feat(bigtable): Customer Managed Encryption (CMEK) #3899
Conversation
product-auto-label
bot
added
the
api: bigtable
google-cla
bot
added
the
cla: yes
crwilcox
added
the
kokoro:force-run
kokoro-team
removed
the
kokoro:force-run
CONTRIBUTING.md
Outdated
| --keyring $MY_KEYRING \ | ||
| --location $MY_LOCATION \ | ||
| --role roles/cloudkms.cryptoKeyEncrypterDecrypter \ | ||
| --member allAuthenticatedUsers \ |
There was a problem hiding this comment.
is this true? Wouldn't you want this to point to a service account?
There was a problem hiding this comment.
I figured that, as this encryption key isn't really a secret, opening it up to all authn'd users was fine. I could be mistaken but I also think adding a service account here would be another dependency/setup step to being a contributor.
@tritone do you know what gsutil kms is doing behind the scenes?
There was a problem hiding this comment.
Hmm not exactly sure what the question is here but here's the code: https://github.com/GoogleCloudPlatform/gsutil/blob/7845859b924004d16db0408335fd434424f6c8d7/gslib/commands/kms.py
Looks like it requests a service account and creates one if it doesn't exist.
There was a problem hiding this comment.
Could you re-use the service account used elsewhere in the setup? GCLOUD_TESTS_GOLANG_KEY should already point to a service account json; is there a gcloud command to grab the email from that? I see https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list . I just don't know enough about IAM to be confident that adding this binding isn't some kind of security risk.
There was a problem hiding this comment.
So, the complication here is we store the path to the key, but the email you need (the member id) for the service account is within the json.
"client_email": "{PROJECT}@{PROJECT}.iam.gserviceaccount.com",
I could infer this as it generally follows that form, but it may not. I was avoiding adding another EnvVar.
CONTRIBUTING.md
Outdated
| --keyring $MY_KEYRING \ | ||
| --location $MY_LOCATION \ | ||
| --role roles/cloudkms.cryptoKeyEncrypterDecrypter \ | ||
| --member allAuthenticatedUsers \ |
There was a problem hiding this comment.
Hmm not exactly sure what the question is here but here's the code: https://github.com/GoogleCloudPlatform/gsutil/blob/7845859b924004d16db0408335fd434424f6c8d7/gslib/commands/kms.py
Looks like it requests a service account and creates one if it doesn't exist.
CONTRIBUTING.md
Outdated
| --keyring $MY_KEYRING \ | ||
| --location $MY_LOCATION \ | ||
| --role roles/cloudkms.cryptoKeyEncrypterDecrypter \ | ||
| --member allAuthenticatedUsers \ |
There was a problem hiding this comment.
Could you re-use the service account used elsewhere in the setup? GCLOUD_TESTS_GOLANG_KEY should already point to a service account json; is there a gcloud command to grab the email from that? I see https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list . I just don't know enough about IAM to be confident that adding this binding isn't some kind of security risk.
No description provided.