.
675 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 |
2 | 
3 |
Clutch Federator Terraform Code Examples
4 | Federate your identities!
5 |
6 |
7 | ---
8 |
9 |
10 |
11 | [](/LICENSE)
12 |
13 |
14 |
15 | ---
16 | # This initiative is part of Clutch Security's [NHI Index](https://non-human.id/)
17 |
18 | As part of the project, we offer essential resources and practical guides on enabling inter-cloud connectivity and establishing **OpenID Connect (OIDC)** between cloud service providers (CSPs) and version control systems.
19 |
20 | Our resources, including **Terraform files** and detailed, step-by-step tutorials, empower organizations to transition from static, long-lived NHIs to ephemeral ones—drastically reducing their attack surface and strengthening their overall security posture.
21 |
22 | ## Cross Cloud Integration
23 | This aims to configure resources in one CSP to query resources in other CSP.
24 |
25 | * [AWS -> Azure Integration (Includes Demo Video)](./cross-cloud-integration/aws->azure/README.md)
26 | * [AWS -> GCP Integration (Includes Demo Video)](./cross-cloud-integration/aws->gcp/README.md)
27 | * [GCP -> AWS Integration (Includes Demo Video)](./cross-cloud-integration/gcp->aws/README.md)
28 | * [GCP -> Azure Integration (Includes Demo Video)](./cross-cloud-integration/gcp->azure/README.md)
29 | * [Azure -> AWS Integration (Includes Demo Video)](./cross-cloud-integration/azure->aws/README.md)
30 | * [Azure -> GCP Integration (Includes Demo Video)](./cross-cloud-integration/azure->gcp/README.md)
31 |
32 | ## Github To CSP Integration
33 |
34 | * [Github Actions -> AWS Integration](./github-actions-integration/aws/README.md)
35 | * [Github Actions -> Azure Integration](./github-actions-integration/azure/README.md)
36 | * [Github Actions -> GCP Integration](./github-actions-integration/gcp/README.md)
37 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->azure/README.md:
--------------------------------------------------------------------------------
1 | # AWS to Azure
2 |
3 | 
4 |
5 | ## Demo
6 |
7 | [](https://asciinema.org/a/48b8z6EEvesDJZ7OwU3piDZyv)
8 |
9 | ## Setup
10 |
11 | Ensure you are logged into both AWS & Azure systems from your CLI before executing below terraform commands.
12 |
13 | ### Verify AWS
14 |
15 | ```
16 | aws sts get-caller-identity
17 | ```
18 |
19 | ### Verify Azure
20 |
21 | ```
22 | az account show
23 | ```
24 |
25 | ### Integration
26 |
27 | Connect to Azure systems from AWS Cloud. In this example, we will use AWS VM to connect with Azure resources.
28 |
29 | ```
30 | terraform init
31 | terraform plan
32 | terraform apply
33 | ```
34 |
35 | Post `terraform apply`, copy the ssh command from the output and login to the AWS VM.
36 |
37 | 1. Some pre-requisities will be installed
38 | 2. Connectivity to the Azure systems will be established
39 | 3. Test it by running the command shown.
40 |
41 | ### Destroy resources
42 |
43 | ```
44 | terraform destroy
45 | ```
46 |
47 | ## NOTE
48 |
49 | There's no in-built terraform module to get OpenID Connect token, `aws cognito-identity get-open-id-token-for-developer-identity`. This command will be executed on the local machine using terraform's `external` provider.
50 |
51 | ## Security Considerations
52 | Misconfigured access to AWS Cognito Identity Pools can result in security vulnerabilities.
53 |
54 | **Ensure that all resources accessing the Cognito Identity Pool are restricted to the minimum necessary permissions.**
55 |
56 | It is crucial to properly manage IAM policies to limit access to only the required identity pools. Failing to do so may allow unintended services or instances to gain access to identity pools, posing a security risk.
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->azure/aws-vm.tf:
--------------------------------------------------------------------------------
1 | # TLS private key resource for generating an RSA private key used for SSH access to EC2 instances.
2 | resource "tls_private_key" "demo_ssh_key" {
3 | algorithm = "RSA"
4 | rsa_bits = 4096
5 | }
6 |
7 | # AWS Key Pair resource to manage the SSH key pair used for EC2 instances.
8 | resource "aws_key_pair" "key_pair" {
9 | provider = aws.ec2-region
10 | key_name = random_string.random_suffix.result
11 | public_key = tls_private_key.demo_ssh_key.public_key_openssh
12 | }
13 |
14 | # Local file resource to save the generated private SSH key securely.
15 | resource "local_file" "private_key" {
16 | content = tls_private_key.demo_ssh_key.private_key_pem
17 | filename = "${path.module}/${random_string.random_suffix.result}.pem"
18 | file_permission = "400"
19 | }
20 |
21 | # AWS Security Group resource to define the security rules for EC2 instances.
22 | resource "aws_security_group" "sg_ec2" {
23 | provider = aws.ec2-region
24 | name = "${var.prefix}-sg_ec2"
25 | description = "Security group for EC2 instance"
26 |
27 | ingress {
28 | from_port = 22
29 | to_port = 22
30 | protocol = "tcp"
31 | cidr_blocks = ["0.0.0.0/0"]
32 | }
33 |
34 | egress {
35 | from_port = 0
36 | to_port = 0
37 | protocol = "-1"
38 | cidr_blocks = ["0.0.0.0/0"]
39 | }
40 | }
41 |
42 | # AWS IAM Role for EC2 instances, allowing them to assume certain policies and interact with other AWS services.
43 | resource "aws_iam_role" "ec2_cognito_role" {
44 | name = "${var.prefix}-ec2_cognito_role"
45 |
46 | assume_role_policy = jsonencode({
47 | Version = "2012-10-17"
48 | Statement = [{
49 | Effect = "Allow"
50 | Principal = {
51 | Service = "ec2.amazonaws.com"
52 | }
53 | Action = "sts:AssumeRole"
54 | }]
55 | })
56 | }
57 |
58 | # Attaches a specified IAM policy to the created IAM role.
59 | resource "aws_iam_role_policy_attachment" "cognito_policy_attachment" {
60 | depends_on = [ aws_iam_role.ec2_cognito_role, aws_iam_policy.cognito_policy ]
61 | role = aws_iam_role.ec2_cognito_role.name
62 | policy_arn = aws_iam_policy.cognito_policy.arn
63 | }
64 |
65 | # Instance profile for EC2 that allows the use of the IAM role within EC2.
66 | resource "aws_iam_instance_profile" "ec2_cognito_profile" {
67 | depends_on = [ aws_iam_role.ec2_cognito_role ]
68 | name = "${var.prefix}-ec2_cognito_profile"
69 | role = aws_iam_role.ec2_cognito_role.name
70 | }
71 |
72 | # AWS EC2 instance resource configured to use the defined resources like key pair, security group, and IAM profile.
73 | resource "aws_instance" "demo" {
74 | depends_on = [azuread_application.demo, aws_key_pair.key_pair, aws_iam_instance_profile.ec2_cognito_profile, azuread_application.demo, aws_cognito_identity_pool.my_identity_pool, data.azurerm_client_config.current ]
75 | provider = aws.ec2-region
76 | ami = var.aws_ec2_ami_id
77 | instance_type = "t2.nano"
78 | key_name = aws_key_pair.key_pair.key_name
79 | vpc_security_group_ids = [aws_security_group.sg_ec2.id]
80 | iam_instance_profile = aws_iam_instance_profile.ec2_cognito_profile.id
81 | user_data = templatefile("${path.module}/tpl/aws-vm.tpl", {
82 | azuread_application_demo_client_id = azuread_application.demo.client_id,
83 | identity_pool_id = aws_cognito_identity_pool.my_identity_pool.id,
84 | azure_tenant_id = data.azurerm_client_config.current.tenant_id,
85 | })
86 | tags = {
87 | Name = "${var.prefix}-demo-instance"
88 | }
89 | }
90 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->azure/aws.tf:
--------------------------------------------------------------------------------
1 | # This identity pool configures identity providers and federations in AWS environments.
2 | resource "aws_cognito_identity_pool" "my_identity_pool" {
3 | identity_pool_name = "${var.prefix}-terraform"
4 | allow_unauthenticated_identities = false
5 | developer_provider_name = var.developer_provider_name
6 | }
7 |
8 | # Resource definition for an IAM policy specifically for the Cognito Identity Pool.
9 | # This policy grants permissions for specific Cognito actions.
10 | # IMPORTANT: Misuse of AWS Cognito Identity Pools can lead to security vulnerabilities.
11 | # Ensure all resources with access to Cognito Identity Pools are strictly limited to the minimum necessary.
12 | # Properly manage IAM policies to prevent unauthorized access and protect your identity pools.
13 | resource "aws_iam_policy" "cognito_policy" {
14 | depends_on = [ aws_cognito_identity_pool.my_identity_pool ]
15 | name = "${var.prefix}-cognito-policy"
16 | description = "Policy for Cognito actions on specific APIs"
17 |
18 | policy = jsonencode({
19 | Version = "2012-10-17"
20 | Statement = [{
21 | Effect = "Allow"
22 | Action = [
23 | "cognito-identity:GetOpenIdTokenForDeveloperIdentity"
24 | ]
25 | Resource = aws_cognito_identity_pool.my_identity_pool.arn
26 | }]
27 | })
28 | }
29 |
30 | # External data source to invoke an AWS CLI command via a bash script.
31 | # This command retrieves an OpenID Connect token for a specific developer identity.
32 | data "external" "aws_get_cognito_identity_local_execution" {
33 | depends_on = [ aws_cognito_identity_pool.my_identity_pool ]
34 | program = ["bash", "-c", "aws cognito-identity get-open-id-token-for-developer-identity --identity-pool-id ${aws_cognito_identity_pool.my_identity_pool.id} --logins ${var.developer_provider_name}=developer_provider_value --region ${var.aws_cognito_region}"]
35 | }
36 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->azure/azure.tf:
--------------------------------------------------------------------------------
1 | # Data source to fetch current Azure client configuration
2 | data "azurerm_client_config" "current" {}
3 |
4 | # Data resource to fetch published app IDs for known applications (like Microsoft Graph)
5 | data "azuread_application_published_app_ids" "well_known" {}
6 |
7 | # Service principal data source for Microsoft Graph
8 | data "azuread_service_principal" "msgraph" {
9 | depends_on = [ data.azuread_application_published_app_ids.well_known ]
10 | client_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
11 | }
12 |
13 | # Fetch all Azure AD service principals
14 | data "azuread_service_principals" "all" {
15 | return_all = true
16 | }
17 |
18 | # Resource to create an Azure AD Application with necessary permissions
19 | resource "azuread_application" "demo" {
20 | depends_on = [
21 | random_string.random_suffix,
22 | data.azuread_application_published_app_ids.well_known,
23 | data.azuread_service_principal.msgraph,
24 | ]
25 | display_name = "${var.prefix} Demo ${random_string.random_suffix.result}"
26 | sign_in_audience = "AzureADMyOrg"
27 |
28 | # Defining required access to specific Microsoft Graph APIs
29 | required_resource_access {
30 | resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
31 |
32 | resource_access {
33 | id = data.azuread_service_principal.msgraph.app_role_ids["User.Read.All"]
34 | type = "Role"
35 | }
36 | resource_access {
37 | id = data.azuread_service_principal.msgraph.app_role_ids["Directory.Read.All"]
38 | type = "Role"
39 | }
40 | }
41 | }
42 |
43 | # Resource group in Azure to organize related resources
44 | resource "azurerm_resource_group" "demo" {
45 | depends_on = [
46 | random_string.random_suffix,
47 | ]
48 | name = "${var.prefix}-resource-group-${random_string.random_suffix.result}"
49 | location = var.resource_group_location
50 | }
51 |
52 | # Service principal for the Azure AD application
53 | resource "azuread_service_principal" "demo" {
54 | depends_on = [ azuread_application.demo ]
55 | client_id = azuread_application.demo.client_id
56 | }
57 |
58 | # Role assignment to give the service principal necessary permissions within the resource group
59 | resource "azurerm_role_assignment" "demo" {
60 | depends_on = [
61 | azurerm_resource_group.demo,
62 | azuread_service_principal.demo,
63 | ]
64 | scope = azurerm_resource_group.demo.id
65 | role_definition_name = "Contributor"
66 | principal_id = azuread_service_principal.demo.id
67 | }
68 |
69 | # Federated identity credential associated with the Azure AD application
70 | resource "azuread_application_federated_identity_credential" "demo" {
71 | depends_on = [
72 | azuread_application.demo,
73 | azurerm_role_assignment.demo,
74 | azuread_app_role_assignment.demo,
75 | random_string.random_suffix,
76 | aws_cognito_identity_pool.my_identity_pool,
77 | data.external.aws_get_cognito_identity_local_execution,
78 | ]
79 | display_name = "${var.prefix}-demo-${random_string.random_suffix.result}"
80 | application_id = "/applications/${azuread_application.demo.object_id}"
81 | issuer = var.openid_connect_url
82 | subject = data.external.aws_get_cognito_identity_local_execution.result["IdentityId"]
83 | description = "Demo federated identity credential for secure integration"
84 | audiences = [aws_cognito_identity_pool.my_identity_pool.id]
85 | }
86 |
87 | # Dynamic role assignment for the application based on required resource access
88 | resource "azuread_app_role_assignment" "demo" {
89 | depends_on = [
90 | azuread_application.demo,
91 | data.azuread_service_principals.all,
92 | azuread_service_principal.demo,
93 | azurerm_role_assignment.demo,
94 | ]
95 | for_each = { for v in flatten([
96 | for rra in azuread_application.demo.required_resource_access : [
97 | for ra in rra.resource_access : {
98 | resource_object_id = one([
99 | for sp in data.azuread_service_principals.all.service_principals :
100 | sp.object_id if sp.client_id == rra.resource_app_id
101 | ])
102 | app_role_id = ra.id
103 | }
104 | ]
105 | ]) : join("|", [v.resource_object_id, v.app_role_id]) => v }
106 |
107 | principal_object_id = azuread_service_principal.demo.object_id
108 | resource_object_id = each.value.resource_object_id
109 | app_role_id = each.value.app_role_id
110 | }
111 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->azure/outputs.tf:
--------------------------------------------------------------------------------
1 | # Output the SSH command to connect to the AWS EC2 instance
2 | output "aws_ec2_ssh_login_command" {
3 | depends_on = [
4 | aws_instance.demo,
5 | random_string.random_suffix
6 | ]
7 | value = "ssh -i ${random_string.random_suffix.result}.pem ${var.aws_admin_user}@${aws_instance.demo.public_ip}"
8 | }
9 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->azure/providers.tf:
--------------------------------------------------------------------------------
1 | # Define Terraform settings and specify required providers with versions
2 | terraform {
3 | required_providers {
4 | # Local provider for managing local files and directories
5 | local = {
6 | source = "hashicorp/local"
7 | version = "~> 2.5.1"
8 | }
9 | # Azure Resource Manager provider to manage Azure resources
10 | azurerm = {
11 | source = "hashicorp/azurerm"
12 | version = "~> 3.112.0"
13 | }
14 | # External provider for running external programs
15 | external = {
16 | source = "hashicorp/external"
17 | version = "~> 2.3.3"
18 | }
19 | # AWS provider to manage Amazon Web Services resources
20 | aws = {
21 | source = "hashicorp/aws"
22 | version = "~> 5.58.0"
23 | }
24 | # Azure AD provider to manage Azure Active Directory resources
25 | azuread = {
26 | source = "hashicorp/azuread"
27 | version = "~> 2.53.1"
28 | }
29 | # Random provider for generating random values
30 | random = {
31 | source = "hashicorp/random"
32 | version = "~> 3.6.2"
33 | }
34 | # TLS provider for managing TLS certificates
35 | tls = {
36 | source = "hashicorp/tls"
37 | version = "~> 4.0.5"
38 | }
39 | }
40 | }
41 |
42 | # AWS provider configuration for general region
43 | provider "aws" {
44 | region = var.aws_cognito_region # Dynamically set the AWS region from variables
45 | }
46 |
47 | # AWS provider configuration with an alias for a specific region (EC2 instances)
48 | provider "aws" {
49 | region = var.aws_ec2_region # Dynamically set the AWS region for EC2 specific operations
50 | alias = "ec2-region" # Alias used to differentiate this configuration
51 | }
52 |
53 | # Local provider configuration
54 | provider "local" {
55 | # This provider is used for managing local state files and directories
56 | }
57 |
58 | # Azure AD provider configuration
59 | provider "azuread" {
60 | # This provider is used for managing Azure Active Directory resources
61 | # Default configuration is used, no specific parameters set
62 | }
63 |
64 | # Azure RM provider configuration
65 | provider "azurerm" {
66 | features {} # Required empty block, needed even when no specific features are configured
67 | }
68 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->azure/tpl/aws-vm.tpl:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | cat <<'EOF' > /etc/profile.d/set_env_vars.sh
3 | #!/bin/bash
4 | echo "Installing some pre-requisites"
5 | curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
6 | sudo apt update && sudo apt -y install jq unzip
7 | curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
8 | unzip awscliv2.zip
9 | sudo ./aws/install
10 |
11 | get_token_output=$(aws cognito-identity get-open-id-token-for-developer-identity --identity-pool-id ${identity_pool_id} --logins developerprovidername=developer_provider_value --region us-east-1)
12 | echo "get_token_output: $get_token_output"
13 |
14 | JWT_TOKEN=$(echo $get_token_output | jq -r '.Token')
15 | echo "JWT_TOKEN: $JWT_TOKEN"
16 |
17 | if [ -z "$JWT_TOKEN" ]; then
18 | echo "Failed to retrieve JWT_TOKEN"
19 | exit 1
20 | fi
21 |
22 | output=$(curl -X GET 'https://login.microsoftonline.com/${azure_tenant_id}/oauth2/v2.0/token' \
23 | --header 'Content-Type: application/x-www-form-urlencoded' \
24 | --data-urlencode "client_id=${azuread_application_demo_client_id}" \
25 | --data-urlencode 'scope=https://graph.microsoft.com/.default' \
26 | --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
27 | --data-urlencode "client_assertion=$JWT_TOKEN" \
28 | --data-urlencode 'grant_type=client_credentials')
29 | echo "output: $output"
30 |
31 | azure_access_token=$(echo $output | jq -r '.access_token')
32 | echo "azure_access_token: $azure_access_token"
33 |
34 | if [ -z "$azure_access_token" ]; then
35 | echo "Failed to retrieve Azure access token"
36 | exit 1
37 | fi
38 |
39 | command_to_run="az rest --method GET --uri \"https://graph.microsoft.com/v1.0/servicePrincipals\" --skip-authorization-header --headers \"Authorization=Bearer \$azure_access_token\""
40 | echo "Run the following command to connect with Azure:"
41 | echo $command_to_run
42 | EOF
43 |
44 | chmod +x /etc/profile.d/set_env_vars.sh
45 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->azure/variables.tf:
--------------------------------------------------------------------------------
1 | # Random string resource definition to ensure unique resource names and avoid conflicts.
