luxolus/open-vault
2
0
Fork 0
Code Issues 1 Pull requests Releases Activity

fix permissions in GCP auth docs (#7035)

Browse source
This commit is contained in:
emily 2019-07-01 15:13:36 -07:00 committed by Becca Petrin
parent 910f615bf5
commit 333d0425b9
1 changed files with 36 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
website/source/docs/auth/gcp.html.md
View file

@ -141,24 +141,53 @@ scope:
https://www.googleapis.com/auth/cloud-platform
```
### Required Permissions
### Required GCP Permissions
The credentials given to Vault must have the following roles:
#### Vault Server Permissions
**For `iam`-type Vault roles**, Vault can be given the following roles:
```text
roles/iam.serviceAccountKeyAdmin
roles/browser
```
Note that this is the permission **given to the Vault servers**. The IAM
service account or GCE instance that is authenticating _against_ Vault must
have the following role:
**For `gce`-type Vault roles**, Vault can be given the following roles:
```text
roles/compute.viewer
```
If you instead wish to create a custom role with only the exact GCP permissions
required, use the following list of permissions:
```text
iam.serviceAccounts.get
iam.serviceAccountKeys.get
compute.instances.get
compute.instanceGroups.list
compute.instanceGroups.listInstances
```
These allow Vault to:
* verify the service account, either directly authenticating or associated with
authenticating GCE instance, exists
* get the corresponding public keys for verifying JWTs signed by service account
private keys.
* verify authenticating GCE instances exist
* compare bound fields for GCE roles (zone/region, labels, or membership
in given instance groups)
#### Permissions For Authenticating Against Vault
Note that the previously mentioned permissions are given to the _Vault servers_.
The IAM service account or GCE instance that is **authenticating against Vault**
must have the following role:
```text
roles/iam.serviceAccountTokenCreator
```
## Group Aliases
As of Vault 1.0, roles can specify an `add_group_aliases` boolean parameter