从Google存储桶IAM政策中删除用户(身份)无效 [英] Deletion of users (identities) from Google bucket IAM Policy does not work

问题描述

为了从Google云存储桶中删除身份，我使用GCP示例存储库中提供的示例:

In order to remove identities from a google cloud bucket, I use the example provided at the GCP examples repo: here. I am wondering if there is something I am missing, I have the correct root credentials to the cloud account, as well as the project ownership credentials. Basically, the removal operations do not owrk both from Java code and using the gsutil function from gcp web console.

以下是原始政策:

Policy{  
bindings=   {  
  roles/storage.legacyBucketOwner=      [  
     projectOwner:csbauditor
  ],
  roles/storage.objectAdmin=      [  
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail]
  ],
  roles/storage.legacyBucketReader=      [  
     projectViewer:csbauditor
  ],
  roles/storage.objectViewer=      [  
   serviceAccount:[e-mail]
  ]
 },
   etag=CLgE,
      version=0
 }

这是第二个策略版本，在写入IAM之前:

 Policy{  
 bindings=   {  
    roles/storage.legacyBucketOwner=      [  
      projectOwner:csbauditor
  ],
  roles/storage.objectAdmin=      [  
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail],
     serviceAccount:[e-mail]
  ],
  roles/storage.legacyBucketReader=      [  
     projectViewer:csbauditor
  ],
  roles/storage.objectViewer=      [  
     serviceAccount:[e-mail]
  ]
},
etag=CLgE,
version=0
}

这是我的代码段:

读取存储桶策略并提取不需要的身份

Set<Identity> wrongIdentities = new HashSet<Identity>();
Role roler = null;    
Policy p = Cache.GCSStorage.getIamPolicy("bucketxyz");
Map<Role, Set<Identity>> policyBindings = p.getBindings();
    for (Map.Entry<Role, Set<Identity>> entry : policyBindings.entrySet()) {
Set<Identity> setidentities = entry.getValue();
    roler = entry.getKey();

        if (roler.getValue().equals("roles/storage.objectAdmin")) {
           setidentities = entry.getValue();
            if ((set.equals("serviceAccount:[e-mail]"))) {
                    continue;
                } else {
                    wrongIdentities.add(set);
                    }
                }
        }
    }
  removeBucketIamMember("bucektxyz", roler, identity));
    }
 }

从策略中删除不需要的身份

public static Policy removeBucketIamMember(String bucketName, Role role, 
Identity identity) {
Storage storage = GoogleStorage.initStorage();
Policy policy = storage.getIamPolicy(bucketName);
System.out.println("policyt "+ policy);
Policy updatedPolicy = policy.toBuilder().removeIdentity(role, 
Identity.serviceAccount(identity.getValue())).build();
System.out.println("updatedPolicy "+ policy);
storage.setIamPolicy(bucketName,updatedPolicy);
if (updatedPolicy.getBindings().get(role) == null|| 
!updatedPolicy.getBindings().get(role).contains(identity)) { 
System.out.printf("Removed %s with role %s from %s\n", identity, role, 
bucketName);
} 
return updatedPolicy;
}

更新01 我还尝试从Web控制台中使用gsutil，但仍然无法正常工作.

Update 01 I tried also using gsutil from within the web console, still does not work.

myaccount@cloudshell:~ (csbauditor)$ gsutil iam ch -d user:company-sipes- 
[e-mail]  gs://company-block-log-fce65e82-a0cd- 
4f71-8693-381100d93c18

No changes made to gs://company-block-log-fce65e82-a0cd-4f71-8693-381100d93c18/

更新02 根据@JohnHanley的建议，在我将user替换为serviceAccount之后，gsutil起作用了.但是，Java代码尚无法正常工作.

Update 02 As advised by @JohnHanley, gsutil worked after I replaced user with serviceAccount. However, the java code is not yet working.

推荐答案

我在您的代码中发现了问题.尽管由于不能编译您的代码，我不能完全确定这是唯一的问题，但我也不得不更改几个类.

I have found the issue in your code. Although I cannot be completely sure that this was the only issue since I wasn't able to compile your code, I had to change several classes too.

在我能够编译并运行代码之后，我注意到即使执行了删除"功能，也没有真正发生任何事情，在进行几次打印后，我注意到它正在尝试使用错误的角色"来删除服务帐户. "，因为您正在更改"for"循环上的角色"值，并且如果设置"不等于"attacker-service-account"，则该循环会进行另一次迭代并更改角色"值.

After I was able to compile and run the code I noticed that even if the "remove" function was executed nothing really happened, after making a few prints I noticed that it was trying to remove the services accounts using the wrong "role", since you were changing the "role" value on the "for" loop, and if the "set" wasn't equal to "attacker-service-account" then the loop made another iteration and changed the "role" value.