2 | resource "random_string" "random_suffix" {
3 | length = 5 # Length of the random string
4 | special = false # Excludes special characters for simplicity
5 | upper = false # Ensures all characters are lowercase to maintain uniformity
6 | }
7 |
8 | # Variable for specifying the AWS region where resources will be deployed.
9 | variable "aws_cognito_region" {
10 | type = string
11 | default = "us-east-1"
12 | }
13 |
14 | # Variable for specifying the specific AWS EC2 region, used particularly for EC2 resource deployments.
15 | variable "aws_ec2_region" {
16 | type = string
17 | default = "ap-south-1"
18 | }
19 |
20 | # Variable to define the AMI ID for deploying AWS EC2 instances.
21 | variable "aws_ec2_ami_id" {
22 | description = "AMI ID for the EC2 instance"
23 | type = string
24 | default = "ami-0f58b397bc5c1f2e8"
25 | }
26 |
27 | # Variable to specify the default admin username for AWS EC2 instances.
28 | variable "aws_admin_user" {
29 | description = "Default admin user for the EC2 instance"
30 | default = "ubuntu"
31 | type = string
32 | }
33 |
34 | # Variable for specifying the OpenID Connect issuer URL, important for identity federation with AWS.
35 | variable "openid_connect_url" {
36 | type = string
37 | default = "https://cognito-identity.amazonaws.com"
38 | nullable = false # Ensures that an issuer URL is always defined
39 | }
40 |
41 | # Variable to specify the developer provider name in identity pools, useful for federated identity setups.
42 | variable "developer_provider_name" {
43 | type = string
44 | default = "developerprovidername"
45 | }
46 |
47 | # Variable to specify the location for Azure resource groups, ensuring consistency across deployments.
48 | variable "resource_group_location" {
49 | type = string
50 | default = "East US" # Default location for resource groups
51 | nullable = false # Ensures that a location is always specified for resource groups
52 | }
53 |
54 | # Variable to define a prefix for naming resources, aiding in their identification and management.
55 | variable "prefix" {
56 | description = "Prefix used to name the resources for easy identification"
57 | type = string
58 | default = "aws-to-azure"
59 | }
60 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->gcp/README.md:
--------------------------------------------------------------------------------
1 | # AWS to GCP
2 |
3 | 
4 |
5 | ## Demo
6 |
7 | [](https://asciinema.org/a/Z37tmQbwzaXeaa2hc3AkaTCvj)
8 |
9 | ## Setup
10 |
11 | Ensure you are logged into both GCP & AWS systems from your CLI before executing below terraform commands.
12 |
13 |
14 | ### Verify GCP
15 |
16 | ```
17 | gcloud auth login
18 | gcloud auth application-default login
19 | ```
20 |
21 | List projects and choose one.
22 |
23 | ```
24 | gcloud projects list
25 | gcloud config set project
26 | ```
27 |
28 | ```
29 | gcloud config list
30 | ```
31 |
32 | ### Verify AWS
33 |
34 | ```
35 | aws sts get-caller-identity
36 | ```
37 |
38 | ### Integration
39 |
40 | Connect to GCP systems from AWS Cloud. In this example, we will use AWS VM to connect with GCP resources.
41 |
42 | ```
43 | export GCP_PROJECT_NAME=$(gcloud config list --format="value(core.project)")
44 | terraform init
45 | terraform plan -var gcp_project_name=$GCP_PROJECT_NAME
46 | terraform apply -var gcp_project_name=$GCP_PROJECT_NAME
47 | ```
48 |
49 | Post `terraform apply`, copy the ssh command from the output and login to the AWS VM.
50 |
51 | 1. Some pre-requisities will be installed
52 | 2. Connectivity to the GCP systems will be established
53 | 3. Test it by running, `gcloud iam service-accounts get-iam-policy ${gcp_service_account_email}`
54 |
55 | ### Destroy resources
56 |
57 | ```
58 | terraform destroy -var gcp_project_name=$GCP_PROJECT_NAME
59 | ```
60 |
61 | ## NOTE
62 |
63 | There's no in-built terraform module to create credential config, `gcloud iam workload-identity-pools create-cred-config`. This command will be executed on the local machine using terraform's `null_resource` capability.
64 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->gcp/aws-vm.tf:
--------------------------------------------------------------------------------
1 | # Create an IAM instance profile that EC2 instances can use to assume the specified IAM role
2 | resource "aws_iam_instance_profile" "ec2_profile" {
3 | depends_on = [aws_iam_role.ec2_gcloud_cli_role]
4 | name = "${var.prefix}-ec2_gcloud_cli_profile-${random_string.random_suffix.result}"
5 | role = aws_iam_role.ec2_gcloud_cli_role.name
6 | }
7 |
8 | # Generate an RSA private key for SSH access to the EC2 instances
9 | resource "tls_private_key" "demo_ssh_key" {
10 | algorithm = "RSA"
11 | rsa_bits = 4096
12 | }
13 |
14 | # Register the generated public key with AWS to create an SSH key pair for EC2
15 | resource "aws_key_pair" "key_pair" {
16 | depends_on = [tls_private_key.demo_ssh_key]
17 | key_name = var.key_name
18 | public_key = tls_private_key.demo_ssh_key.public_key_openssh
19 | }
20 |
21 | # Save the private key locally with restricted permissions for secure access
22 | resource "local_file" "private_key" {
23 | depends_on = [tls_private_key.demo_ssh_key]
24 | content = tls_private_key.demo_ssh_key.private_key_pem
25 | filename = var.key_name
26 | file_permission = "400"
27 | }
28 |
29 | # Define a security group for the EC2 instance with specific ingress and egress rules
30 | resource "aws_security_group" "sg_ec2" {
31 | name = "${var.prefix}-sg_ec2"
32 | description = "Security group for EC2 instance"
33 |
34 | ingress {
35 | from_port = 22
36 | to_port = 22
37 | protocol = "tcp"
38 | cidr_blocks = ["0.0.0.0/0"] # Allow SSH access from any IP
39 | }
40 |
41 | egress {
42 | from_port = 0
43 | to_port = 0
44 | protocol = "-1" # Allow all outbound traffic
45 | cidr_blocks = ["0.0.0.0/0"]
46 | }
47 | }
48 |
49 | # Create an EC2 instance with the specified configuration, including AMI, instance type, and security settings
50 | resource "aws_instance" "demo" {
51 | depends_on = [
52 | aws_security_group.sg_ec2,
53 | aws_iam_instance_profile.ec2_profile,
54 | aws_key_pair.key_pair,
55 | google_service_account.wi_aws,
56 | ]
57 | ami = var.aws_ec2_ami_id
58 | instance_type = "t2.micro"
59 | key_name = aws_key_pair.key_pair.key_name
60 | vpc_security_group_ids = [aws_security_group.sg_ec2.id]
61 | iam_instance_profile = aws_iam_instance_profile.ec2_profile.name
62 | user_data = templatefile("${path.module}/tpl/aws_ec2_user_data.tpl", {
63 | gcp_project_name = var.gcp_project_name,
64 | admin_user = var.aws_admin_user,
65 | gcp_service_account_email = google_service_account.wi_aws.email
66 | })
67 | metadata_options {
68 | # Allows the use of IMDSv1 because default generation of GCP create-cred-config doesn't include information that supports IMDS v2. To avoid, manually changing the generated cred-config, for demo purposes, we configure the AWS EC2 instance to support IMDS v1.
69 | http_tokens = "optional"
70 | }
71 |
72 | tags = {
73 | Name = "${var.prefix}-demo-instance"
74 | }
75 |
76 | root_block_device {
77 | volume_size = 10
78 | volume_type = "gp2"
79 | }
80 |
81 | provisioner "local-exec" {
82 | # Wait till machine is up and ready to accept ssh connections
83 | command = "until nc -z ${self.public_ip} 22; do echo 'Waiting for VM to become SSH-ready...'; sleep 10; done"
84 | }
85 |
86 | provisioner "remote-exec" {
87 | # Validate the ssh connection the created VM
88 | inline = [
89 | "echo 'VM is now reachable'"
90 | ]
91 | connection {
92 | type = "ssh"
93 | host = self.public_ip
94 | user = var.aws_admin_user
95 | private_key = file("${local_file.private_key.filename}")
96 | agent = false
97 | }
98 | }
99 | }
100 |
101 | # Use a null_resource to manage a script that copies the GCP credentials to the AWS VM
102 | resource "null_resource" "copy_gcp_cred_file_to_aws_vm" {
103 | depends_on = [
104 | aws_instance.demo,
105 | null_resource.create_cred_config,
106 | random_string.random_suffix,
107 | local_file.private_key,
108 | ]
109 | triggers = {
110 | always_run = timestamp()
111 | gcp_cred_config = "gcp-${random_string.random_suffix.result}.json"
112 | }
113 |
114 | # Provisioning command to securely copy the GCP credentials over to the AWS instance
115 | provisioner "local-exec" {
116 | when = create
117 | command = "scp -i ${local_file.private_key.filename} -o StrictHostKeyChecking=no ${self.triggers["gcp_cred_config"]} ${var.aws_admin_user}@${aws_instance.demo.public_ip}:/home/${var.aws_admin_user}/gcp.json"
118 | }
119 | }
120 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->gcp/aws.tf:
--------------------------------------------------------------------------------
1 | # Data source to get the AWS caller identity to access account-specific details like account ID
2 | data "aws_caller_identity" "current" {}
3 |
4 | # Create an IAM role for EC2 that can be assumed by AWS services
5 | resource "aws_iam_role" "ec2_gcloud_cli_role" {
6 | depends_on = [random_string.random_suffix]
7 | name = "${var.prefix}-ec2_gcloud_cli_role-${random_string.random_suffix.result}"
8 |
9 | # IAM policy that allows an EC2 instance to assume this role
10 | assume_role_policy = jsonencode({
11 | Version = "2012-10-17"
12 | Statement = [
13 | {
14 | Effect = "Allow"
15 | Action = "sts:AssumeRole"
16 | Principal = { Service = "ec2.amazonaws.com" }
17 | }
18 | ]
19 | })
20 | }
21 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->gcp/gcp.tf:
--------------------------------------------------------------------------------
1 | # Data source to fetch current Google Cloud project details
2 | data "google_project" "project" {}
3 |
4 | # Create a Workload Identity Pool in GCP for managing identities from AWS
5 | resource "google_iam_workload_identity_pool" "avi_aws_pool" {
6 | depends_on = [ random_string.random_suffix ]
7 | workload_identity_pool_id = "${var.prefix}-aws-pool-id-${random_string.random_suffix.result}"
8 | display_name = "aws-pool-id-${random_string.random_suffix.result}"
9 | description = "Identity pool for AWS to access GCP resources"
10 | }
11 |
12 | # Provider in the workload identity pool for AWS
13 | resource "google_iam_workload_identity_pool_provider" "avi_aws_provider" {
14 | depends_on = [
15 | random_string.random_suffix,
16 | google_iam_workload_identity_pool.avi_aws_pool,
17 | data.aws_caller_identity.current,
18 | aws_iam_role.ec2_gcloud_cli_role,
19 | ]
20 | workload_identity_pool_id = google_iam_workload_identity_pool.avi_aws_pool.workload_identity_pool_id
21 | workload_identity_pool_provider_id = "aws-pool-provider-id-${random_string.random_suffix.result}"
22 | display_name = "aws-pool-provider-id-${random_string.random_suffix.result}"
23 | attribute_condition = "attribute.aws_role==\"arn:aws:sts::${data.aws_caller_identity.current.account_id}:assumed-role/${aws_iam_role.ec2_gcloud_cli_role.name}\""
24 |
25 | # Configuration to link AWS account to this provider
26 | aws {
27 | account_id = data.aws_caller_identity.current.account_id
28 | }
29 | }
30 |
31 | # Create a Google service account to be used with the Workload Identity Pool
32 | resource "google_service_account" "wi_aws" {
33 | depends_on = [ random_string.random_suffix ]
34 | account_id = "${var.prefix}-wi-aws-${random_string.random_suffix.result}"
35 | display_name = "Workload Identity AWS-${random_string.random_suffix.result}"
36 | }
37 |
38 | # Bind the Google service account to the Workload Identity Pool with necessary roles
39 | resource "google_service_account_iam_member" "wi_aws_binding" {
40 | depends_on = [
41 | google_service_account.wi_aws,
42 | data.google_project.project,
43 | google_iam_workload_identity_pool.avi_aws_pool,
44 | ]
45 | service_account_id = google_service_account.wi_aws.name
46 | role = "roles/iam.workloadIdentityUser"
47 | member = "principalSet://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.avi_aws_pool.workload_identity_pool_id}/*"
48 | }
49 |
50 | # Define the roles to be assigned to the Google service account
51 | locals {
52 | roles = {
53 | "viewer" = "roles/viewer",
54 | # "serviceAccountTokenCreator" = "roles/iam.serviceAccountTokenCreator",
55 | # "serviceAccountUser" = "roles/iam.serviceAccountUser"
56 | }
57 | }
58 |
59 | # Dynamically assign roles to the Google service account
60 | resource "google_project_iam_member" "wi_aws_binding" {
61 | for_each = local.roles
62 |
63 | depends_on = [google_service_account.wi_aws]
64 | project = var.gcp_project_name
65 | role = each.value
66 | member = "serviceAccount:${google_service_account.wi_aws.email}"
67 | }
68 |
69 | # A null_resource to handle the creation and deletion of GCP credentials configuration file
70 | # For this demo, this credentials file will be copied to aws ec2 instance
71 | # and ec2 will connect to Google Cloud using this file.
