Secure Data Cataloging and Sharing with Policy Tag IAM

Question

Pulumi · Accepted Answer

When it comes to managing data cataloging and sharing with appropriate security measures in place on Google Cloud Platform (GCP), you can make use of Policy Tags and IAM policies to enforce access controls. The Policy Tags feature in GCP Data Catalog allows you to classify data in BigQuery tables. IAM (Identity and Access Management) policies, on the other hand, help you assign specific roles and permissions to users or groups for resources associated with Policy Tags.

In this context, using Pulumi to automate the creation and management of Policy Tags and related IAM policies can be performed efficiently. We will create a Policy Tag, assign it to a BigQuery column, and set an IAM policy to grant access to a user for data associated with that Policy Tag.

Below is a Pulumi program written in Python that demonstrates setting up a secure data cataloging and sharing environment using Policy Tag IAM:

1. **Create a Policy Tag:** This resource represents a tag within the Data Catalog taxonomy, used for referencing in policies.
2. **Assign IAM Policy to Policy Tag:** This binds a set of members to a role for any data asset tagged with the specified Policy Tag.

The resources used are:

- `gcp.datacatalog.PolicyTagIamPolicy`: to set an IAM policy on a policy tag.
- `gcp.datacatalog.PolicyTagIamBinding`: to create a binding for a role and members for a specific policy tag.

Here is the detailed program to achieve this:

```python
import pulumi
import pulumi_gcp as gcp

# Create a Policy Taxonomy
policy_taxonomy = gcp.datacatalog.Taxonomy("my-policy-taxonomy",
                                           activated_policy_types=["FINE_GRAINED_ACCESS_CONTROL"])

# Create a Policy Tag within the Policy Taxonomy
policy_tag = gcp.datacatalog.PolicyTag("my-policy-tag",
                                       taxonomy=policy_taxonomy.id,
                                       description="Tag for sensitive data")

# Set IAM Policy on the Policy Tag to grant access to a specific user
policy_tag_iam_policy = gcp.datacatalog.PolicyTagIamPolicy("my-policy-tag-iam-policy",
                                                           policy_tag=policy_tag.id,
                                                           policy_data=policy_tag.id.apply(lambda id: f"""{{
                                                               "bindings": [
                                                                   {{
                                                                       "role": "roles/datacatalog.fineGrainedReader",
                                                                       "members": [
                                                                           "user:jane.doe@example.com"
                                                                       ]
                                                                   }}
                                                               ]
                                                           }}"""))

# Export the Policy Tag ID and IAM Policy ID
pulumi.export("policy_tag_id", policy_tag.id)
pulumi.export("policy_iam_policy_id", policy_tag_iam_policy.id)
```

Here's what's happening in the program:
- We create a `Taxonomy`, which is a group of related Policy Tags.
- A `Policy Tag` is then created within the Taxonomy.
- The `PolicyTagIamPolicy` resource sets up an IAM policy. In particular, this policy allows the user `jane.doe@example.com` to be a fine-grained reader on any data asset that the policy tag is attached to. This enforces that only specific individuals or groups (in this case, one user) can access the data categorized under this tag.

Finally, we export the IDs of the Policy Tag and the IAM Policy for reference, which can be useful if you need to interact with these resources further or stack outputs in other Pulumi programs.

This program needs to be deployed within a Pulumi project, and the GCP project should be configured appropriately with the required permissions for the entity running the Pulumi deployment to create these resources.

Note to run this Pulumi code, you need to have Pulumi installed and configured with access to your GCP account. Save the above program in a file named `__main__.py`, then run `pulumi up` to deploy the resources.