这是我班级的代码(示例代码段的修改):

Here's the code of my class (a modification of the example snippet):

package com.google.cloud.examples.storage.snippets;

import com.google.cloud.Identity;
import com.google.cloud.Policy;
import com.google.cloud.Role;
import com.google.cloud.storage.Storage;
import com.google.cloud.storage.StorageOptions;
import com.google.cloud.storage.StorageRoles;
import java.util.Map;
import java.util.Set;
import java.util.Arrays;
import java.util.HashMap;
import java.util.HashSet;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;

/** This class contains Bucket-level IAM snippets for the {@link Storage} interface. */
public class BucketIamSnippets {

  /** Example of listing the Bucket-Level IAM Roles and Members */
  public Policy listBucketIamMembers(String bucketName) {
    // [START view_bucket_iam_members]
    // Initialize a Cloud Storage client
    Storage storage = StorageOptions.getDefaultInstance().getService();

    // Get IAM Policy for a bucket
    Policy policy = storage.getIamPolicy(bucketName);

    // Print Roles and its identities
    Map<Role, Set<Identity>> policyBindings = policy.getBindings();
    for (Map.Entry<Role, Set<Identity>> entry : policyBindings.entrySet()) {
      System.out.printf("Role: %s Identities: %s\n", entry.getKey(), entry.getValue());
    }
    // [END view_bucket_iam_members]
    return policy;
  }

  /** Example of adding a member to the Bucket-level IAM */
  public Policy addBucketIamMember(String bucketName, Role role, Identity identity) {
    // [START add_bucket_iam_member]
    // Initialize a Cloud Storage client
    Storage storage = StorageOptions.getDefaultInstance().getService();

    // Get IAM Policy for a bucket
    Policy policy = storage.getIamPolicy(bucketName);

    // Add identity to Bucket-level IAM role
    Policy updatedPolicy =
        storage.setIamPolicy(bucketName, policy.toBuilder().addIdentity(role, identity).build());

    if (updatedPolicy.getBindings().get(role).contains(identity)) {
      System.out.printf("Added %s with role %s to %s\n", identity, role, bucketName);
    }
    // [END add_bucket_iam_member]
    return updatedPolicy;
  }


  public static void removeUserFromBucketUsingEmail(String bucketName, Role role, String email)  {

        Storage storage = StorageOptions.getDefaultInstance().getService(); 
        Policy policy = storage.getIamPolicy(bucketName);
        Identity identity = Identity.serviceAccount(email);
        String eTag = policy.getEtag();
        System.out.println("etag: " + eTag);

        Policy updatedPolicy = storage.setIamPolicy(bucketName, policy.toBuilder().removeIdentity(role, identity).build());

    if (updatedPolicy.getBindings().get(role) == null
        || !updatedPolicy.getBindings().get(role).contains(identity)) {
      System.out.printf("Removed %s with role %s from %s\n", identity, role, bucketName);
    }


    }


public static void main(String... args) throws Exception {

    try
    {

    String bucketName = "my-bucket-name";

    BucketIamSnippets obj = new BucketIamSnippets ();
    Role role_admin = StorageRoles.objectAdmin();

    String acc_1 = "[e-mail]";
    String acc_2 = "[e-mail]";
    Identity identity_1 = Identity.serviceAccount(acc_1);
    Identity identity_2 = Identity.serviceAccount(acc_2);

     System.out.println(obj.addBucketIamMember (bucketName, role_admin, identity_1 ));
     System.out.println(obj.addBucketIamMember (bucketName, role_admin, identity_2 ));


      Storage storage = StorageOptions.getDefaultInstance().getService();
        Policy policy = storage.getIamPolicy(bucketName);
        System.out.println(policy);

        //List<Role> roleList = new ArrayList<>();
        List<Set<Identity>> identities = new ArrayList<>();
        // Print Roles and its identities
        Set<Identity> wrongIdentities = new HashSet<Identity>();
        Role aux = null;

        Map<Role, Set<Identity>> policyBindings = policy.getBindings();
        Set<Identity> setidentities = new HashSet<>();
        for (Map.Entry<Role, Set<Identity>> entry : policyBindings.entrySet()) {
            aux = entry.getKey();
            System.out.println("role plain " + aux);
            System.out.println("role other  " + aux.getValue());

            if (aux.getValue().equals("roles/storage.objectAdmin")) {
                System.out.println("role :" + aux.getValue());
                System.out.println("Identities getV :" + entry.getValue());
                System.out.println("Identities getK :" + entry.getKey());

                setidentities = entry.getValue();
                System.out.println("setidentities  :" + setidentities);
                System.out.println("setidentities size :" + setidentities.size());
                for (Identity set : setidentities) {
                    if ((set.equals("serviceAccount: [e-mail]"))) {
                        System.out.println("strong one : " + set);
                        continue;
                    } else {
                        wrongIdentities.add(set);
                        System.out.println("strong one : " + set);

                    }

                    System.out.println("wrongIdentities.size() : " + wrongIdentities.size());

                }
            }

        }

        System.out.println("ww " + wrongIdentities);
        System.out.println("policyEtag " + policy.getEtag());
        //GCSFunctions function = new GCSFunctions(); 

        for (Identity identity : wrongIdentities) {
            BucketIamSnippets.removeUserFromBucketUsingEmail(bucketName, role_admin, identity.getValue());
        }


    }
    catch (Exception e)
    {
        e.printStackTrace ();
    }
}

}

注意:

1. 我添加两个测试服务帐户，然后运行您的代码(稍作修改).
2. 我已经直接将角色"初始化为objectAdmin，这就是我传递给删除功能的内容.
3. 修改代码以符合您的实际用例.
4. 我使用与

1. I add two test services accounts and then I run your code (with a little modifications).
2. I have initialized the "role" as objectAdmin directly, and that's what i pass to the removing function.
3. Modify the code to comply with your actual use case.
4. I have compiled this with the same dependencies used on the example

这篇关于从Google存储桶IAM政策中删除用户(身份)无效的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！