72 | resource "null_resource" "create_cred_config" {
73 | depends_on = [
74 | google_service_account.wi_aws,
75 | google_iam_workload_identity_pool.avi_aws_pool,
76 | google_iam_workload_identity_pool_provider.avi_aws_provider,
77 | random_string.random_suffix,
78 | data.google_project.project,
79 | ]
80 |
81 | triggers = {
82 | always_run = timestamp()
83 | gcp_cred_config = "gcp-${random_string.random_suffix.result}.json"
84 | }
85 |
86 | # Local-exec provisioner to create the GCP credentials configuration file using gcloud CLI
87 | provisioner "local-exec" {
88 | when = create
89 | command = <gcp/outputs.tf:
--------------------------------------------------------------------------------
1 | # Output the SSH command to connect to the AWS EC2 instance
2 | output "aws_ec2_ssh_login_command" {
3 | depends_on = [
4 | null_resource.copy_gcp_cred_file_to_aws_vm,
5 | aws_instance.demo
6 | ]
7 | value = "ssh -i ${var.key_name} ${var.aws_admin_user}@${aws_instance.demo.public_ip}"
8 | }
9 |
10 | # # Output the AWS region used for provisioning resources
11 | # output "aws_ec2_region" {
12 | # value = var.aws_region
13 | # }
14 |
15 | # # Output the GCP credentials configuration file path
16 | # output "gcp_cred_config_file" {
17 | # depends_on = [
18 | # null_resource.create_cred_config
19 | # ]
20 | # value = null_resource.create_cred_config.triggers["gcp_cred_config"]
21 | # }
22 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->gcp/providers.tf:
--------------------------------------------------------------------------------
1 | # Define required providers and their versions for this configuration
2 | terraform {
3 | required_providers {
4 | google = {
5 | source = "hashicorp/google"
6 | version = "5.29.1"
7 | }
8 | tls = {
9 | source = "hashicorp/tls"
10 | version = "4.0.5"
11 | }
12 | local = {
13 | source = "hashicorp/local"
14 | version = "2.5.1"
15 | }
16 | random = {
17 | source = "hashicorp/random"
18 | version = "3.6.2"
19 | }
20 | aws = {
21 | source = "hashicorp/aws"
22 | version = "5.50.0"
23 | }
24 | null = {
25 | source = "hashicorp/null"
26 | version = "3.2.2"
27 | }
28 | }
29 | }
30 |
31 | # Configure the Google Cloud provider with the specified project
32 | provider "google" {
33 | project = var.gcp_project_name
34 | }
35 |
36 | # Configure the AWS provider with the specified region
37 | provider "aws" {
38 | region = var.aws_region
39 | }
40 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->gcp/tpl/aws_ec2_user_data.tpl:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | cat < /etc/profile.d/set_env_vars.sh
3 | #!/bin/bash
4 | echo "Installing some pre-requisites"
5 | sudo snap install google-cloud-cli --classic
6 | echo "Running 'gcloud auth login --cred-file=/home/${admin_user}/gcp.json'"
7 | gcloud auth login --cred-file=/home/${admin_user}/gcp.json
8 | echo "Running 'gcloud config set project ${gcp_project_name}'"
9 | gcloud config set project ${gcp_project_name}
10 | echo "Fetching permissions of associated IAM account"
11 | echo "Running 'gcloud iam service-accounts get-iam-policy ${gcp_service_account_email}'"
12 | gcloud iam service-accounts get-iam-policy ${gcp_service_account_email}
13 | EOF
14 | chmod +x /etc/profile.d/set_env_vars.sh
15 |
--------------------------------------------------------------------------------
/cross-cloud-integration/aws->gcp/variables.tf:
--------------------------------------------------------------------------------
1 | # Define variables with descriptions and default values
2 |
3 | # Google Cloud project name
4 | variable "gcp_project_name" {
5 | description = "GCP project name for Google resources"
6 | type = string
7 | }
8 |
9 | # AWS region where the resources will be created
10 | variable "aws_region" {
11 | description = "AWS region where resources will be created"
12 | type = string
13 | default = "ap-south-1"
14 | }
15 |
16 | # Prefix to be used for naming the resources to ensure uniqueness and easy identification
17 | variable "prefix" {
18 | description = "Prefix used to name the resources for easy identification"
19 | type = string
20 | default = "aws-to-gcp"
21 | }
22 |
23 | # AMI ID to use for creating EC2 instances
24 | variable "aws_ec2_ami_id" {
25 | description = "AMI ID for the EC2 instance"
26 | type = string
27 | default = "ami-0f58b397bc5c1f2e8"
28 | }
29 |
30 | # Default administrator username for accessing the EC2 instances
31 | variable "aws_admin_user" {
32 | description = "Default admin user for the EC2 instance"
33 | default = "ubuntu"
34 | }
35 |
36 | # Name of the SSH key to be used for the EC2 instances
37 | variable "key_name" {
38 | description = "SSH key pair name"
39 | default = "temporary-terraform-ec2.pem"
40 | }
41 |
42 | # Generate a random string to use as a suffix in resource names to ensure uniqueness
43 | resource "random_string" "random_suffix" {
44 | length = 5
45 | special = false
46 | upper = false
47 | }
48 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/README.md:
--------------------------------------------------------------------------------
1 | # Azure to AWS
2 |
3 | 
4 |
5 | ## Demo
6 |
7 | [](https://asciinema.org/a/I2TOpYnJiF7294JFUWjWc8m5J)
8 |
9 | ## Setup
10 |
11 | Ensure you are logged into both AWS & Azure systems from your CLI before executing below terraform commands.
12 |
13 | ### Verify AWS
14 |
15 | ```
16 | aws sts get-caller-identity
17 | ```
18 |
19 | ### Verify Azure
20 |
21 | ```
22 | az account show
23 | ```
24 |
25 | ### Integration
26 |
27 | Connect to AWS systems from Azure Cloud. In this example, we will use Azure VM to connect with AWS resources.
28 |
29 | ```
30 | terraform init
31 | terraform plan
32 | terraform apply
33 | ```
34 |
35 | Post `terraform apply`, copy the ssh command from the output and login to the Azure VM.
36 |
37 | 1. Some pre-requisities will be installed
38 | 2. Connectivity to the AWS systems will be established
39 | 3. Test it by running, `aws sts get-caller-identity`
40 | 4. `AmazonS3ReadOnlyAccess` is provided in the configuration.
41 | 1. Run `aws s3 ls` - Must work
42 | 2. Run `aws ec2 describe-instances --region us-east-1` - Must throw permission error
43 |
44 | ### Destroy resources
45 |
46 | ```
47 | terraform destroy
48 | ```
49 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/aws.tf:
--------------------------------------------------------------------------------
1 | # Retrieve AWS caller identity details.
2 | data "aws_caller_identity" "current" {}
3 |
4 | # Fetch TLS certificate for Azure OIDC configuration.
5 | data "tls_certificate" "azure" {
6 | url = "https://sts.windows.net/${data.azuread_client_config.current.tenant_id}/.well-known/openid-configuration"
7 | }
8 |
9 | # Create an AWS IAM OpenID Connect provider for Azure.
10 | resource "aws_iam_openid_connect_provider" "default" {
11 | url = "https://sts.windows.net/${data.azuread_client_config.current.tenant_id}/"
12 | client_id_list = tolist(azuread_application.demo.identifier_uris)
13 | thumbprint_list = [data.tls_certificate.azure.certificates[0].sha1_fingerprint]
14 | }
15 |
16 | # Define a local trust policy from a template.
17 | locals {
18 | trust_policy = templatefile("${path.module}/tpl/azure-trust-policy.json.tpl", {
19 | aws_account_id = data.aws_caller_identity.current.account_id
20 | azure_tenant_id = data.azuread_client_config.current.tenant_id
21 | identifier_uri = tolist(azuread_application.demo.identifier_uris)[0]
22 | principal_id = azurerm_user_assigned_identity.demo.principal_id
23 | })
24 | }
25 |
26 | # Create an IAM role with an OIDC-based trust policy.
27 | resource "aws_iam_role" "assume_role" {
28 | depends_on = [aws_iam_openid_connect_provider.default]
29 | name = "${var.prefix}-AssumeRole-${random_string.random_suffix.result}"
30 | assume_role_policy = local.trust_policy
31 | }
32 |
33 | # Attach an S3 read-only access policy to the IAM role.
34 | resource "aws_iam_role_policy_attachment" "s3_readonly_policy" {
35 | depends_on = [aws_iam_role.assume_role]
36 | role = aws_iam_role.assume_role.name
37 | policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
38 | }
39 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/azure-vm.tf:
--------------------------------------------------------------------------------
1 | # Create a Virtual Network in Azure for testing AWS connectivity.
2 | resource "azurerm_virtual_network" "demo" {
3 | depends_on = [ random_string.random_suffix, azurerm_resource_group.demo ]
4 | name = "${var.prefix}-vnet-${random_string.random_suffix.result}"
5 | address_space = ["10.0.0.0/16"]
6 | location = azurerm_resource_group.demo.location
7 | resource_group_name = azurerm_resource_group.demo.name
8 | }
9 |
10 | # Create a subnet within the virtual network.
11 | resource "azurerm_subnet" "demo" {
12 | depends_on = [azurerm_virtual_network.demo, random_string.random_suffix]
13 | name = "${var.prefix}-subnet-${random_string.random_suffix.result}"
14 | resource_group_name = azurerm_resource_group.demo.name
15 | virtual_network_name = azurerm_virtual_network.demo.name
16 | address_prefixes = ["10.0.1.0/24"]
17 | }
18 |
19 | # Define a public IP resource for network accessibility.
20 | resource "azurerm_public_ip" "demo" {
21 | depends_on = [ azurerm_resource_group.demo, random_string.random_suffix ]
22 | name = "${var.prefix}-public-ip-${random_string.random_suffix.result}"
23 | location = azurerm_resource_group.demo.location
24 | resource_group_name = azurerm_resource_group.demo.name
25 | allocation_method = "Dynamic"
26 | }
27 |
28 | # Configure a network interface with the public IP and subnet.
29 | resource "azurerm_network_interface" "demo" {
30 | depends_on = [
31 | azurerm_subnet.demo,
32 | azurerm_resource_group.demo,
33 | random_string.random_suffix,
34 | azurerm_public_ip.demo,
35 | ]
36 | name = "${var.prefix}-network-interface-${random_string.random_suffix.result}"
37 | location = azurerm_resource_group.demo.location
38 | resource_group_name = azurerm_resource_group.demo.name
39 |
40 | ip_configuration {
41 | name = "internal"
42 | subnet_id = azurerm_subnet.demo.id
43 | private_ip_address_allocation = "Dynamic"
44 | public_ip_address_id = azurerm_public_ip.demo.id
45 | }
46 | }
47 |
48 | # Set up a Linux virtual machine that connects to the defined network interface.
49 | resource "azurerm_linux_virtual_machine" "demo" {
50 | depends_on = [
51 | azurerm_network_interface.demo,
52 | aws_iam_role.assume_role,
53 | aws_iam_openid_connect_provider.default,
54 | random_string.random_suffix,
55 | azurerm_resource_group.demo,
56 | azurerm_user_assigned_identity.demo,
57 | data.aws_caller_identity.current,
58 | azuread_application.demo,
59 | ]
60 | name = "${var.prefix}-vm-${random_string.random_suffix.result}"
61 | disable_password_authentication = false
62 | resource_group_name = azurerm_resource_group.demo.name
63 | location = azurerm_resource_group.demo.location
64 | size = "Standard_B1ls" # Entry-level VM size
65 |
66 | admin_username = var.azure_vm_admin_username
67 | admin_password = var.azure_vm_admin_password
68 |
69 | network_interface_ids = [azurerm_network_interface.demo.id]
70 |
71 | os_disk {
72 | caching = "ReadWrite"
73 | storage_account_type = "Standard_LRS"
74 | }
75 |
76 | source_image_reference {
77 | publisher = "Canonical"
78 | offer = "UbuntuServer"
79 | sku = "18.04-LTS"
80 | version = "latest"
81 | }
82 |
83 | identity {
84 | type = "UserAssigned"
85 | identity_ids = [azurerm_user_assigned_identity.demo.id]
86 | }
87 |
88 | custom_data = base64encode(
89 | templatefile("${path.module}/tpl/azure-vm-init-script.yaml.tpl", {
90 | account_id = data.aws_caller_identity.current.account_id
91 | aws_iam_role_name = aws_iam_role.assume_role.name
92 | audience = tolist(azuread_application.demo.identifier_uris)[0]
93 | app_role = var.app_role
94 | })
95 | )
96 | }
97 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/azure.tf:
--------------------------------------------------------------------------------
1 | # Retrieve current Azure AD client configuration, useful for establishing cross-service trust relationships.
2 | data "azuread_client_config" "current" {}
3 |
4 | # Define an Azure AD application to be used with AWS resources for trust and authentication.
5 | resource "azuread_application" "demo" {
6 | depends_on = [
7 | random_string.random_suffix,
8 | ]
9 | display_name = "${var.prefix}-Application-${random_string.random_suffix.result}"
10 | description = "${var.prefix} application description"
11 | sign_in_audience = "AzureADMyOrg"
12 | identifier_uris = ["urn://azure-aws"]
13 |
14 | # Define an application role for AWS STS Web Identity API.
15 | app_role {
16 | id = uuidv5("url", var.app_role)
17 | value = var.app_role
18 | description = "${var.prefix} - This app will temporarily use AWS STS Web Identity API"
19 | display_name = "AssumeRole"
20 | allowed_member_types = ["User", "Application"]
21 | enabled = true
22 | }
23 | }
24 |
25 | # Create a service principal for the above Azure AD application, tagging it for specific integrations.
26 | resource "azuread_service_principal" "demo" {
27 | depends_on = [ azuread_application.demo ]
28 | client_id = azuread_application.demo.client_id
29 | tags = ["WindowsAzureActiveDirectoryIntegratedApp", "HideApp"]
30 | }
31 |
32 | # Set up an Azure Resource Group in the East US region.
33 | resource "azurerm_resource_group" "demo" {
34 | depends_on = [ random_string.random_suffix ]
35 | name = "${var.prefix}-resource-group-${random_string.random_suffix.result}"
36 | location = "East US"
37 | }
38 |
39 | # Define a user-assigned identity in Azure for fine-grained access control within Azure resources.
40 | resource "azurerm_user_assigned_identity" "demo" {
41 | depends_on = [
42 | random_string.random_suffix,
43 | azurerm_resource_group.demo,
44 | ]
45 | name = "${var.prefix}-identity-${random_string.random_suffix.result}"
46 | resource_group_name = azurerm_resource_group.demo.name
47 | location = azurerm_resource_group.demo.location
48 | }
49 |
50 | # Assign the defined app role to the user-assigned identity for the specified service principal.
51 | resource "azuread_app_role_assignment" "demo" {
52 | depends_on = [
53 | azuread_application.demo,
54 | azurerm_user_assigned_identity.demo,
55 | azuread_service_principal.demo,
56 | ]
57 | app_role_id = azuread_application.demo.app_role_ids[var.app_role]
58 | principal_object_id = azurerm_user_assigned_identity.demo.principal_id
59 | resource_object_id = azuread_service_principal.demo.object_id
60 | }
61 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/outputs.tf:
--------------------------------------------------------------------------------
1 | # Generate the SSH command to log into the Azure VM.
2 | output "ssh_login_command" {
3 | depends_on = [azurerm_linux_virtual_machine.demo]
4 | value = "ssh ${var.azure_vm_admin_username}@${azurerm_linux_virtual_machine.demo.public_ip_address}"
5 | description = "SSH command to connect to the virtual machine."
6 | }
7 |
8 | # Output the password required for SSH login.
9 | output "ssh_password" {
10 | value = var.azure_vm_admin_password
11 | description = "Use this password to login to the VM."
12 | }
13 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/providers.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_providers {
3 | azuread = {
4 | source = "hashicorp/azuread"
5 | version = "2.50.0"
6 | }
7 | aws = {
8 | source = "hashicorp/aws"
9 | version = "5.50.0"
10 | }
11 | tls = {
12 | source = "hashicorp/tls"
13 | version = "4.0.5"
14 | }
15 | azurerm = {
16 | source = "hashicorp/azurerm"
17 | version = "3.104.2"
18 | }
19 | random = {
20 | source = "hashicorp/random"
21 | version = "3.6.2"
22 | }
23 | }
24 | }
25 |
26 | # Configure the Azure AD provider with default settings.
27 | provider "azuread" {}
28 |
29 | # Initialize the Azure RM (Resource Manager) provider with no specific features enabled.
