创建 IaC 验证报告示例

高级和 Enterprise 服务层级（需要在组织级激活）

本教程介绍了如何验证基础架构即代码 (IaC) 是否违反了贵组织政策或 Security Health Analytics 检测器。

准备环境

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

Install the Google Cloud CLI.

如果您使用的是外部身份提供方 (IdP)，则必须先使用联合身份登录 gcloud CLI。

如需初始化 gcloud CLI，请运行以下命令：

gcloud init

Create or select a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

• Create a Google Cloud project:

  gcloud projects create PROJECT_ID

  Replace PROJECT_ID with a name for the Google Cloud project you are creating.

• Select the Google Cloud project that you created:

  gcloud config set project PROJECT_ID

  Replace PROJECT_ID with your Google Cloud project name.

Verify that billing is enabled for your Google Cloud project.

Enable the Security posture service and Security Command Center management APIs:

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

gcloud services enable securityposture.googleapis.com  securitycentermanagement.googleapis.com

Install the Google Cloud CLI.

如果您使用的是外部身份提供方 (IdP)，则必须先使用联合身份登录 gcloud CLI。

如需初始化 gcloud CLI，请运行以下命令：

gcloud init

Create or select a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

• Create a Google Cloud project:

  gcloud projects create PROJECT_ID

  Replace PROJECT_ID with a name for the Google Cloud project you are creating.

• Select the Google Cloud project that you created:

  gcloud config set project PROJECT_ID

  Replace PROJECT_ID with your Google Cloud project name.

Verify that billing is enabled for your Google Cloud project.

Enable the Security posture service and Security Command Center management APIs:

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

gcloud services enable securityposture.googleapis.com  securitycentermanagement.googleapis.com

1. 复制项目编号。在部署状况时，您需要使用项目编号来设置目标资源。

   gcloud projects describe PROJECT_ID

2. 初始化 Terraform：

   terraform init

创建和部署状况

1. 在 Cloud Shell 中，启动 Cloud Shell 编辑器。如需启动编辑器，请点击 Cloud Shell 窗口工具栏上的 打开编辑器。

2. 创建一个名为 example-standard.yaml 的 YAML 文件。

3. 将以下代码粘贴到您的文件中：

name: organizations/ORGANIZATION_ID/locations/global/postures/example-standard
state: ACTIVE
policySets:
- policies:
  - constraint:
      orgPolicyConstraintCustom:
        customConstraint:
          actionType: ALLOW
          condition: "resource.initialNodeCount == 3"
          description: Set initial node count to be exactly 3.
          displayName: fixedNodeCount
          methodTypes:
          - CREATE
          name: organizations/ORGANIZATION_ID/customConstraints/custom.fixedNodeCount
          resourceTypes:
          - container.googleapis.com/NodePool
        policyRules:
        - enforce: true
    policyId: fixedNodeCount
  - constraint:
      securityHealthAnalyticsCustomModule:
        config:
          customOutput: {}
          description: Set MTU for a network to be exactly 1000.
          predicate:
            expression: "!(resource.mtu == 1000)"
          recommendation: Only create networks whose MTU is 1000.
          resourceSelector:
            resourceTypes:
            - compute.googleapis.com/Network
          severity: HIGH
        displayName: fixedMTU
        moduleEnablementState: ENABLED
    policyId: fixedMTU
  - constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: BUCKET_POLICY_ONLY_DISABLED
    policyId: bucket_policy_only_disabled
  - constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: BUCKET_LOGGING_DISABLED
    policyId: bucket_logging_disabled
  policySetId: policySet1

将 ORGANIZATION_ID 替换为您的组织 ID。

1. 在 Cloud Shell 中，创建状况：

   gcloud scc postures create organizations/ORGANIZATION_ID/locations/global/postures/example-standard --posture-from-file=example-standard.yaml
   

2. 复制该命令生成的状况修订版本 ID。

3. 将状况部署到您的项目：

   gcloud scc posture-deployments create organizations/ORGANIZATION_ID/locations/global/postureDeployments/example-standard \
   --posture-name=organizations/ORGANIZATION_ID/locations/global/postures/example-standard \
   --posture-revision-id="POSTURE_REVISION_ID" \
   --target-resource=projects/PROJECT_NUMBER
   

