with Pulumi, the specified user group will have the necessary access to the secret created, and all other principals will be restricted from accessing it.

Remember, to run this program you'll need:

1. Pulumi CLI installed and configured for use with GCP.
2. Access to a GCP account and permissions to create resources and manage IAM policies.
3. The IAM email for the Google group that will be provided access.

After everything is set up, you can run this program with Pulumi CLI commands `pulumi up` to deploy and `pulumi destroy` to clean up the resources.