Enforcing the Principle of Least Privilege on Cloud Run Services

Introduction

In this guide, we will demonstrate how to enforce the principle of least privilege on Google Cloud Run services using Pulumi. The principle of least privilege ensures that each service or user has only the permissions necessary to perform their tasks, reducing the risk of accidental or malicious misuse of permissions.

We will create a Cloud Run service and configure IAM policies to restrict access. We will use Pulumi’s TypeScript SDK to define and manage these resources.

Step-by-Step Explanation

Step 1: Set Up Pulumi and Google Cloud Provider

1. Ensure you have the Pulumi CLI installed. If not, follow the installation guide.
2. Set up a new Pulumi project using TypeScript:

   pulumi new typescript
   

3. Install the Pulumi Google Cloud provider:

   npm install @pulumi/google-native
   

Step 2: Define the Cloud Run Service

1. Create a new file called index.ts in your project directory.
2. Define the Cloud Run service in index.ts:

   import * as gcp from "@pulumi/google-native";
   
   const service = new gcp.cloudrun.v1.Service("my-service", {
       location: "us-central1",
       template: {
           spec: {
               containers: [{
                   image: "gcr.io/my-project/my-image:latest",
               }],
           },
       },
   });
   

Step 3: Configure IAM Policies

1. Define IAM policies to enforce least privilege on the Cloud Run service:

   const iamPolicy = new gcp.cloudrun.v1.ServiceIamPolicy("my-service-iam-policy", {
       serviceId: service.id,
       location: service.location,
       policyData: pulumi.output(service.id).apply(id => JSON.stringify({
           bindings: [
               {
                   role: "roles/run.invoker",
                   members: [
                       "serviceAccount:my-service-account@my-project.iam.gserviceaccount.com",
                   ],
               },
           ],
       })),
   });
   

Step 4: Deploy the Stack

1. Run pulumi up to deploy the stack:

   pulumi up
   

2. Confirm the deployment and verify that the Cloud Run service and IAM policies are correctly configured.

Summary

By following this guide, you have successfully enforced the principle of least privilege on a Google Cloud Run service using Pulumi. This ensures that your Cloud Run service has only the necessary permissions, enhancing the security of your cloud infrastructure.

Full Code Example

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

// Define the Cloud Run service
const service = new gcp.cloudrun.Service("my-service", {
    location: "us-central1",
    template: {
        spec: {
            containers: [{
                image: "gcr.io/my-project/my-image:latest",
            }],
        },
    },
});

// Define IAM policies to enforce least privilege on the Cloud Run service
const iamBinding = new gcp.cloudrun.IamBinding("my-service-iam-binding", {
    service: service.name,
    location: service.location,
    role: "roles/run.invoker",
    members: [
        "serviceAccount:my-service-account@my-project.iam.gserviceaccount.com",
    ],
});