I created a terraform deployment for gcp cloudfunction which should assume AWS role to manipulate on AWS s3. The problem that flow which looks like created correctly causes to (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity error. Maybe somebody knows what I do wrongly?
requirements.txt:
google-auth
google-auth-oauthlib
google-auth-httplib2
boto3
functions-framework==3.0.0
flask>=1.0,<3.0
requests
main.py.tmpl:
from flask import jsonify
import google.auth
import google.oauth2.id_token
import google.auth.transport.requests
from google.auth import compute_engine
import boto3
import os
import traceback
import requests
def get_service_account_email():
# Fetch the service account email from the metadata server
metadata_url = 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email'
headers = {'Metadata-Flavor': 'Google'}
response = requests.get(metadata_url, headers=headers)
return response.text
def get_google_identity_token(audience):
auth_req = google.auth.transport.requests.Request()
id_token = google.oauth2.id_token.fetch_id_token(auth_req, audience)
return id_token
def assume_role_with_web_identity(role_arn, identity_token):
sts_client = boto3.client('sts')
response = sts_client.assume_role_with_web_identity(
RoleArn=role_arn,
RoleSessionName='GCPAssumeRoleSession',
WebIdentityToken=identity_token,
)
return response['Credentials']
def transfer_to_s3(request):
service_account_email = get_service_account_email()
print(f"Service Account Email: {service_account_email}")
try:
print("Starting the function execution...")
role_arn = "${gcp_assume_role_arn}"
identity_token = get_google_identity_token(service_account_email)
credentials = assume_role_with_web_identity(role_arn, identity_token)
print(f"Credentials were successfully assumed")
return jsonify({
"status": "success",
"message": f"File {file_name} successfully transferred from GCS to S3"
}), 200
except Exception as e:
print(f"Exception: {e}\n{traceback.print_exc()}")
return jsonify({
"status": "error",
"message": str(e)
}), 500
main.tf
variable "gcp_project_id" {
type = string
description = "refers to the client GCP project"
}
##############################################################################
# aws PROVIDER
##############################################################################
provider "aws" {
region = "us-east-1"
}
##############################################################################
# gcp PROVIDER
##############################################################################
provider "google" {
credentials = file("${path.module}/service-account.json")
project = var.gcp_project_id
region = "us-central1"
}
##############################################################################
# DATA & locals
##############################################################################
data "aws_caller_identity" "current" {}
data "google_project" "client-project" {
project_id = var.gcp_project_id
}
locals {
client_deploy_dir = "${path.module}/deployment/"
gcp_service_account_email = "${var.gcp_project_id}@appspot.gserviceaccount.com"
}
##############################################################################
# AWS S3
##############################################################################
resource "aws_s3_bucket" "client-cur-gcp-bucket" {
bucket = "client-gcp-bucket"
force_destroy = true
}
# Enable versioning
resource "aws_s3_bucket_versioning" "client-cur-gcp-bucket-versioning" {
bucket = aws_s3_bucket.client-cur-gcp-bucket.id
# enable versionning
versioning_configuration {
status = "Enabled"
}
}
# Enable logging on s3 actioins
resource "aws_s3_bucket_acl" "client-cur-gcp-bucket-acl" {
bucket = aws_s3_bucket.client-cur-gcp-bucket.id
acl = "private"
depends_on = [aws_s3_bucket_ownership_controls.client-cur-gcp-bucket-acl-ownership]
}
# Resource to avoid error "AccessControlListNotSupported: The bucket does not allow ACLs"
resource "aws_s3_bucket_ownership_controls" "client-cur-gcp-bucket-acl-ownership" {
bucket = aws_s3_bucket.client-cur-gcp-bucket.id
rule {
object_ownership = "ObjectWriter"
}
}
##############################################################################
# AWS Permissions for GCP
##############################################################################
resource "aws_iam_role" "gcp_assume_role" {
name = "GCPAssumeRole"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "accounts.google.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"accounts.google.com:aud": "${local.gcp_service_account_email}"
}
}
}
]
}
EOF
}
resource "aws_iam_policy" "s3_access_policy" {
name = "S3AccessPolicy"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "${aws_s3_bucket.client-cur-gcp-bucket.arn}/*"
}
]
}
EOF
}
resource "aws_iam_role_policy_attachment" "attach_s3_access_policy" {
role = aws_iam_role.gcp_assume_role.name
policy_arn = aws_iam_policy.s3_access_policy.arn
}
##############################################################################
# BUCKET FOR BigQuery results CSV
##############################################################################
resource "google_storage_bucket" "client-cloud-functions-source-bucket" {
name = "max-test-cloud-functions-source-bucket"
location = "US"
force_destroy = true
}
##############################################################################
# GCP to AWS Transfer Function
##############################################################################
# fille the template
data "template_file" "transwer-to-s3-function" {
template = file("${path.module}/main.py.tmpl")
vars = {
gcp_assume_role_arn = aws_iam_role.gcp_assume_role.arn
}
}
# save file
resource "local_file" "transwer-to-s3-function" {
content = data.template_file.transwer-to-s3-function.rendered
filename = "${local.client_deploy_dir}/transwer_to_s3/main.py"
}
# zip files
resource "null_resource" "zip_transwer_to_s3_code" {
depends_on = [local_file.transwer-to-s3-function]
provisioner "local-exec" {
command = "7z a ${local.client_deploy_dir}/transwer_to_s3.zip ${abspath(local.client_deploy_dir)}/transwer_to_s3/main.py ${abspath(path.module)}/requirements.txt"
}
}
####################
# cloud function
resource "google_storage_bucket_object" "transwer-to-s3-function-zip" {
depends_on = [null_resource.zip_transwer_to_s3_code]
name = "transwer_to_s3.zip"
bucket = google_storage_bucket.client-cloud-functions-source-bucket.name
source = "${local.client_deploy_dir}/transwer_to_s3.zip"
}
resource "google_cloudfunctions_function" "transwer-to-s3-function" {
name = "transwer-to-s3-function"
description = "Run transwer to s3 function"
runtime = "python39"
source_archive_bucket = google_storage_bucket.client-cloud-functions-source-bucket.name
source_archive_object = google_storage_bucket_object.transwer-to-s3-function-zip.name
entry_point = "transfer_to_s3"
trigger_http = true
}
resource "google_project_iam_member" "transwer-to-s3-function-invoker" {
project = var.gcp_project_id
role = "roles/pubsub.subscriber"
member = "serviceAccount:${local.gcp_service_account_email}"
}
CMD
you need to have your gcp service-account.json in the current dir
terraform init
terraform apply -auto-approve -var gcp_project_id=<gcp project id>
