GCP terraform module to create the Drata Read Only service account.
Make sure the service account that will run this terraform script has the following roles granted.
- Organization Administrator
- Organization Policy Administrator
- Organization Role Administrator
- Service Account Admin
- Service Account Key Admin
- Service Usage Admin
The example below uses ref=main
(which is appended in the URL), but it is recommended to use a specific tag version (i.e. ref=1.0.0
) to avoid breaking changes. Go to the release page for a list of published versions. releases page for a list of published versions.
Replace YOUR_ORGANIZATION_DOMAIN
with the organization domain. i.e. your_org.com
.
module "service_account_creation" {
source = "git::https://github.com/drata/gcp-terraform-drata-setup.git?ref=main"
gcp_org_domain = "YOUR_ORGANIZATION_DOMAIN"
# gcp_project_id = "YOUR_PROJECT_ID" # if it's unset, the project by default is used
# drata_role_name = "YOUR_ROLE_NAME" # if it's unset, the default name is DrataReadOnly
# connect_multiple_projects = false # if it's unset, the default value is true
}
output "drata_service_account_key" {
value = module.service_account_creation.drata_service_account_key
description = "Service Account Key"
sensitive = true
}
After you apply this terraform, run the following command to retrieve the key file drata-gcp-private-key.json
terraform output -raw drata_service_account_key > drata-gcp-private-key.json
- Fixing
FAILED_PRECONDITION: Key creation is not allowed on this service account (type: constraints/iam.disableServiceAccountKeyCreation)
issue.- Go to the IAM Organization Policies page.
- Make sure the project where the service account will be stored is selected top left in the console.
- Type
Disable service account key creation
on the๐ฝ Filter
bar and select the policy. - Click over
๐ MANAGE POLICY
button. - Go to
Policy source
and select theOverride parent's policy
option. - Scroll down a little and open up the
Enforced
rule. - Make sure the
Enforcement
section isOff
. - Click
SET POLICY
to save changes. - Run this script again.
The following steps demonstrate how to connect GCP in Drata when using this terraform module.
- Add the code above to your terraform project.
- Make sure the service account to authenticate this script has the roles
Organization Administrator
,Service Account Admin
,Service Account Key Admin
andService Usage Admin
. - Replace
main
inref=main
with the latest version from the releases page. - Replace
YOUR_ORGANIZATION_DOMAIN
with the GCP organization domain. - Replace
YOUR_PROJECT_ID
if the desired project is not the default project in your organization. - Replace the given
drata_role_name
if you don't want the role added to be the default:DrataReadOnly
. - If you don't wish to connect multiple projects to Drata the
connect_multiple_projects
variable must befalse
otherwisetrue
or unset. - Back in your terminal, run
terraform init
to download/update the module. - Run
terraform apply
and IMPORTANT review the plan output before typingyes
. - If successful, run the command to generate the json key file
terraform output -raw drata_service_account_key > drata-gcp-private-key.json
.
- Verify the file has been generated.
- Go to the GCP connection drawer and select Upload File to upload the
drata-gcp-private-key.json
file. - Select the
Save & Test Connection
button.
Name | Version |
---|---|
terraform | >= 0.13.0 |
5.16.0 |
Name | Version |
---|---|
5.16.0 |
No modules.
Name | Type |
---|---|
google_organization_iam_custom_role.drata_org_role | resource |
google_organization_iam_member.drata_organization_viewer_role | resource |
google_organization_iam_member.organization | resource |
google_project_iam_custom_role.drata_project_role | resource |
google_project_iam_member.drata_member_project_role | resource |
google_project_iam_member.drata_project_viewer_role | resource |
google_project_service.services | resource |
google_service_account.drata | resource |
google_service_account_key.drata_key | resource |
google_organization.gcp_organization | data source |
google_project.gcp_project | data source |
Name | Description | Type | Default | Required |
---|---|---|---|---|
connect_multiple_projects | Tells the service account whether it can see all the projects or not. | bool |
true |
no |
drata_role_name | Role name. | string |
"DrataReadOnly" |
no |
gcp_org_domain | GCP Organization domain. | string |
n/a | yes |
gcp_project_id | Project identifier of the gcp organization. If it is not provided, the provider project is used. | string |
null |
no |
gcp_services | List of services to enable. | list(string) |
[ |
no |
Name | Description |
---|---|
drata_service_account_key | Service Account Key |