30 | provider "azurerm" {
31 | features {}
32 | }
33 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/tpl/azure-trust-policy.json.tpl:
--------------------------------------------------------------------------------
1 | {
2 | "Version": "2012-10-17",
3 | "Statement": [{
4 | "Effect": "Allow",
5 | "Principal": {
6 | "Federated": "arn:aws:iam::${aws_account_id}:oidc-provider/sts.windows.net/${azure_tenant_id}/"
7 | },
8 | "Action": "sts:AssumeRoleWithWebIdentity",
9 | "Condition": {
10 | "StringEquals": {
11 | "sts.windows.net/${azure_tenant_id}/:aud": "${identifier_uri}",
12 | "sts.windows.net/${azure_tenant_id}/:sub": "${principal_id}"
13 | }
14 | }
15 | }]
16 | }
17 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/tpl/azure-vm-init-script.yaml.tpl:
--------------------------------------------------------------------------------
1 | #cloud-config
2 | write_files:
3 | - path: /etc/profile.d/set_env_vars.sh
4 | content: |
5 | echo "Installing some pre-requisites"
6 | sudo snap install jq
7 | sudo apt update
8 | sudo apt -y install awscli
9 | export ROLE_ARN="arn:aws:iam::${account_id}:role/${aws_iam_role_name}"
10 | export ACCESS_TOKEN=$(curl "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=${audience}" -H "Metadata:true" -s | jq -r ".access_token")
11 | echo "Run the following command to test the AWS connectivity: "
12 | echo 'curl -s --header "Content-Type: application/x-www-form-urlencoded" --data "Action=${app_role}" --data "Version=2011-06-15" --data "DurationSeconds=3600" --data "RoleSessionName=session" --data "RoleArn=$ROLE_ARN" --data "WebIdentityToken=$ACCESS_TOKEN" https://sts.amazonaws.com'
13 | response=$(curl -s --header "Content-Type: application/x-www-form-urlencoded" --data "Action=${app_role}" --data "Version=2011-06-15" --data "DurationSeconds=3600" --data "RoleSessionName=session" --data "RoleArn=$ROLE_ARN" --data "WebIdentityToken=$ACCESS_TOKEN" https://sts.amazonaws.com)
14 | AccessKeyId=$(echo $response | grep -oP '\K[^<]+')
15 | SecretAccessKey=$(echo $response | grep -oP '\K[^<]+')
16 | SessionToken=$(echo $response | grep -oP '\K[^<]+')
17 | # Set them as environment variables
18 | export AWS_ACCESS_KEY_ID=$AccessKeyId
19 | export AWS_SECRET_ACCESS_KEY=$SecretAccessKey
20 | export AWS_SESSION_TOKEN=$SessionToken
21 | # Verify environment variable setting
22 | echo "AWS_ACCESS_KEY_ID is set to: $AWS_ACCESS_KEY_ID"
23 | echo "AWS_SECRET_ACCESS_KEY is set to: $AWS_SECRET_ACCESS_KEY"
24 | echo "AWS_SESSION_TOKEN is set to: $AWS_SESSION_TOKEN"
25 | echo "Running aws sts get-caller-identity"
26 | aws sts get-caller-identity
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/variables.tf:
--------------------------------------------------------------------------------
1 | # Define a variable for specifying an application role, used primarily for identity assumptions.
2 | variable "app_role" {
3 | type = string
4 | default = "AssumeRoleWithWebIdentity"
5 | nullable = false
6 | description = "The application role name to be used with Web Identity providers."
7 | }
8 |
9 | # Define a variable for prefixing resource names to ensure uniqueness and traceability.
10 | variable "prefix" {
11 | type = string
12 | default = "azure-to-aws"
13 | nullable = false
14 | description = "Prefix for naming resources, used to avoid name clashes and improve manageability."
15 | }
16 |
17 | # Generate a random string to append to resources, ensuring unique names and reducing collision risk.
18 | resource "random_string" "random_suffix" {
19 | length = 5
20 | special = false
21 | upper = false
22 | }
23 |
24 | # Define the username for the Azure virtual machine administrator.
25 | variable "azure_vm_admin_username" {
26 | type = string
27 | default = "azureuser"
28 | nullable = false
29 | description = "Default username for the administrator account on the Azure VM."
30 | }
31 |
32 | # Define the password for the Azure virtual machine administrator, ensuring access credentials are set.
33 | variable "azure_vm_admin_password" {
34 | type = string
35 | default = "Azureuser1234"
36 | nullable = false
37 | description = "The password for the VM's administrator account."
38 | }
39 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->aws/workflow.md:
--------------------------------------------------------------------------------
1 | Azure-AWS-AssumeRole - Managed Identity - Object (principal) ID - 89db5217-9f6f-4148-b0ed-f125c0d8c125
2 |
3 | azure_aws_assume_role - App Roles - e277fc03-f004-4644-b7c8-6c0ed89ae577
4 |
5 | PrincipalID = Object ID
6 |
7 | ResourceID = 1e6f2537-375c-40fa-8a64-f53bcf5550b7
8 |
9 | New-AzureADServiceAppRoleAssignment -ObjectId -Id -PrincipalId -ResourceId
10 |
11 | curl -X POST https://graph.microsoft.com/v1.0/servicePrincipals/89db5217-9f6f-4148-b0ed-f125c0d8c125/appRoleAssignments \
12 | -H "Authorization: Bearer $accessToken" \
13 | -H "Content-Type: application/json" \
14 | -d '{
15 | "principalId": "89db5217-9f6f-4148-b0ed-f125c0d8c125",
16 | "resourceId": "1e6f2537-375c-40fa-8a64-f53bcf5550b7",
17 | "appRoleId": "e277fc03-f004-4644-b7c8-6c0ed89ae577"
18 | }'
19 |
20 | ```
21 | az rest --method POST --uri "https://graph.microsoft.com/v1.0/servicePrincipals/89db5217-9f6f-4148-b0ed-f125c0d8c125/appRoleAssignments" --body '{
22 | "principalId": "89db5217-9f6f-4148-b0ed-f125c0d8c125",
23 | "resourceId": "1e6f2537-375c-40fa-8a64-f53bcf5550b7",
24 | "appRoleId": "e277fc03-f004-4644-b7c8-6c0ed89ae577"
25 | }'
26 | {
27 | "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('89db5217-9f6f-4148-b0ed-f125c0d8c125')/appRoleAssignments/$entity",
28 | "appRoleId": "e277fc03-f004-4644-b7c8-6c0ed89ae577",
29 | "createdDateTime": "2024-05-16T17:40:25.3586982Z",
30 | "deletedDateTime": null,
31 | "id": "F1LbiW-fSEGw7fElwNjBJWVkVAvmO7FIsR94xDJWEl8",
32 | "principalDisplayName": "Azure-AWS-AssumeRole",
33 | "principalId": "89db5217-9f6f-4148-b0ed-f125c0d8c125",
34 | "principalType": "ServicePrincipal",
35 | "resourceDisplayName": "azure_aws_assume_role",
36 | "resourceId": "1e6f2537-375c-40fa-8a64-f53bcf5550b7"
37 | }
38 | ```
39 |
40 | "tenantId": "b506ae5f-374f-4e03-ad64-c1bc65e5ba82",
41 |
42 | Azure-AWSAssumeRole
43 | {
44 | "Version": "2012-10-17",
45 | "Statement": [{
46 | "Effect": "Allow",
47 | "Principal": {
48 | "Federated": "arn:aws:iam::558267956267:oidc-provider/sts.windows.net/b506ae5f-374f-4e03-ad64-c1bc65e5ba82/"
49 | },
50 | "Action": "sts:AssumeRoleWithWebIdentity",
51 | "Condition": {
52 | "StringEquals": {
53 | "sts.windows.net/b506ae5f-374f-4e03-ad64-c1bc65e5ba82/:aud": "urn://aws-account",
54 | "sts.windows.net/b506ae5f-374f-4e03-ad64-c1bc65e5ba82/:sub": "89db5217-9f6f-4148-b0ed-f125c0d8c125"
55 | }
56 | }
57 | }]
58 | }
59 |
60 | ---
61 | AUDIENCE="urn://aws-account"
62 | ROLE_ARN="arn:aws:iam:: :role/Azure-AWSAssumeRole"
63 | access_token=$(curl "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=${AUDIENCE}" -H "Metadata:true" -s| jq -r '.access_token')
64 |
65 | # Create credentials following JSON format required by AWS CLI
66 | credentials=$(aws sts assume-role-with-web-identity –role-arn ${ROLE_ARN} –web-identity-token $access_token –role-session-name AWSAssumeRole|jq '.Credentials' | jq '.Version=1')
67 |
68 | # Write credentials to STDOUT for AWS CLI to pick up
69 | echo $credentials
70 |
71 | $ curl -v \
72 | --header "Content-Type: application/x-www-form-urlencoded" \
73 | --data "Action=AssumeRoleWithWebIdentity" \
74 | --data "Version=2011-06-15" \
75 | --data "DurationSeconds=3600" \
76 | --data "RoleSessionName=sesss" \
77 | --data "RoleArn=${ROLE_ARN}" \
78 | --data "WebIdentityToken="$access_token \
79 | POST https://sts.amazonaws.com
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->gcp/README.md:
--------------------------------------------------------------------------------
1 | # Azure to GCP
2 |
3 | 
4 |
5 | ## Demo
6 |
7 | [](https://asciinema.org/a/KImHqr7vrk1RPHzxdvK7xNfcV)
8 |
9 | ## Setup
10 |
11 | Ensure you are logged into both GCP & Azure systems from your CLI before executing below terraform commands.
12 |
13 | ### Verify GCP
14 |
15 | ```
16 | gcloud auth login
17 | gcloud auth application-default login
18 | ```
19 |
20 | List projects and choose one.
21 |
22 | ```
23 | gcloud projects list
24 | gcloud config set project
25 | ```
26 |
27 | ```
28 | gcloud config list
29 | ```
30 |
31 | ### Verify Azure
32 |
33 | ```
34 | az account show
35 | ```
36 |
37 | ### Integration
38 |
39 | Connect to GCP systems from Azure Cloud. In this example, we will use Azure VM to connect with GCP resources.
40 |
41 | ```
42 | export GCP_PROJECT_NAME=$(gcloud config list --format="value(core.project)")
43 | terraform init
44 | terraform plan -var gcp_project_name=$GCP_PROJECT_NAME
45 | terraform apply -var gcp_project_name=$GCP_PROJECT_NAME
46 | ```
47 |
48 | Post `terraform apply`, copy the ssh command from the output and login to the Azure VM.
49 |
50 | 1. Some pre-requisities will be installed
51 | 2. Connectivity to the GCP systems will be established
52 | 3. Test it by running, `gcloud iam service-accounts get-iam-policy $(gcloud auth list --format="value(account)")`
53 |
54 | ### Destroy resources
55 |
56 | ```
57 | terraform destroy -var gcp_project_name=
58 | ```
59 |
60 | ## NOTE
61 |
62 | There's no in-built terraform module to create credential config, `gcloud iam workload-identity-pools create-cred-config`. This command will be executed on the local machine using terraform's `null_resource` capability.
63 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->gcp/azure-vm.tf:
--------------------------------------------------------------------------------
1 | # Generate a private key for SSH access
2 | resource "tls_private_key" "demo_ssh_key" {
3 | algorithm = "RSA"
4 | rsa_bits = 2048
5 | }
6 |
7 | # Create a file to store the generated private SSH key
8 | resource "local_file" "private_key_file" {
9 | content = tls_private_key.demo_ssh_key.private_key_pem
10 | filename = "${path.module}/demo_ssh_key.pem"
11 | file_permission = "0400"
12 | }
13 |
14 | # Create a virtual network within Azure
15 | resource "azurerm_virtual_network" "demo" {
16 | name = "${var.prefix}-vnet-${random_string.random_suffix.result}"
17 | address_space = ["10.0.0.0/16"]
18 | location = azurerm_resource_group.demo.location
19 | resource_group_name = azurerm_resource_group.demo.name
20 | }
21 |
22 | # Define a subnet within the virtual network
23 | resource "azurerm_subnet" "demo" {
24 | name = "${var.prefix}-subnet-${random_string.random_suffix.result}"
25 | resource_group_name = azurerm_resource_group.demo.name
26 | virtual_network_name = azurerm_virtual_network.demo.name
27 | address_prefixes = ["10.0.1.0/24"]
28 | }
29 |
30 | # Allocate a public IP for Azure resources
31 | resource "azurerm_public_ip" "demo" {
32 | name = "${var.prefix}-public-ip-${random_string.random_suffix.result}"
33 | location = azurerm_resource_group.demo.location
34 | resource_group_name = azurerm_resource_group.demo.name
35 | allocation_method = "Dynamic"
36 | }
37 |
38 | # Configure a network interface for Azure VM
39 | resource "azurerm_network_interface" "demo" {
40 | name = "${var.prefix}-nic-${random_string.random_suffix.result}"
41 | location = azurerm_resource_group.demo.location
42 | resource_group_name = azurerm_resource_group.demo.name
43 |
44 | ip_configuration {
45 | name = "internal"
46 | subnet_id = azurerm_subnet.demo.id
47 | private_ip_address_allocation = "Dynamic"
48 | public_ip_address_id = azurerm_public_ip.demo.id
49 | }
50 | }
51 |
52 | # Deploy an Azure Linux virtual machine
53 | resource "azurerm_linux_virtual_machine" "demo" {
54 | depends_on = [null_resource.create_cred_config]
55 | name = "${var.prefix}-vm-${random_string.random_suffix.result}"
56 | disable_password_authentication = true
57 | resource_group_name = azurerm_resource_group.demo.name
58 | location = azurerm_resource_group.demo.location
59 | size = "Standard_B1ls" # Cheapest VM size for testing
60 |
61 | admin_username = var.admin_username
62 |
63 | admin_ssh_key {
64 | username = var.admin_username
65 | public_key = tls_private_key.demo_ssh_key.public_key_openssh
66 | }
67 |
68 | network_interface_ids = [azurerm_network_interface.demo.id]
69 |
70 | os_disk {
71 | caching = "ReadWrite"
72 | storage_account_type = "Standard_LRS"
73 | }
74 |
75 | source_image_reference {
76 | publisher = "Canonical"
77 | offer = "UbuntuServer"
78 | sku = "18.04-LTS"
79 | version = "latest"
80 | }
81 |
82 | identity {
83 | type = "UserAssigned"
84 | identity_ids = [azurerm_user_assigned_identity.demo.id]
85 | }
86 |
87 | custom_data = base64encode(templatefile("${path.module}/tpl/azure-vm-init-script.yaml.tpl", {
88 | admin_username = var.admin_username
89 | gcp_project_name = var.gcp_project_name
90 | }))
91 |
92 | provisioner "local-exec" {
93 | command = "until nc -z ${self.public_ip_address} 22; do echo 'Waiting for VM to become SSH-ready...'; sleep 10; done"
94 | }
95 |
96 | provisioner "remote-exec" {
97 | inline = ["echo 'VM is now reachable'"]
98 | connection {
99 | type = "ssh"
100 | host = self.public_ip_address
101 | user = var.admin_username
102 | private_key = file("${local_file.private_key_file.filename}")
103 | agent = false
104 | }
105 | }
106 | }
107 |
108 | # Provision a script to copy the Google Cloud credentials file to the Azure VM
109 | resource "null_resource" "copy_gcp_cred_file_to_azure_vm" {
110 | depends_on = [azurerm_linux_virtual_machine.demo]
111 | triggers = {
112 | always_run = timestamp()
113 | gcp_cred_config = "gcp-${random_string.random_suffix.result}.json"
114 | }
115 |
116 | provisioner "local-exec" {
117 | when = create
118 | command = <gcp/azure.tf:
--------------------------------------------------------------------------------
1 | # Retrieve the configuration of the current Azure AD client
2 | data "azuread_client_config" "current" {
3 | }
4 |
5 | # Create an Azure AD application with configurable display properties and roles
6 | resource "azuread_application" "demo" {
7 | display_name = "${var.prefix}-application-${random_string.random_suffix.result}"
8 | description = "${var.prefix} application description ${random_string.random_suffix.result}"
9 | sign_in_audience = "AzureADMyOrg"
10 |
11 | # Define a custom URI identifier
12 | identifier_uris = [
13 | "urn://azure-gcp"
14 | ]
15 |
16 | # Configure an application role for access management
17 | app_role {
18 | id = uuidv5("url", var.prefix)
19 | value = var.prefix
20 | description = "${var.prefix} app_role description ${random_string.random_suffix.result}"
21 | display_name = "Connect-To-GCP"
22 | allowed_member_types = ["User", "Application"]
23 | enabled = true
24 | }
25 | }
26 |
27 | # Create a service principal for the Azure AD application
28 | resource "azuread_service_principal" "demo" {
29 | depends_on = [azuread_application.demo]
30 | client_id = azuread_application.demo.client_id
31 |
32 | # Define tags to manage the visibility and integration settings of the service principal
33 | tags = [
34 | "WindowsAzureActiveDirectoryIntegratedApp",
35 | "HideApp",
36 | ]
37 | }
38 |
39 | # Provision an Azure resource group in the specified location
40 | resource "azurerm_resource_group" "demo" {
41 | name = "${var.prefix}-resources-${random_string.random_suffix.result}"
42 | location = "East US"
43 | }
44 |
45 | # Create a user-assigned managed identity within the provisioned resource group
46 | resource "azurerm_user_assigned_identity" "demo" {
47 | depends_on = [azurerm_resource_group.demo]
48 | name = "${var.prefix}-identity-${random_string.random_suffix.result}"
49 | resource_group_name = azurerm_resource_group.demo.name
50 | location = azurerm_resource_group.demo.location
51 | }
52 |
53 | # Retrieve a TLS certificate from Azure AD's well-known configuration URL
54 | data "tls_certificate" "azure" {
55 | url = "https://sts.windows.net/${data.azuread_client_config.current.tenant_id}/.well-known/openid-configuration"
56 | }
57 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->gcp/gcp.tf:
--------------------------------------------------------------------------------
1 | # Data source to retrieve the current GCP project details
2 | data "google_project" "project" {
3 | }
4 |
5 | # Create a Workload Identity Pool in Google IAM for Azure workload federation
6 | resource "google_iam_workload_identity_pool" "avi_azure_pool" {
7 | workload_identity_pool_id = "${var.prefix}-pool-id-${random_string.random_suffix.result}"
8 | display_name = "${var.prefix}-pool-display-${random_string.random_suffix.result}"
9 | description = "azure workload federation"
10 | }
11 |
12 | # Create a provider within the Workload Identity Pool for Azure
13 | resource "google_iam_workload_identity_pool_provider" "avi_azure_provider" {
14 | depends_on = [google_iam_workload_identity_pool.avi_azure_pool]
15 | workload_identity_pool_id = google_iam_workload_identity_pool.avi_azure_pool.workload_identity_pool_id
16 | workload_identity_pool_provider_id = "${var.prefix}-provider-id-${random_string.random_suffix.result}"
17 | display_name = "${var.prefix}-provider-${random_string.random_suffix.result}"
18 |
19 | oidc {
20 | issuer_uri = "https://sts.windows.net/${data.azuread_client_config.current.tenant_id}/"
21 | allowed_audiences = tolist(azuread_application.demo.identifier_uris)
22 | }
23 |
24 | attribute_mapping = {
25 | "google.subject" = "assertion.sub"
26 | }
27 | }
28 |
29 | # Define a Google service account for Workload Identity
30 | resource "google_service_account" "wi_azure" {
31 | account_id = "${var.prefix}-wi-gcp-${random_string.random_suffix.result}"
32 | display_name = "${var.prefix}-Workload Identity GCP-${random_string.random_suffix.result}"
33 | }
34 |
35 | # Bind roles to the service account based on Workload Identity
36 | resource "google_service_account_iam_member" "wi_azure_binding" {
37 | depends_on = [google_service_account.wi_azure, google_iam_workload_identity_pool.avi_azure_pool]
38 | service_account_id = google_service_account.wi_azure.name
39 | role = "roles/iam.workloadIdentityUser"
40 | member = "principalSet://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.avi_azure_pool.workload_identity_pool_id}/*"
41 |
42 | condition {
43 | title = "Bind specific identity"
44 | description = "Only apply this to identities with a specific assertion.sub claim i.e service account unique identifier"
45 | expression = "true"
46 | }
47 | }
48 |
49 | # Set roles for the Google service account
50 | locals {
51 | roles = {
52 | "viewer" = "roles/viewer",
53 | }
54 | }
55 |
56 | # Dynamically assign predefined roles to the Google service account
57 | resource "google_project_iam_member" "wi_azure_binding" {
58 | for_each = local.roles
59 | depends_on = [google_service_account.wi_azure]
60 | project = var.gcp_project_name
61 | role = each.value
62 | member = "serviceAccount:${google_service_account.wi_azure.email}"
63 | }
64 |
65 | # Provision credentials for integration between Google Cloud and Azure
66 | # For this demo, this credentials file will be copied to azure vm instance
67 | # and vm will connect to Google Cloud using this file.
