05030edf61
Per the task in `docs/TODO.md`, this change runs `git update-index --chmod=+x` on all relevant `.sh` and `.py` files in the repository. This prevents intermittent 'Permission denied' errors when scripts are run in CI/CD environments or after being edited via the GitHub web interface, which can strip file permissions.
105 lines
3.9 KiB
Bash
Executable File
105 lines
3.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# 11-billing-iam-hardening.sh — GCP Billing Account Health fixes
|
|
#
|
|
# Løser to offisielle GCP-advarsler:
|
|
# 1. "0 billing account viewers" — gir billing.viewer til spesifiserte brukere
|
|
# 2. "Billing Account Creator rolle på for domenet" — fjerner domain-wide Creator
|
|
#
|
|
# Agent-identitet: jason.vauger@vauco.no får billing.viewer
|
|
# slik at agenten kan hente og rapportere kostnadsdata autonomt.
|
|
#
|
|
# Krav: du må være Billing Account Administrator for å kjøre dette.
|
|
# Source .env før kjøring: source .env
|
|
set -euo pipefail
|
|
|
|
: "${BILLING_ACCOUNT_ID:?Set BILLING_ACCOUNT_ID i .env}"
|
|
: "${ALERT_EMAIL:?Set ALERT_EMAIL i .env}"
|
|
|
|
# Brukere som får billing.viewer — kan overstyres i .env
|
|
BILLING_VIEWER_EMAILS="${BILLING_VIEWER_EMAILS:-chris.christiansen@vauco.no,jason.vauger@vauco.no}"
|
|
|
|
# Google Workspace / Cloud Identity domene (kun nødvendig ved org-oppsett)
|
|
ORG_DOMAIN="${ORG_DOMAIN:-}"
|
|
|
|
echo "=== 11: Billing IAM Hardening ==="
|
|
echo " Billing Account: ${BILLING_ACCOUNT_ID}"
|
|
|
|
bash "$(dirname "$0")/00-authcheck.sh"
|
|
|
|
# ----------------------------------------------------------------
|
|
# FIX 1: billing.viewer til agent-identitet og eier
|
|
# ----------------------------------------------------------------
|
|
echo ""
|
|
echo "--- Fix 1: Billing Account Viewer ---"
|
|
echo " Gir lesetilgang til: ${BILLING_VIEWER_EMAILS}"
|
|
echo " Formål: agenten (jason.vauger) kan hente kostnadsdata autonomt;"
|
|
echo " chris får eksplisitt viewer i tillegg til admin."
|
|
|
|
IFS=',' read -ra VIEWER_LIST <<< "${BILLING_VIEWER_EMAILS}"
|
|
for EMAIL in "${VIEWER_LIST[@]}"; do
|
|
EMAIL=$(echo "${EMAIL}" | xargs)
|
|
[[ -z "${EMAIL}" ]] && continue
|
|
|
|
if [[ "${EMAIL}" == *".gserviceaccount.com" ]]; then
|
|
MEMBER="serviceAccount:${EMAIL}"
|
|
else
|
|
MEMBER="user:${EMAIL}"
|
|
fi
|
|
|
|
gcloud billing accounts add-iam-policy-binding "${BILLING_ACCOUNT_ID}" \
|
|
--member="${MEMBER}" \
|
|
--role="roles/billing.viewer" --quiet
|
|
echo "✓ billing.viewer gitt til: ${EMAIL}"
|
|
done
|
|
|
|
# ----------------------------------------------------------------
|
|
# FIX 2: Fjern billing.creator fra domenet
|
|
# ----------------------------------------------------------------
|
|
echo ""
|
|
echo "--- Fix 2: Fjern Billing Account Creator fra domenet ---"
|
|
|
|
if [[ -z "${ORG_DOMAIN}" ]]; then
|
|
echo "⚠️ ORG_DOMAIN er ikke satt — hopper over."
|
|
echo " Sett i .env: export ORG_DOMAIN=\"vauco.no\" og kjør på nytt."
|
|
echo " (Kun nødvendig om vauco.no er koblet som Google Workspace-org i GCP)"
|
|
else
|
|
DOMAIN_MEMBER="domain:${ORG_DOMAIN}"
|
|
|
|
EXISTING=$(gcloud billing accounts get-iam-policy "${BILLING_ACCOUNT_ID}" \
|
|
--format=json 2>/dev/null \
|
|
| python3 -c "
|
|
import sys, json
|
|
policy = json.load(sys.stdin)
|
|
for b in policy.get('bindings', []):
|
|
if b.get('role') == 'roles/billing.creator' and '${DOMAIN_MEMBER}' in b.get('members', []):
|
|
print('found')
|
|
break
|
|
" 2>/dev/null || echo "")
|
|
|
|
if [[ "${EXISTING}" == "found" ]]; then
|
|
gcloud billing accounts remove-iam-policy-binding "${BILLING_ACCOUNT_ID}" \
|
|
--member="${DOMAIN_MEMBER}" \
|
|
--role="roles/billing.creator" --quiet
|
|
echo "✓ roles/billing.creator fjernet fra domain:${ORG_DOMAIN}"
|
|
else
|
|
echo "✓ roles/billing.creator var ikke tildelt domain:${ORG_DOMAIN} — ingen endring"
|
|
fi
|
|
fi
|
|
|
|
# ----------------------------------------------------------------
|
|
# Vis nåværende billing IAM-policy
|
|
# ----------------------------------------------------------------
|
|
echo ""
|
|
echo "--- Nåværende Billing Account IAM (etter endringer) ---"
|
|
gcloud billing accounts get-iam-policy "${BILLING_ACCOUNT_ID}" \
|
|
--format="table(bindings.role,bindings.members)" 2>/dev/null || true
|
|
|
|
echo ""
|
|
echo "=== 11: Billing IAM Hardening COMPLETE ==="
|
|
echo " Verifiser i GCP Console:"
|
|
echo " https://console.cloud.google.com/billing/${BILLING_ACCOUNT_ID}/manage"
|
|
echo ""
|
|
echo " Fremtidig: opprett billing@vauco.no som Google Group,"
|
|
echo " legg chris + jason inn i gruppa, og erstatt enkeltadressene med:"
|
|
echo " export BILLING_VIEWER_EMAILS=\"billing@vauco.no\""
|