   替换以下内容：

   • ORGANIZATION_ID：您的组织 ID。
   • POSTURE REVISION_ID：您复制的状况修订版本 ID。
   • PROJECT_NUMBER：您的项目编号。

创建 Terraform 文件并进行验证

1. 在 Cloud Shell 中，启动 Cloud Shell 编辑器。

2. 创建一个名为 main.tf 的 Terraform 文件。

3. 将以下代码粘贴到您的文件中：

   terraform {
     required_providers {
       google = {
         source  = "hashicorp/google"
       }
     }
   }
   
   provider "google" {
     region  = "us-central1"
     zone    = "us-central1-c"
   }
   
   resource "google_compute_network" "example_network"{
     name                            = "example-network-1"
     delete_default_routes_on_create = false
     auto_create_subnetworks         = false
     routing_mode                    = "REGIONAL"
     mtu                             = 100
     project                         = "PROJECT_ID"
   }
   
   resource "google_container_node_pool" "example_node_pool" {
     name               = "example-node-pool-1"
     cluster            = "example-cluster-1"
     project            = "PROJECT_ID"
     initial_node_count = 2
   
     node_config {
       preemptible  = true
       machine_type = "e2-medium"
     }
   }
   
   resource "google_storage_bucket" "example_bucket" {
     name          = "example-bucket-1"
     location      = "EU"
     force_destroy = true
   
     project = "PROJECT_ID"
   
     uniform_bucket_level_access = false
   }
   

   将 PROJECT_ID 替换为您创建的项目的项目 ID。

4. 在 Cloud Shell 中，创建 Terraform 方案文件并将其转换为 JSON 格式：

   terraform plan -out main.plan
   terraform show -json main.plan > mainplan.json
   

5. 为 mainplan.json 创建 IaC 验证报告：

   gcloud scc iac-validation-reports create organizations/ORGANIZATION_ID/locations/global --tf-plan-file=mainplan.json
   

   此命令会返回一个 IaC 验证报告，其中描述了以下违规行为：

   • example_network 的 mtu 不是 1,000。
   • example_node_pool 的 initial_node_count 不是 3。
   • example_bucket 尚未启用统一存储桶级访问权限。
   • example_bucket 尚未启用日志记录。

解决违规

1. 在 Cloud Shell 中，启动 Cloud Shell 编辑器。

2. 使用以下更改来更新 main.tf 文件：

   terraform {
     required_providers {
       google = {
         source  = "hashicorp/google"
       }
     }
   }
   
   provider "google" {
     region  = "us-central1"
     zone    = "us-central1-c"
   }
   
   resource "google_compute_network" "example_network"{
     name                            = "example-network-1"
     delete_default_routes_on_create = false
     auto_create_subnetworks         = false
     routing_mode                    = "REGIONAL"
     mtu                             = 1000
     project                         = "PROJECT_ID"
   }
   
   resource "google_container_node_pool" "example_node_pool" {
     name               = "example-node-pool-1"
     cluster            = "example-cluster-1"
     project            = "PROJECT_ID"
     initial_node_count = 3
   
     node_config {
       preemptible  = true
       machine_type = "e2-medium"
     }
   }
   
   resource "google_storage_bucket" "example_bucket" {
     name          = "example-bucket-1"
     location      = "EU"
     force_destroy = true
   
     project = "PROJECT_ID"
     uniform_bucket_level_access = true
   
     logging {
       log_bucket   = "my-unique-logging-bucket" // Create a separate bucket for logs
       log_object_prefix = "tf-logs/"             // Optional prefix for better structure
     }
   }
   

   将 PROJECT_ID 替换为您创建的项目的项目 ID。

3. 在 Cloud Shell 中，创建 Terraform 方案文件并将其转换为 JSON 格式：

   terraform plan -out main.plan
   terraform show -json main.plan > mainplan.json
   

4. 为 mainplan.json 重新创建 IaC 验证报告：

   gcloud scc iac-validation-reports create organizations/ORGANIZATION_ID/locations/global --tf-plan-file=mainplan.json