68 | resource "null_resource" "create_cred_config" {
69 | depends_on = [
70 | google_service_account.wi_azure,
71 | google_iam_workload_identity_pool.avi_azure_pool,
72 | google_iam_workload_identity_pool_provider.avi_azure_provider,
73 | azuread_application.demo,
74 | random_string.random_suffix
75 | ]
76 | triggers = {
77 | always_run = timestamp()
78 | gcp_cred_config = "gcp-${random_string.random_suffix.result}.json"
79 | }
80 |
81 | provisioner "local-exec" {
82 | when = create
83 | command = <gcp/outputs.tf:
--------------------------------------------------------------------------------
1 | # Output the SSH command required to connect to the deployed Azure Linux VM
2 | output "ssh_command" {
3 | # Ensure this output waits for the virtual machine and related resources to be created
4 | depends_on = [
5 | azurerm_linux_virtual_machine.demo,
6 | null_resource.copy_gcp_cred_file_to_azure_vm,
7 | null_resource.create_cred_config
8 | ]
9 |
10 | # Formulate the SSH command using dynamic values from the deployment
11 | value = "ssh -i ${local_file.private_key_file.filename} ${azurerm_linux_virtual_machine.demo.admin_username}@${azurerm_linux_virtual_machine.demo.public_ip_address}"
12 | }
13 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->gcp/providers.tf:
--------------------------------------------------------------------------------
1 | # Define required Terraform version and provider dependencies
2 | terraform {
3 | required_providers {
4 | google = {
5 | source = "hashicorp/google" # Google Cloud provider
6 | version = "5.29.1"
7 | }
8 | tls = {
9 | source = "hashicorp/tls" # TLS provider for cryptographic functions
10 | version = "4.0.5"
11 | }
12 | local = {
13 | source = "hashicorp/local" # Local provider for managing local files
14 | version = "2.5.1"
15 | }
16 | azuread = {
17 | source = "hashicorp/azuread" # Azure Active Directory provider
18 | version = "2.50.0"
19 | }
20 | random = {
21 | source = "hashicorp/random" # Random provider for generating random values
22 | version = "3.6.1"
23 | }
24 | null = {
25 | source = "hashicorp/null" # Null provider for implementing utilities
26 | version = "3.2.2"
27 | }
28 | azurerm = {
29 | source = "hashicorp/azurerm" # Azure Resource Manager provider
30 | version = "3.104.0"
31 | }
32 | }
33 | }
34 |
35 | # Azure Active Directory Provider configuration
36 | provider "azuread" {
37 | # No specific configuration options are set here.
38 | }
39 |
40 | # Azure Resource Manager Provider configuration
41 | provider "azurerm" {
42 | # Placeholder for future configurations; currently, no specific features are configured.
43 | features {}
44 | }
45 |
46 | # Local Provider configuration
47 | provider "local" {
48 | # This provider typically requires no specific configuration.
49 | }
50 |
51 | # Google Cloud Provider configuration, setting the project based on input variables
52 | provider "google" {
53 | project = var.gcp_project_name # Dynamic assignment of the Google Cloud project name
54 | }
55 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->gcp/tpl/azure-vm-init-script.yaml.tpl:
--------------------------------------------------------------------------------
1 | #cloud-config
2 | write_files:
3 | - path: /etc/profile.d/set_env_vars.sh
4 | content: |
5 | echo "Installing some pre-requisites"
6 | sudo snap install google-cloud-cli --classic
7 | echo "Running 'gcloud auth login --cred-file=/home/${admin_username}/gcp.json'"
8 | gcloud auth login --cred-file=/home/${admin_username}/gcp.json
9 | echo "Running 'gcloud config set project ${gcp_project_name}'"
10 | gcloud config set project ${gcp_project_name}
11 | echo "Fetching permissions of associated IAM account"
12 | echo "Running 'gcloud iam service-accounts get-iam-policy $(gcloud auth list --format="value(account)")'"
13 | gcloud iam service-accounts get-iam-policy $(gcloud auth list --format="value(account)")
14 |
--------------------------------------------------------------------------------
/cross-cloud-integration/azure->gcp/variables.tf:
--------------------------------------------------------------------------------
1 | # Variable declaration for the Google Cloud project name
2 | # This is crucial for directing where resources should be provisioned within GCP
3 | variable "gcp_project_name" {
4 | type = string
5 | nullable = false # Ensures that a GCP project name must be specified
6 | }
7 |
8 | # Variable declaration for a prefix used in naming resources
9 | # This prefix is used to distinguish resources related to the Azure to GCP integration
10 | variable "prefix" {
11 | type = string
12 | default = "azure-to-gcp" # Default value for the prefix
13 | nullable = false # Ensures that the prefix must always have a value
14 | }
15 |
16 | # Resource to generate a random string used as a suffix in resource names
17 | # This helps ensure that resource names are unique and avoid conflicts
18 | resource "random_string" "random_suffix" {
19 | length = 5 # Length of the random string
20 | special = false # Exclude special characters to simplify usage
21 | upper = false # Use only lowercase letters for consistency
22 | }
23 |
24 | # Variable for specifying the default administrator username
25 | # Used in configurations where a username is necessary, like VM provisioning
26 | variable "admin_username" {
27 | default = "azureuser" # Provides a default username, which can be overridden as needed
28 | }
29 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->aws/README.md:
--------------------------------------------------------------------------------
1 | # GCP to AWS
2 |
3 | 
4 |
5 | ## Demo
6 |
7 | [](https://asciinema.org/a/ruwALuA0mTWh3Qtsj8IemfnOx)
8 |
9 | ## Setup
10 |
11 | Ensure you are logged into both GCP & AWS systems from your CLI before executing below terraform commands.
12 |
13 | ### Verify GCP
14 |
15 | ```
16 | gcloud auth login
17 | gcloud auth application-default login
18 | ```
19 |
20 | List projects and choose one.
21 |
22 | ```
23 | gcloud projects list
24 | gcloud config set project
25 | ```
26 |
27 | ```
28 | gcloud config list
29 | ```
30 |
31 | ### Verify AWS
32 |
33 | ```
34 | aws sts get-caller-identity
35 | ```
36 |
37 | ### Integration
38 |
39 | Connect to AWS systems from GCP Cloud. In this example, we will use GCP VM to connect with AWS resources.
40 |
41 | ```
42 | export GCP_PROJECT_NAME=$(gcloud config list --format="value(core.project)")
43 | terraform init
44 | terraform plan -var gcp_project_name=$GCP_PROJECT_NAME
45 | terraform apply -var gcp_project_name=$GCP_PROJECT_NAME
46 | ```
47 |
48 | Post `terraform apply`, copy the ssh command from the output and login to the GCP VM.
49 |
50 | 1. Some pre-requisities will be installed
51 | 2. Connectivity to the AWS systems will be established
52 | 3. Test it by running, `aws sts get-caller-identity`
53 |
54 | #### NOTE
55 |
56 | It's observed sometimes, GCP VMs aren't executing the scripts in `/etc/profile.d/` on first ssh login. If that happens with you, there are two ways to fix it.
57 |
58 | 1. Exit the shell and run the `gcloud ssh` command again.
59 | 2. Manually, run the script that will configure the shell to connect with AWS services - `bash /etc/profile.d/set_env_vars.sh`
60 |
61 | ### Destroy resources
62 |
63 | ```
64 | terraform destroy -var gcp_project_name=$GCP_PROJECT_NAME
65 | ```
66 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->aws/aws.tf:
--------------------------------------------------------------------------------
1 | # Resource to create an AWS IAM role for a demo application
2 | # The role is configured to allow identity federation with Google Cloud's service account
3 | resource "aws_iam_role" "demo_role" {
4 | depends_on = [
5 | random_string.random_suffix,
6 | google_service_account.demo,
7 | ]
8 | name = "${var.prefix}-demo-role-${random_string.random_suffix.result}" # Dynamic name based on provided prefix and a random suffix
9 |
10 | # Assume role policy that allows Google's federated accounts to assume this role
11 | assume_role_policy = jsonencode({
12 | Version = "2012-10-17"
13 | Statement = [{
14 | Effect = "Allow"
15 | Principal = {
16 | Federated = "accounts.google.com"
17 | }
18 | Action = "sts:AssumeRoleWithWebIdentity"
19 | Condition = {
20 | StringEquals = {
21 | "accounts.google.com:aud" = "${google_service_account.demo.unique_id}" # Only allow if the audience matches the Google service account's unique ID
22 | }
23 | }
24 | }]
25 | })
26 | }
27 |
28 | # Attach a predefined Amazon S3 ReadOnly policy to the previously defined AWS IAM role
29 | resource "aws_iam_role_policy_attachment" "s3_readonly_policy" {
30 | depends_on = [aws_iam_role.demo_role]
31 | role = aws_iam_role.demo_role.name # Reference to the IAM role
32 | policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess" # ARN for Amazon S3 ReadOnly Access policy
33 | }
34 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->aws/gcp-vm.tf:
--------------------------------------------------------------------------------
1 | # Resource to generate a private SSH key using the TLS provider
2 | resource "tls_private_key" "example_ssh_key" {
3 | algorithm = "RSA"
4 | rsa_bits = 2048
5 | }
6 |
7 | # Create a file to store the generated private SSH key
8 | resource "local_file" "private_key_file" {
9 | depends_on = [tls_private_key.example_ssh_key]
10 | content = tls_private_key.example_ssh_key.private_key_pem
11 | filename = "${path.module}/demo_instance_ssh_key.pem"
12 | file_permission = "0400"
13 | }
14 |
15 | # Create a file to store the public SSH key
16 | resource "local_file" "public_key_file" {
17 | depends_on = [tls_private_key.example_ssh_key]
18 | content = tls_private_key.example_ssh_key.public_key_pem
19 | filename = "${path.module}/demo_instance_ssh_key.pem.pub"
20 | file_permission = "0400"
21 | }
22 |
23 | # Deploy a Google Compute Instance with a configured machine type and zone
24 | resource "google_compute_instance" "demo_instance" {
25 | depends_on = [random_string.random_suffix]
26 | name = "${var.prefix}-demo-instance-${random_string.random_suffix.result}"
27 | machine_type = "e2-medium"
28 | zone = "us-central1-a"
29 |
30 | # Define the boot disk image for the instance
31 | boot_disk {
32 | initialize_params {
33 | image = "debian-cloud/debian-10"
34 | }
35 | }
36 |
37 | # Setup the network interface and external access
38 | network_interface {
39 | network = "default"
40 | access_config {}
41 | }
42 |
43 | # Configure the service account and scopes for the instance
44 | service_account {
45 | email = google_service_account.demo.email
46 | scopes = ["cloud-platform"]
47 | }
48 |
49 | # Startup script to configure AWS CLI and assume an AWS role via the federated token
50 | metadata_startup_script = templatefile("${path.module}/tpl/gcp-metadata-startup-script.sh.tpl", {
51 | aws_iam_role_arn = aws_iam_role.demo_role.arn
52 | })
53 |
54 | # Attach the public SSH key to the instance for the specified admin user
55 | metadata = {
56 | ssh-keys = "${var.gcp_vm_admin_user}:${tls_private_key.example_ssh_key.public_key_openssh}"
57 | }
58 | }
59 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->aws/gcp.tf:
--------------------------------------------------------------------------------
1 | # Resource to create a Google Cloud service account
2 | resource "google_service_account" "demo" {
3 | depends_on = [random_string.random_suffix]
4 | account_id = "${var.prefix}-demo-${random_string.random_suffix.result}" # Construct account ID using a prefix and a random suffix
5 | display_name = "demo Service Account" # User-friendly name for the service account
6 | }
7 |
8 | # Assign the 'serviceAccountTokenCreator' role to the newly created service account
9 | resource "google_project_iam_member" "service_account_token_creator" {
10 | depends_on = [google_service_account.demo]
11 | project = var.gcp_project_name # Specify the GCP project where the IAM role should be assigned
12 | role = "roles/iam.serviceAccountTokenCreator" # IAM role to assign
13 | member = "serviceAccount:${google_service_account.demo.email}" # Construct the member identifier using the service account's email
14 | }
15 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->aws/outputs.tf:
--------------------------------------------------------------------------------
1 | # Output the SSH login command for the Google Compute Instance
2 | output "gcp_ssh_login_command" {
3 | depends_on = [
4 | google_compute_instance.demo_instance,
5 | local_file.private_key_file,
6 | ]
7 | value = "gcloud compute ssh --zone ${google_compute_instance.demo_instance.zone} --project ${var.gcp_project_name} --ssh-key-file ${local_file.private_key_file.filename} ${var.gcp_vm_admin_user}@${google_compute_instance.demo_instance.name}"
8 | # This command utilizes gcloud to establish an SSH connection using the generated private key file.
9 | # It specifies the admin user, project, and zone to ensure the command can be executed without requiring additional inputs.
10 | }
11 |
12 | # Output the command to be manually run after SSHing into the instance
13 | output "manual_operation" {
14 | depends_on = [
15 | google_compute_instance.demo_instance,
16 | local_file.private_key_file,
17 | ]
18 | value = "Post SSH run, 'bash /etc/profile.d/set_env_vars.sh'"
19 | # This output suggests a manual operation to execute the script that configures AWS credentials via the environment.
