A delivery pipeline should not use administrative credentials simply because it manages infrastructure. The principle of least privilege grants each user or service account only the minimum access required to complete its task. For an infrastructure-as-code pipeline, that may mean write access to network, application, and database resources, while excluding unrelated resource types. section 8.1.1
Apply least privilege as an ongoing access-management practice:
- Identify the resources and operations a user, application, or pipeline actually needs. section 8.1.1
- Group permissions into composable roles or reusable permission modules so access can be added and removed as infrastructure changes. section 8.1.1
- Test the resulting configuration before production; security tests can reject permissive firewall ranges such as 0.0.0.0/0. section 8.3.2
- Verify that reduced permissions do not break dependent applications, then promote the tested change across environments. section 11.1 section 11.3.3
- Review permissions whenever new resources or dependencies are introduced, and revoke or rotate exposed credentials through a secrets manager. section 8.1.1 section 8.1.2
Frontend pipeline roles
A frontend delivery pipeline creates network, App Engine, and Cloud SQL resources. Replace administrative credentials with roles permitting only network administration, App Engine administration, and Cloud SQL administration; retrieve the database password from a secrets manager and add a test confirming that administrative access is absent. section 8.1.1
Listing 8.3 Using a test to parse the firewall rule for 0.0.0.0
import json
import pytest
from main import APP_NAME, CONFIGURATION_FILE
@pytest.fixture(scope="module")
def resources():
with open(CONFIGURATION_FILE, 'r') as f: #1
config = json.load(f) #1
return config['resource'] #2
@pytest.fixture
def database_firewall_rule(resources): #3
return resources[0][ #3
'google_compute_firewall'][0][APP_NAME][0] #3
def test_database_firewall_rule_should_not_allow_everything( #4
database_firewall_rule):
assert '0.0.0.0/0' not in \ #5
database_firewall_rule['source_ranges'], \ #5
'database firewall rule must not ' + \ #6
'allow traffic from 0.0.0.0/0, specify source_ranges ' + \ #6
'with exact IP address ranges' #6
Inspect a Python test that parses generated infrastructure configuration and fails when a database firewall permits traffic from every IP address. section 8.3.2