20 | # The script sets up AWS environment variables based on a federated identity, enabling AWS CLI operations.
21 | }
22 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->aws/providers.tf:
--------------------------------------------------------------------------------
1 | # Terraform configuration block specifying required providers and their versions
2 | terraform {
3 | required_providers {
4 | google = {
5 | source = "hashicorp/google"
6 | version = "5.29.1"
7 | }
8 | tls = {
9 | source = "hashicorp/tls"
10 | version = "4.0.5"
11 | }
12 | local = {
13 | source = "hashicorp/local"
14 | version = "2.5.1"
15 | }
16 | random = {
17 | source = "hashicorp/random"
18 | version = "3.6.2"
19 | }
20 | aws = {
21 | source = "hashicorp/aws"
22 | version = "5.50.0"
23 | }
24 | }
25 | }
26 |
27 | # Configuration for the Local provider, typically used for managing local files
28 | provider "local" {
29 | # No specific configurations are necessary here.
30 | }
31 |
32 | # Configuration for the AWS provider, used for managing AWS resources
33 | provider "aws" {
34 | # Region or other configurations can be added here if needed.
35 | }
36 |
37 | # Configuration for the Google Cloud provider, including specifying the project
38 | provider "google" {
39 | project = var.gcp_project_name # Dynamic assignment of the Google Cloud project from a variable
40 | }
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->aws/tpl/gcp-metadata-startup-script.sh.tpl:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | # Create and write the set_env_vars.sh script to the /etc/profile.d directory
3 | sudo tee /etc/profile.d/set_env_vars.sh << 'EOT'
4 | # Update package listings and install AWS CLI and jq
5 | sudo apt update
6 | sudo apt -y install awscli jq
7 |
8 | # Export the AWS IAM Role ARN environment variable for use in the script
9 | export AWS_ROLE_ARN=${aws_iam_role_arn}
10 |
11 | # Fetch the Google Cloud identity token for the default service account
12 | token=$(curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?format=standard&audience=gcp")
13 |
14 | # Use AWS STS to assume the specified role using the fetched token and parse the credentials using jq
15 | response=$(aws sts assume-role-with-web-identity --role-arn "$AWS_ROLE_ARN" --role-session-name "whatever" --web-identity-token "$token" --output json)
16 | export AWS_ACCESS_KEY_ID=$(echo "$response" | jq -r '.Credentials.AccessKeyId')
17 | export AWS_SECRET_ACCESS_KEY=$(echo "$response" | jq -r '.Credentials.SecretAccessKey')
18 | export AWS_SESSION_TOKEN=$(echo "$response" | jq -r '.Credentials.SessionToken')
19 |
20 | # Confirmation messages to verify successful configuration
21 | echo "Configured the VM to connect with AWS. To test:"
22 | echo "aws sts get-caller-identity"
23 | aws sts get-caller-identity
24 | EOT
25 |
26 | # Make the script executable
27 | chmod +x /etc/profile.d/set_env_vars.sh
28 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->aws/variables.tf:
--------------------------------------------------------------------------------
1 | # Variable declaration for specifying the Google Cloud project name.
2 | # This variable must be set as it is not nullable, ensuring that a project is always specified.
3 | variable "gcp_project_name" {
4 | type = string
5 | nullable = false # Ensures that the project name must be provided
6 | }
7 |
8 | # Variable declaration for a prefix used to name resources.
9 | # A default value is provided, which can be overridden as needed.
10 | variable "prefix" {
11 | type = string
12 | default = "gcp-to-aws" # Default prefix used for naming resources, can be overridden
13 | }
14 |
15 | # Resource for generating a random string to be used as a suffix in resource names.
16 | # This ensures uniqueness and prevents naming conflicts.
17 | resource "random_string" "random_suffix" {
18 | length = 5 # Specifies the length of the random string
19 | special = false # Indicates that special characters should not be included
20 | upper = false # Specifies that all characters should be lowercase
21 | }
22 |
23 | # Variable for specifying the administrator username for the virtual machine in GCP.
24 | # A default value is provided and the variable is not nullable.
25 | variable "gcp_vm_admin_user" {
26 | default = "gcpuser" # Default username for GCP virtual machine admin
27 | type = string
28 | nullable = false # Ensures that an admin username must be provided
29 | }
30 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->azure/README.md:
--------------------------------------------------------------------------------
1 | # GCP to Azure
2 |
3 | 
4 |
5 | ## Demo
6 |
7 | [](https://asciinema.org/a/Gwr3aeCvOtNvy0AfN3PEzXUye)
8 |
9 | ## Setup
10 |
11 | Ensure you are logged into both GCP & Azure systems from your CLI before executing below terraform commands.
12 |
13 | ### Verify GCP
14 |
15 | ```
16 | gcloud auth login
17 | gcloud auth application-default login
18 | ```
19 |
20 | List projects and choose one.
21 |
22 | ```
23 | gcloud projects list
24 | gcloud config set project
25 | ```
26 |
27 | ```
28 | gcloud config list
29 | ```
30 |
31 | ### Verify Azure
32 |
33 | ```
34 | az account show
35 | ```
36 |
37 | ### Integration
38 |
39 | Connect to Azure systems from GCP Cloud. In this example, we will use GCP VM to connect with Azure resources.
40 |
41 | ```
42 | export GCP_PROJECT_NAME=$(gcloud config list --format="value(core.project)")
43 | terraform init
44 | terraform plan -var gcp_project_name=$GCP_PROJECT_NAME
45 | terraform apply -var gcp_project_name=$GCP_PROJECT_NAME
46 | ```
47 |
48 | Post `terraform apply`, copy the ssh command from the output and login to the GCP VM.
49 |
50 | 1. Some pre-requisities will be installed
51 | 2. Connectivity to the Azure systems will be established
52 | 3. Test it by running the command shown.
53 |
54 | #### NOTE
55 |
56 | It's observed sometimes, GCP VMs aren't executing the scripts in `/etc/profile.d/` on first ssh login. If that happens with you, there are two ways to fix it.
57 |
58 | 1. Exit the shell and run the `gcloud ssh` command again.
59 | 2. Manually, run the script that will configure the shell to connect with Azure services - `bash /etc/profile.d/set_env_vars.sh`
60 |
61 | ### Destroy resources
62 |
63 | ```
64 | terraform destroy -var gcp_project_name=$GCP_PROJECT_NAME
65 | ```
66 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->azure/azure.tf:
--------------------------------------------------------------------------------
1 | # Data source to fetch current Azure client configuration
2 | data "azurerm_client_config" "current" {}
3 |
4 | # Data resource to fetch published app IDs for known applications (like Microsoft Graph)
5 | data "azuread_application_published_app_ids" "well_known" {}
6 |
7 | # Service principal data source for Microsoft Graph
8 | data "azuread_service_principal" "msgraph" {
9 | client_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
10 | }
11 |
12 | # Fetch all Azure AD service principals
13 | data "azuread_service_principals" "all" {
14 | return_all = true
15 | }
16 |
17 | # Resource to create an Azure AD Application with necessary permissions
18 | resource "azuread_application" "demo" {
19 | depends_on = [
20 | random_string.random_suffix,
21 | data.azuread_application_published_app_ids.well_known,
22 | data.azuread_service_principal.msgraph,
23 | ]
24 | display_name = "${var.prefix} Demo ${random_string.random_suffix.result}"
25 | sign_in_audience = "AzureADMyOrg"
26 |
27 | # Defining required access to specific Microsoft Graph APIs
28 | required_resource_access {
29 | resource_app_id = data.azuread_application_published_app_ids.well_known.result.MicrosoftGraph
30 |
31 | resource_access {
32 | id = data.azuread_service_principal.msgraph.app_role_ids["User.Read.All"]
33 | type = "Role"
34 | }
35 | resource_access {
36 | id = data.azuread_service_principal.msgraph.app_role_ids["Directory.Read.All"]
37 | type = "Role"
38 | }
39 | }
40 | }
41 |
42 | # Resource group in Azure to organize related resources
43 | resource "azurerm_resource_group" "demo" {
44 | depends_on = [
45 | random_string.random_suffix,
46 | ]
47 | name = "${var.prefix}-resource-group-${random_string.random_suffix.result}"
48 | location = var.resource_group_location
49 | }
50 |
51 | # Service principal for the Azure AD application
52 | resource "azuread_service_principal" "demo" {
53 | depends_on = [ azuread_application.demo ]
54 | client_id = azuread_application.demo.client_id
55 | }
56 |
57 | # Role assignment to give the service principal necessary permissions within the resource group
58 | resource "azurerm_role_assignment" "demo" {
59 | depends_on = [
60 | azurerm_resource_group.demo,
61 | azuread_service_principal.demo,
62 | ]
63 | scope = azurerm_resource_group.demo.id
64 | role_definition_name = "Contributor"
65 | principal_id = azuread_service_principal.demo.id
66 | }
67 |
68 | # Federated identity credential associated with the Azure AD application
69 | resource "azuread_application_federated_identity_credential" "demo" {
70 | depends_on = [
71 | azuread_application.demo,
72 | azurerm_role_assignment.demo,
73 | azuread_app_role_assignment.demo,
74 | random_string.random_suffix,
75 | google_service_account.demo,
76 | ]
77 | display_name = "${var.prefix}-demo-${random_string.random_suffix.result}"
78 | application_id = "/applications/${azuread_application.demo.object_id}"
79 | issuer = var.openid_connect_url
80 | subject = google_service_account.demo.unique_id
81 | description = "Demo federated identity credential for secure integration"
82 | audiences = [var.audience]
83 | }
84 |
85 | # Dynamic role assignment for the application based on required resource access
86 | resource "azuread_app_role_assignment" "demo" {
87 | depends_on = [
88 | azuread_application.demo,
89 | data.azuread_service_principals.all,
90 | azuread_service_principal.demo,
91 | azurerm_role_assignment.demo,
92 | ]
93 | for_each = { for v in flatten([
94 | for rra in azuread_application.demo.required_resource_access : [
95 | for ra in rra.resource_access : {
96 | resource_object_id = one([
97 | for sp in data.azuread_service_principals.all.service_principals :
98 | sp.object_id if sp.client_id == rra.resource_app_id
99 | ])
100 | app_role_id = ra.id
101 | }
102 | ]
103 | ]) : join("|", [v.resource_object_id, v.app_role_id]) => v }
104 |
105 | principal_object_id = azuread_service_principal.demo.object_id
106 | resource_object_id = each.value.resource_object_id
107 | app_role_id = each.value.app_role_id
108 | }
109 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->azure/gcp-vm.tf:
--------------------------------------------------------------------------------
1 | # Generate a private SSH key using the TLS provider
2 | resource "tls_private_key" "example_ssh_key" {
3 | algorithm = "RSA"
4 | rsa_bits = 2048
5 | # RSA algorithm is used for key generation with a length of 2048 bits for good security and performance balance
6 | }
7 |
8 | # Store the generated private SSH key in a local file
9 | resource "local_file" "private_key_file" {
10 | depends_on = [tls_private_key.example_ssh_key]
11 | content = tls_private_key.example_ssh_key.private_key_pem
12 | filename = "${path.module}/demo_instance_ssh_key.pem"
13 | file_permission = "0400" # Permissions set to read-only for the file owner for security
14 | }
15 |
16 | # Store the public SSH key in a local file
17 | resource "local_file" "public_key_file" {
18 | depends_on = [tls_private_key.example_ssh_key]
19 | content = tls_private_key.example_ssh_key.public_key_pem
20 | filename = "${path.module}/demo_instance_ssh_key.pem.pub"
21 | file_permission = "0400" # Permissions set to read-only for the file owner for security
22 | }
23 |
24 | # Create a Google Compute Instance with dependencies on Azure resources for demonstration purposes
25 | resource "google_compute_instance" "demo_instance" {
26 | depends_on = [
27 | azuread_application.demo,
28 | azurerm_role_assignment.demo,
29 | azuread_app_role_assignment.demo,
30 | random_string.random_suffix,
31 | google_service_account.demo,
32 | tls_private_key.example_ssh_key,
33 | data.azurerm_client_config.current,
34 | ]
35 | name = "${var.prefix}-demo-instance-${random_string.random_suffix.result}"
36 | machine_type = "e2-medium"
37 | zone = "us-central1-a"
38 |
39 | # Define the boot disk using a Debian 10 image
40 | boot_disk {
41 | initialize_params {
42 | image = "debian-cloud/debian-10"
43 | }
44 | }
45 |
46 | # Set up network interface with default network and allow external access
47 | network_interface {
48 | network = "default"
49 | access_config {}
50 | }
51 |
52 | # Assign a service account to the instance with permissions scoped to the entire cloud platform
53 | service_account {
54 | email = google_service_account.demo.email
55 | scopes = ["cloud-platform"]
56 | }
57 |
58 | # Metadata to attach the public SSH key to the instance for SSH access
59 | metadata = {
60 | ssh-keys = "${var.gcp_vm_admin_user}:${tls_private_key.example_ssh_key.public_key_openssh}"
61 | }
62 |
63 | # Startup script to install required tools, authenticate with Azure, and perform an API request
64 | metadata_startup_script = <<-EOF
65 | #! /bin/bash
66 | # Setup environment by installing Azure CLI and jq
67 | sudo tee /etc/profile.d/set_env_vars.sh << 'EOT'
68 | curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
69 | sudo apt -y install jq
70 | # Fetch token from GCP metadata service and use it to authenticate against Azure
71 | gcp_token=$(curl -H "Metadata-Flavor: Google" 'http://metadata/computeMetadata/v1/instance/service-accounts/default/identity?audience=${var.audience}')
72 | output=$(curl -X GET 'https://login.microsoftonline.com/${data.azurerm_client_config.current.tenant_id}/oauth2/v2.0/token' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'client_id=${azuread_application.demo.client_id}' --data-urlencode 'scope=https://graph.microsoft.com/.default' --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' --data-urlencode "client_assertion=$gcp_token" --data-urlencode 'grant_type=client_credentials')
73 | azure_access_token=$(echo $output | jq -r '.access_token')
74 | # Prepare a command to query Azure Service Principals using the Azure CLI
75 | command_to_run=$(echo "az rest --method GET --uri \"https://graph.microsoft.com/v1.0/servicePrincipals\" --skip-authorization-header --headers \"Authorization=Bearer \$azure_access_token\"")
76 | echo $command_to_run
77 | EOT
78 | EOF
79 | }
80 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->azure/gcp.tf:
--------------------------------------------------------------------------------
1 | # Resource to create a Google Cloud service account
2 | resource "google_service_account" "demo" {
3 | depends_on = [ random_string.random_suffix ]
4 | account_id = "${var.prefix}-demo-${random_string.random_suffix.result}" # Construct account ID using a prefix and a random suffix
5 | display_name = "Demo Service Account" # User-friendly name for the service account
6 | }
7 |
8 | resource "google_project_iam_member" "service_account_token_creator" {
9 | depends_on = [ google_service_account.demo ]
10 | project = var.gcp_project_name # Specify the GCP project where the IAM role should be assigned
11 | role = "roles/iam.serviceAccountTokenCreator" # IAM role to assign
12 | member = "serviceAccount:${google_service_account.demo.email}" # Construct the member identifier using the service account's email
13 | }
14 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->azure/outputs.tf:
--------------------------------------------------------------------------------
1 | # Output the SSH login command for the Google Compute Instance
2 | output "gcp_ssh_login_command" {
3 | depends_on = [
4 | google_compute_instance.demo_instance,
5 | local_file.private_key_file,
6 | ]
7 | value = "gcloud compute ssh --zone ${google_compute_instance.demo_instance.zone} --project ${var.gcp_project_name} --ssh-key-file ${local_file.private_key_file.filename} ${var.gcp_vm_admin_user}@${google_compute_instance.demo_instance.name}"
8 | # This command utilizes gcloud to establish an SSH connection using the generated private key file.
9 | # It specifies the admin user, project, and zone to ensure the command can be executed without requiring additional inputs.
10 | }
11 |
12 | # Output the command to be manually run after SSHing into the instance
13 | output "manual_operation" {
14 | depends_on = [
15 | google_compute_instance.demo_instance,
16 | local_file.private_key_file,
17 | ]
18 | value = "Post SSH run, 'bash /etc/profile.d/set_env_vars.sh'"
19 | # This output suggests a manual operation to execute the script that configures AWS credentials via the environment.
20 | # The script sets up AWS environment variables based on a federated identity, enabling AWS CLI operations.
21 | }
22 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->azure/providers.tf:
--------------------------------------------------------------------------------
1 | # Terraform configuration specifying required providers and their versions
2 | terraform {
3 | required_providers {
4 | azuread = {
5 | source = "hashicorp/azuread"
6 | version = "2.49.0" # Specified version to match previously installed version
7 | }
8 | azurerm = {
9 | source = "hashicorp/azurerm"
10 | version = "3.103.1" # Specified version to match previously installed version
11 | }
12 | random = {
13 | source = "hashicorp/random"
14 | version = "3.6.1" # Specified version to match previously installed version
15 | }
16 | tls = {
17 | source = "hashicorp/tls"
18 | version = "4.0.5" # Latest version used as per previously installed information
19 | }
20 | local = {
21 | source = "hashicorp/local"
22 | version = "2.5.1" # Latest version used as per previously installed information
23 | }
24 | google = {
25 | source = "hashicorp/google"
26 | version = "5.31.1" # Latest version used as per previously installed information
27 | }
28 | }
29 | }
30 |
31 |
32 | # Configuration for the Google Cloud provider
33 | provider "google" {
34 | project = var.gcp_project_name # Dynamically assigns the Google Cloud project from a variable
35 | }
36 |
37 | # Configuration for the Local provider
38 | provider "local" {
39 | # This provider manages local files and directories
40 | }
41 |
42 | # Azure AD provider configuration
43 | provider "azuread" {
44 | # Using default configurations, no specific parameters set
45 | }
46 |
47 | # Azure RM (Resource Manager) provider configuration
48 | provider "azurerm" {
49 | features {} # Required block, even when no features are explicitly enabled
50 | }
51 |
--------------------------------------------------------------------------------
/cross-cloud-integration/gcp->azure/variables.tf:
--------------------------------------------------------------------------------
1 | # Variable declaration for specifying the Google Cloud project name.
2 | # This is a mandatory setting as the variable is not nullable, ensuring that a project name is always provided.
3 | variable "gcp_project_name" {
4 | type = string
5 | nullable = false # Ensures that the project name is explicitly specified for deployments
6 | }
7 |
8 | # Variable for specifying the administrator username for the virtual machine in GCP.
9 | # A default value is provided, and the variable is not nullable to ensure a username is always specified.
10 | variable "gcp_vm_admin_user" {
11 | default = "gcpuser" # Default username for GCP virtual machine admin
12 | type = string
13 | nullable = false # Prevents omitting the admin username to ensure deployment consistency
14 | }
15 |
16 | # Variable declaration for a prefix used to name resources.
17 | # A default value is provided which can be overridden, useful for distinguishing environments or deployments.
18 | variable "prefix" {
19 | type = string
20 | default = "gcp-to-azure" # Serves as a default prefix for resource naming, can be customized
21 | }
22 |
23 | # Resource definition for generating a random string which acts as a suffix for resource names.
24 | # This ensures resource names are unique and avoids naming conflicts across deployments.
25 | resource "random_string" "random_suffix" {
26 | length = 5 # Length of the random string
27 | special = false # Excludes special characters for simplicity
28 | upper = false # Ensures all characters are lowercase to maintain uniformity
29 | }
30 |
31 | # Variable to specify the OpenID Connect issuer URL used for federated identity.
32 | # This setting is crucial for configurations involving identity federation with GCP.
33 | variable "openid_connect_url" {
34 | type = string
35 | default = "https://accounts.google.com"
36 | nullable = false # Ensures that an issuer URL is always defined
37 | }
38 |
39 | # Variable for specifying the location of Azure resource groups.
40 | # A default value is provided, ensuring deployments are consistently located unless overridden.
41 | variable "resource_group_location" {
42 | type = string
43 | default = "East US" # Default location for resource groups, can be customized
44 | nullable = false # Ensures that a location is always specified for resource groups
45 | }
46 |
47 | # Variable for defining an audience URI used in configurations like OAuth2 token issuance.
48 | # This helps in specifying the intended recipient or authorized party for tokens.
49 | variable "audience" {
50 | default = "urn://gcp-azure" # Default audience URI for OAuth2 scenarios
51 | type = string
52 | }
53 |
--------------------------------------------------------------------------------
/cross-cloud-integration/images/aws-to-azure-integration.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clutchsecurity/federator/ec99d92d0b3b4877992bfc4beddac326292aaa2d/cross-cloud-integration/images/aws-to-azure-integration.png
--------------------------------------------------------------------------------
/cross-cloud-integration/images/aws-to-gcp-integration.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clutchsecurity/federator/ec99d92d0b3b4877992bfc4beddac326292aaa2d/cross-cloud-integration/images/aws-to-gcp-integration.png
--------------------------------------------------------------------------------
/cross-cloud-integration/images/azure-to-aws-integration.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clutchsecurity/federator/ec99d92d0b3b4877992bfc4beddac326292aaa2d/cross-cloud-integration/images/azure-to-aws-integration.png
--------------------------------------------------------------------------------
/cross-cloud-integration/images/azure-to-gcp-integration.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clutchsecurity/federator/ec99d92d0b3b4877992bfc4beddac326292aaa2d/cross-cloud-integration/images/azure-to-gcp-integration.png
--------------------------------------------------------------------------------
/cross-cloud-integration/images/gcp-to-aws-integration.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clutchsecurity/federator/ec99d92d0b3b4877992bfc4beddac326292aaa2d/cross-cloud-integration/images/gcp-to-aws-integration.png
--------------------------------------------------------------------------------
/cross-cloud-integration/images/gcp-to-azure-integration.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/clutchsecurity/federator/ec99d92d0b3b4877992bfc4beddac326292aaa2d/cross-cloud-integration/images/gcp-to-azure-integration.png
--------------------------------------------------------------------------------
/github-actions-integration/aws/0_variables.tf:
--------------------------------------------------------------------------------
1 | variable "openid_connect_url" {
2 | type = string
3 | default = "https://token.actions.githubusercontent.com"
4 | nullable = false
5 | }
6 |
7 | variable "client_id_list" {
8 | type = list(string)
9 | default = [
10 | "sts.amazonaws.com",
11 | ]
12 | nullable = false
13 | }
14 |
15 | variable "github_username" {
16 | type = string
17 | validation {
18 | condition = can(regex("^[a-zA-Z0-9]+$", var.github_username))
19 | error_message = "The github username must be alphanumeric and contain no special characters"
20 | }
21 | validation {
22 | condition = length(var.github_username) > 0
23 | error_message = "The github_username cannot be empty"
24 | }
25 | nullable = false
26 | }
27 |
28 | variable "github_repo_name" {
29 | type = string
30 | validation {
31 | condition = length(var.github_repo_name) > 0
32 | error_message = "The github_repo_name cannot be empty"
33 | }
34 | nullable = false
35 | }
36 |
37 | variable "role_session_name" {
38 | type = string
39 | default = "Terraform-Github-OIDC-AWS"
40 | nullable = false
41 | }
42 |
43 | variable "aws_region" {
44 | type = string
45 | default = "us-east-1"
46 | nullable = false
47 | }
48 |
49 | variable "github_pat" {
50 | type = string
51 | validation {
52 | condition = length(var.github_pat) > 0
53 | error_message = "The github_pat cannot be empty"
54 | }
55 | sensitive = true
56 | }
57 |
--------------------------------------------------------------------------------
/github-actions-integration/aws/1_idpfingerprint.tf:
--------------------------------------------------------------------------------
1 | # provider "idpfingerprint" {
2 |
3 | # }
4 |
5 | data "idpfingerprint" "default" {
6 | idp_url = "${var.openid_connect_url}/.well-known/openid-configuration"
7 | }
8 |
9 | # output "idp_fingerprint" {
10 | # value = data.idpfingerprint.default
11 | # }
12 |
--------------------------------------------------------------------------------
/github-actions-integration/aws/2_aws_oidc_provider.tf:
--------------------------------------------------------------------------------
1 | resource "aws_iam_openid_connect_provider" "default" {
2 |
3 | # wait to get the fingerprint
4 | depends_on = [ data.idpfingerprint.default ]
5 |
6 | # provider url
7 | url = var.openid_connect_url
8 |
9 | # audience
10 | client_id_list = var.client_id_list
11 |
12 | # thumbprint list for given url
13 | thumbprint_list = [
14 | data.idpfingerprint.default.fingerprint,
15 | ]
16 | }
17 |
--------------------------------------------------------------------------------
/github-actions-integration/aws/3_aws_oidc_role.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | // Load and format the trust policy from the template file
3 | trust_policy = templatefile("${path.module}/tpl/trust-policy-for-github-OIDC.json.tpl", {
4 | oidc_arn = aws_iam_openid_connect_provider.default.arn
5 | domain = data.idpfingerprint.default.domain
6 | github_username = var.github_username
7 | audience = jsonencode(var.client_id_list)
8 | })
9 | }
10 |
11 | resource "aws_iam_role" "github_action" {
12 | depends_on = [ aws_iam_openid_connect_provider.default ]
13 | name = "GitHubAction-AssumeRoleWithAction-Terraform"
14 | assume_role_policy = local.trust_policy
15 | }
16 |
17 |
--------------------------------------------------------------------------------
/github-actions-integration/aws/4_github_actions_secret.tf:
--------------------------------------------------------------------------------
1 | resource "github_actions_secret" "oidc_role_arn_secret" {
2 | depends_on = [aws_iam_role.github_action]
3 | repository = var.github_repo_name
4 | secret_name = "OIDC_ROLE_ARN"
5 | plaintext_value = aws_iam_role.github_action.arn
6 | }
7 |
8 |
--------------------------------------------------------------------------------
/github-actions-integration/aws/5_github_actions_commit.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | // Load and format the trust policy from the template file
3 | github_action_content = templatefile("${path.module}/tpl/github-actions-workflow.yml.tpl", {
4 | oidc_role_arn_secret_name = github_actions_secret.oidc_role_arn_secret.secret_name
5 | role_session_name = var.role_session_name
6 | aws_region = var.aws_region
7 | })
8 | }
9 |
10 | resource "random_string" "github_actions_workflow_filename" {
11 | length = 8
12 | special = false
13 | upper = false
14 | }
15 |
16 | resource "github_repository_file" "github_actions_workflow" {
17 | depends_on = [ github_actions_secret.oidc_role_arn_secret ]
18 | repository = var.github_repo_name
19 | branch = "main"
20 | file = format(".github/workflows/aws-%s.yml", random_string.github_actions_workflow_filename.result)
21 | content = local.github_action_content
22 | commit_message = "Committed AWS with love from Terraform"
23 | }
24 |
25 |
--------------------------------------------------------------------------------
/github-actions-integration/aws/README.md:
--------------------------------------------------------------------------------
1 | # AWS OIDC Github Actions Integration
2 |
3 | ```
4 |
5 | cd terraform-provider-idpfingerprint
6 | go build -o terraform-provider-idpfingerprint .
7 | cd ..
8 |
9 | # Uncomment `1_idpfingerprint.tf` file
10 | # Uncomment `idpfingerprint` block in `required_providers` in `providers.tf`
11 | terraform init
12 |
13 | TF_CLI_CONFIG_FILE=./terraform.rc terraform plan -var-file input.tfvars
14 | TF_CLI_CONFIG_FILE=./terraform.rc terraform apply -var-file input.tfvars
15 | ```
--------------------------------------------------------------------------------
/github-actions-integration/aws/input.tfvars.example:
--------------------------------------------------------------------------------
1 | openid_connect_url = "https://token.actions.githubusercontent.com"
2 | client_id_list = [
3 | "sts.amazonaws.com",
4 | ]
5 | role_session_name = "Terraform-Github-OIDC-AWS"
6 | aws_region = "us-east-1"
7 |
8 | github_username = ""
9 | github_repo_name = ""
10 | github_pat = ""
11 |
--------------------------------------------------------------------------------
/github-actions-integration/aws/outputs.tf:
--------------------------------------------------------------------------------
1 | # output "aws_iam_openid_connect_provider_arn" {
2 | # value = aws_iam_openid_connect_provider.default.arn
3 | # }
4 |
5 | # output "aws_iam_role_arn" {
6 | # value = aws_iam_role.github_action.arn
7 | # }
8 |
9 | # # output "trust_policy" {
10 | # # value = local.trust_policy
11 | # # description = "The IAM role trust policy JSON"
12 | # # }
13 |
14 | # output "github_actions_secret_output" {
15 | # value = github_actions_secret.oidc_role_arn_secret.id
16 | # }
17 |
18 | # output "github_repository_details" {
19 | # value = [
20 | # github_repository_file.github_actions_workflow.file,
21 | # github_repository_file.github_actions_workflow.repository
22 | # ]
23 | # description = "Github repository details"
24 | # }
25 |
26 | output "check_status" {
27 | value = "Check https://github.com/${var.github_username}/${var.github_repo_name}/actions"
28 | }
29 |
--------------------------------------------------------------------------------
/github-actions-integration/aws/providers.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_providers {
3 | idpfingerprint = {
4 | source = "thelocalhost.com/terraform-custom-provider/idpfingerprint"
5 | }
6 | github = {
7 | source = "integrations/github"
8 | version = "6.2.1"
9 | }
10 | aws = {
11 | source = "hashicorp/aws"
12 | version = "5.49.0"
13 | }
14 | random = {
15 | source = "hashicorp/random"
16 | version = "3.6.1"
17 | }
18 | }
19 | }
20 |
21 | provider "github" {
22 | token = var.github_pat
23 | owner = var.github_username
24 | # organization =
25 | }
--------------------------------------------------------------------------------
/github-actions-integration/aws/tpl/github-actions-workflow.yml.tpl:
--------------------------------------------------------------------------------
1 | name: Connect to an AWS role from a GitHub repository
2 | on:
3 | push:
4 | branches: [ main ]
5 | pull_request:
6 | branches: [ main ]
7 | permissions:
8 | id-token: write
9 | contents: read
10 | jobs:
11 | AssumeRoleAndCallIdentity:
12 | runs-on: ubuntu-latest
13 | steps:
14 | - name: Git clone the repository
15 | uses: actions/checkout@v3
16 | - name: configure aws credentials
17 | uses: aws-actions/configure-aws-credentials@v1.7.0
18 | with:
19 | role-to-assume: $${{ secrets.${oidc_role_arn_secret_name} }}
20 | role-session-name: ${role_session_name}
21 | aws-region: ${aws_region}
22 | - name: Sts GetCallerIdentity
23 | run: |
24 | aws sts get-caller-identity
--------------------------------------------------------------------------------
/github-actions-integration/aws/tpl/trust-policy-for-github-OIDC.json.tpl:
--------------------------------------------------------------------------------
1 | {
2 | "Version": "2012-10-17",
3 | "Statement": [
4 | {
5 | "Effect": "Allow",
6 | "Principal": {
7 | "Federated": "${oidc_arn}"
8 | },
9 | "Action": "sts:AssumeRoleWithWebIdentity",
10 | "Condition": {
11 | "StringEquals": {
12 | "${domain}:aud": ${audience}
13 | },
14 | "StringLike": {
15 | "${domain}:sub": "repo:${github_username}/*"
16 | }
17 | }
18 | }
19 | ]
20 | }
21 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/0_variables.tf:
--------------------------------------------------------------------------------
1 | variable "openid_connect_url" {
2 | type = string
3 | default = "https://token.actions.githubusercontent.com"
4 | nullable = false
5 | }
6 |
7 | variable "github_username" {
8 | type = string
9 | validation {
10 | condition = can(regex("^[a-zA-Z0-9]+$", var.github_username))
11 | error_message = "The github username must be alphanumeric and contain no special characters"
12 | }
13 | validation {
14 | condition = length(var.github_username) > 0
15 | error_message = "The github_username cannot be empty"
16 | }
17 | nullable = false
18 | }
19 |
20 | variable "github_repo_name" {
21 | type = string
22 | validation {
23 | condition = length(var.github_repo_name) > 0
24 | error_message = "The github_repo_name cannot be empty"
25 | }
26 | nullable = false
27 | }
28 |
29 | variable "github_repo_branch" {
30 | type = string
31 | default = "main"
32 | validation {
33 | condition = length(var.github_repo_branch) > 0
34 | error_message = "The github_repo_branch cannot be empty"
35 | }
36 | nullable = false
37 | }
38 |
39 | # variable "role_session_name" {
40 | # type = string
41 | # default = "Terraform-Github-OIDC-AWS"
42 | # nullable = false
43 | # }
44 |
45 | variable "resource_group_location" {
46 | type = string
47 | default = "East US"
48 | nullable = false
49 | }
50 |
51 | variable "github_pat" {
52 | type = string
53 | validation {
54 | condition = length(var.github_pat) > 0
55 | error_message = "The github_pat cannot be empty"
56 | }
57 | sensitive = true
58 | }
59 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/1_application_registration.tf:
--------------------------------------------------------------------------------
1 | resource "azuread_application_registration" "my_app" {
2 | display_name = "myApp11"
3 | }
4 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/2_resource_group.tf:
--------------------------------------------------------------------------------
1 | resource "azurerm_resource_group" "my_resource_group" {
2 | name = "myResourceGroup"
3 | location = var.resource_group_location
4 | }
5 |
6 | data "azurerm_resource_group" "example" {
7 | depends_on = [ azurerm_resource_group.my_resource_group ]
8 | name = azurerm_resource_group.my_resource_group.name
9 | }
--------------------------------------------------------------------------------
/github-actions-integration/azure/3_service_principal.tf:
--------------------------------------------------------------------------------
1 | resource "azuread_service_principal" "my_sp" {
2 | depends_on = [ azuread_application_registration.my_app ]
3 | client_id = azuread_application_registration.my_app.client_id
4 | }
5 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/4_service_principal_resource_group_role_assignment.tf:
--------------------------------------------------------------------------------
1 | resource "azurerm_role_assignment" "example" {
2 | depends_on = [ azurerm_resource_group.my_resource_group, azuread_service_principal.my_sp ]
3 | scope = data.azurerm_resource_group.example.id
4 | role_definition_name = "Contributor"
5 | principal_id = azuread_service_principal.my_sp.id
6 | }
7 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/5_federated_identity_credential.tf:
--------------------------------------------------------------------------------
1 | resource "azuread_application_federated_identity_credential" "example" {
2 | depends_on = [ azuread_application_registration.my_app, azurerm_role_assignment.example ]
3 | display_name = "hwatever"
4 | application_id = "/applications/${azuread_application_registration.my_app.object_id}"
5 | # name = var.credential_name
6 | issuer = var.openid_connect_url
7 | subject = "repo:${var.github_username}/${var.github_repo_name}:ref:refs/heads/${var.github_repo_branch}"
8 | description = "Testing"
9 | audiences = ["api://AzureADTokenExchange"]
10 | }
11 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/6_client_config.tf:
--------------------------------------------------------------------------------
1 | data "azurerm_client_config" "current" {
2 | }
--------------------------------------------------------------------------------
/github-actions-integration/azure/7_github_actions_secret.tf:
--------------------------------------------------------------------------------
1 | resource "github_actions_secret" "azure_tenant_id" {
2 | depends_on = [data.azurerm_client_config.current]
3 | repository = var.github_repo_name
4 | secret_name = "AZURE_TENANT_ID"
5 | plaintext_value = data.azurerm_client_config.current.tenant_id
6 | }
7 |
8 | resource "github_actions_secret" "azure_subscription_id" {
9 | depends_on = [data.azurerm_client_config.current]
10 | repository = var.github_repo_name
11 | secret_name = "AZURE_SUBSCRIPTION_ID"
12 | plaintext_value = data.azurerm_client_config.current.subscription_id
13 | }
14 |
15 | resource "github_actions_secret" "azure_client_id" {
16 | depends_on = [azuread_application_registration.my_app]
17 | repository = var.github_repo_name
18 | secret_name = "AZURE_CLIENT_ID"
19 | plaintext_value = azuread_application_registration.my_app.client_id
20 | }
21 |
22 | # output "github_actions_secret_output" {
23 | # value = [
24 | # github_actions_secret.azure_client_id.plaintext_value,
25 | # github_actions_secret.azure_subscription_id.plaintext_value,
26 | # github_actions_secret.azure_tenant_id.plaintext_value
27 | # ]
28 | # sensitive = true
29 | # }
30 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/8_github_actions_commit.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | // Load and format the trust policy from the template file
3 | github_action_content = templatefile("${path.module}/tpl/azure-github-actions-workflow.yml.tpl", {
4 | client_id_secret_name = github_actions_secret.azure_client_id.secret_name
5 | tenant_id_secret_name = github_actions_secret.azure_tenant_id.secret_name
6 | subscription_id_secret_name = github_actions_secret.azure_subscription_id.secret_name
7 | })
8 | }
9 |
10 | resource "random_string" "github_actions_workflow_filename" {
11 | length = 8
12 | special = false
13 | }
14 |
15 | resource "github_repository_file" "foo" {
16 | depends_on = [ github_actions_secret.azure_subscription_id, github_actions_secret.azure_tenant_id, github_actions_secret.azure_client_id, azuread_application_federated_identity_credential.example ]
17 | repository = var.github_repo_name
18 | branch = "main"
19 | file = ".github/workflows/azure-${random_string.github_actions_workflow_filename.result}.yml"
20 | content = local.github_action_content
21 | commit_message = "Committed azure with love from Terraform"
22 | }
23 |
24 | output "github_repository_details" {
25 | value = [
26 | github_repository_file.foo.file,
27 | github_repository_file.foo.repository
28 | ]
29 | description = "Github repository details"
30 | }
--------------------------------------------------------------------------------
/github-actions-integration/azure/README.md:
--------------------------------------------------------------------------------
1 | # Azure OIDC Github Actions Integration
2 |
3 | ```
4 | terraform init
5 | terraform plan -var-file input.tfvars
6 | terraform apply -var-file input.tfvars
7 | ```
8 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/input.tfvars.example:
--------------------------------------------------------------------------------
1 | github_pat = ""
2 | github_username = ""
3 | github_repo_name = ""
4 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/outputs.tf:
--------------------------------------------------------------------------------
1 | # output "app_id" {
2 | # value = azuread_application_registration.my_app.application_id
3 | # }
4 |
5 | output "client_id" {
6 | value = azuread_application_registration.my_app.client_id
7 | }
8 |
9 | # output "object_id" {
10 | # value = azuread_application_registration.my_app.object_id
11 | # }
12 |
13 | # output "assigneeObjectId" {
14 | # value = azuread_service_principal.my_sp.id
15 | # }
16 |
17 | output "tenant_id" {
18 | value = data.azurerm_client_config.current.tenant_id
19 | }
20 |
21 | output "subscription_id" {
22 | value = data.azurerm_client_config.current.subscription_id
23 | }
24 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/providers.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_providers {
3 | azuread = {
4 | source = "hashicorp/azuread"
5 | version = "2.49.0"
6 | }
7 | azurerm = {
8 | source = "hashicorp/azurerm"
9 | version = "3.103.1"
10 | }
11 | github = {
12 | source = "integrations/github"
13 | version = "6.2.1"
14 | }
15 | random = {
16 | source = "hashicorp/random"
17 | version = "3.6.1"
18 | }
19 | }
20 | }
21 |
22 | provider "azuread" {}
23 |
24 | provider "azurerm" {
25 | features {}
26 | }
27 |
28 | provider "github" {
29 | token = var.github_pat
30 | owner = var.github_username
31 | # organization =
32 | }
33 |
--------------------------------------------------------------------------------
/github-actions-integration/azure/tpl/azure-github-actions-workflow.yml.tpl:
--------------------------------------------------------------------------------
1 | name: Run Azure Login with OIDC
2 | on: [push]
3 |
4 | permissions:
5 | id-token: write
6 | contents: read
7 | jobs:
8 | build-and-deploy:
9 | runs-on: ubuntu-latest
10 | steps:
11 | - name: 'Az CLI login'
12 | uses: azure/login@v1
13 | with:
14 | client-id: $${{ secrets.${client_id_secret_name} }}
15 | tenant-id: $${{ secrets.${tenant_id_secret_name} }}
16 | subscription-id: $${{ secrets.${subscription_id_secret_name} }}
17 |
18 | - name: 'Run az commands'
19 | run: |
20 | az account show
21 | az group list
--------------------------------------------------------------------------------
/github-actions-integration/gcp/0_variables.tf:
--------------------------------------------------------------------------------
1 | variable "openid_connect_url" {
2 | type = string
3 | default = "https://token.actions.githubusercontent.com"
4 | nullable = false
5 | }
6 |
7 | variable "github_username" {
8 | type = string
9 | validation {
10 | condition = can(regex("^[a-zA-Z0-9]+$", var.github_username))
11 | error_message = "The github username must be alphanumeric and contain no special characters"
12 | }
13 | validation {
14 | condition = length(var.github_username) > 0
15 | error_message = "The github_username cannot be empty"
16 | }
17 | nullable = false
18 | }
19 |
20 | variable "github_repo_name" {
21 | type = string
22 | validation {
23 | condition = length(var.github_repo_name) > 0
24 | error_message = "The github_repo_name cannot be empty"
25 | }
26 | nullable = false
27 | }
28 |
29 | variable "github_pat" {
30 | type = string
31 | validation {
32 | condition = length(var.github_pat) > 0
33 | error_message = "The github_pat cannot be empty"
34 | }
35 | sensitive = true
36 | }
37 |
38 | variable "gcp_project" {
39 | type = string
40 | validation {
41 | condition = length(var.gcp_project) > 0
42 | error_message = "The gcp_project cannot be empty"
43 | }
44 | nullable = false
45 | }
46 |
--------------------------------------------------------------------------------
/github-actions-integration/gcp/1_gcp_workload_identity_pool.tf:
--------------------------------------------------------------------------------
1 | resource "random_string" "workload_identity_pool" {
2 | length = 8
3 | special = false
4 | upper = false
5 | }
6 |
7 | resource "google_iam_workload_identity_pool" "github_oidc" {
8 | depends_on = [ random_string.workload_identity_pool ]
9 | workload_identity_pool_id = "terraform-example-pool-${random_string.workload_identity_pool.result}"
10 | # display_name = "Terraform GitHub OIDC"
11 | disabled = false
12 | }
13 |
--------------------------------------------------------------------------------
/github-actions-integration/gcp/2_gcp_workload_identity_pool_provider.tf:
--------------------------------------------------------------------------------
1 | resource "google_iam_workload_identity_pool_provider" "example" {
2 | depends_on = [ google_iam_workload_identity_pool.github_oidc ]
3 | workload_identity_pool_id = google_iam_workload_identity_pool.github_oidc.workload_identity_pool_id
4 | workload_identity_pool_provider_id = "terraform-github"
5 | attribute_mapping = {
6 | "google.subject" = "assertion.sub"
7 | "attribute.actor" = "assertion.actor"
8 | "attribute.aud" = "assertion.aud"
9 | "attribute.org" = "assertion.repository_owner"
10 | "attribute.repository" = "assertion.repository"
11 | }
12 | # attribute_condition = "attribute.repository == \"testinguser883xxxefe\""
13 | oidc {
14 | issuer_uri = var.openid_connect_url
15 | }
16 | }
--------------------------------------------------------------------------------
/github-actions-integration/gcp/3_gcp_service_account.tf:
--------------------------------------------------------------------------------
1 | resource "google_service_account" "sa" {
2 | account_id = "my-service-account"
3 | display_name = "A service account that only Jane can use"
4 | }
5 |
--------------------------------------------------------------------------------
/github-actions-integration/gcp/4_gcp_service_account_iam_binding.tf:
--------------------------------------------------------------------------------
1 | resource "google_service_account_iam_binding" "admin-account-iam" {
2 | depends_on = [google_service_account.sa, google_iam_workload_identity_pool.github_oidc]
3 | service_account_id = google_service_account.sa.name
4 | role = "roles/iam.workloadIdentityUser"
5 | members = [
6 | "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github_oidc.name}/attribute.repository/${var.github_username}/${var.github_repo_name}"
7 | ]
8 | }
--------------------------------------------------------------------------------
/github-actions-integration/gcp/5_gcp_service_account_to_project_binding.tf:
--------------------------------------------------------------------------------
1 | resource "google_project_iam_member" "sa_viewer" {
2 | depends_on = [ google_service_account.sa ]
3 | project = "probable-anchor-420008"
4 | role = "roles/iam.serviceAccountViewer"
5 | member = "serviceAccount:${google_service_account.sa.email}"
6 | }
7 |
--------------------------------------------------------------------------------
/github-actions-integration/gcp/6_github_actions_secret.tf:
--------------------------------------------------------------------------------
1 | resource "github_actions_secret" "workload_identity_provider" {
2 | depends_on = [google_iam_workload_identity_pool_provider.example]
3 | repository = var.github_repo_name
4 | secret_name = "GCP_WORKLOAD_IDENTITY_PROVIDER"
5 | plaintext_value = google_iam_workload_identity_pool_provider.example.name
6 | }
7 |
8 | resource "github_actions_secret" "service_account_email" {
9 | depends_on = [google_service_account.sa]
10 | repository = var.github_repo_name
11 | secret_name = "GCP_SERVICE_ACCOUNT_EMAIL"
12 | plaintext_value = google_service_account.sa.email
13 | }
14 |
--------------------------------------------------------------------------------
/github-actions-integration/gcp/7_github_actions_commit.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | // Load and format the trust policy from the template file
3 | github_action_content = templatefile("${path.module}/tpl/gcp-github-actions-workflow.yml.tpl", {
4 | workload_identity_provider_secret_name = github_actions_secret.workload_identity_provider.secret_name
5 | service_account_email_secret_name = github_actions_secret.service_account_email.secret_name
6 | })
7 | }
8 |
9 | resource "random_string" "github_actions_workflow_filename" {
10 | length = 8
11 | special = false
12 | }
13 |
14 | resource "github_repository_file" "foo" {
15 | depends_on = [ random_string.github_actions_workflow_filename, local.github_action_content, github_actions_secret.workload_identity_provider, github_actions_secret.service_account_email, google_project_iam_member.sa_viewer, google_service_account_iam_binding.admin-account-iam ]
16 | repository = var.github_repo_name
17 | branch = "main"
18 | file = ".github/workflows/gcp-${random_string.github_actions_workflow_filename.result}.yml"
19 | content = local.github_action_content
20 | commit_message = "Committed GCP with love from Terraform"
21 | }
22 |
23 | output "github_repository_details" {
24 | value = [
25 | github_repository_file.foo.file,
26 | github_repository_file.foo.repository
27 | ]
28 | description = "Github repository details"
29 | }
--------------------------------------------------------------------------------
/github-actions-integration/gcp/README.md:
--------------------------------------------------------------------------------
1 | # GCP OIDC Github Actions Integration
2 |
3 | ```
4 | terraform init
5 | terraform plan -var-file input.tfvars
6 | terraform apply -var-file input.tfvars
7 | ```
8 |
--------------------------------------------------------------------------------
/github-actions-integration/gcp/input.tfvars.example:
--------------------------------------------------------------------------------
1 | github_pat = ""
2 | github_username = ""
3 | github_repo_name = ""
4 | gcp_project = ""
5 |
--------------------------------------------------------------------------------
/github-actions-integration/gcp/outputs.tf:
--------------------------------------------------------------------------------
1 | output "workload_identity_provider" {
2 | value = google_iam_workload_identity_pool_provider.example.name
3 | }
4 |
5 | output "service_account_email" {
6 | value = google_service_account.sa.email
7 | }
8 |
--------------------------------------------------------------------------------
/github-actions-integration/gcp/providers.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_providers {
3 | google = {
4 | source = "hashicorp/google"
5 | version = "5.28.0"
6 | }
7 | github = {
8 | source = "integrations/github"
9 | version = "6.2.1"
10 | }
11 | random = {
12 | source = "hashicorp/random"
13 | version = "3.6.1"
14 | }
15 | }
16 | }
17 |
18 | provider "google" {
19 | project = var.gcp_project
20 | }
21 |
22 | provider "github" {
23 | token = var.github_pat
24 | owner = var.github_username
25 | # organization =
26 | }
27 |
--------------------------------------------------------------------------------
/github-actions-integration/gcp/tpl/gcp-github-actions-workflow.yml.tpl:
--------------------------------------------------------------------------------
1 | name: Connect to a GCP role from a GitHub repository
2 |
3 | on:
4 | push:
5 | branches: [ main ]
6 | pull_request:
7 | branches: [ main ]
8 |
9 | permissions:
10 | contents: read
11 | jobs:
12 | deploy-dev:
13 | runs-on: ubuntu-latest
14 | permissions:
15 | id-token: write
16 | contents: read
17 | steps:
18 | - name: "Checkout"
19 | uses: actions/checkout@v3
20 |
21 | - name: Authenticate with Google Cloud
22 | uses: google-github-actions/auth@v1
23 | with:
24 | workload_identity_provider: $${{ secrets.${workload_identity_provider_secret_name} }}
25 | service_account: $${{ secrets.${service_account_email_secret_name} }}
26 | # create_credentials_file: true
27 |
28 | - name: Setup Google Cloud SDK
29 | uses: google-github-actions/setup-gcloud@v1
30 | with:
31 | version: ">= 363.0.0"
32 | project_id: probable-anchor-420008
33 | export_default_credentials: true # Ensure this is set
34 |
35 | - name: List Service Accounts
36 | run: gcloud iam service-accounts list
--------------------------------------------------------------------------------