Keyless authentication in Google Cloud

To enable Keyless Authentication in GCP you’ll first need permissions to create service accounts and assign these accounts roles to GCP. The workflow to enable keyless authentication is:

Create a service account with no permissions for federation.
If you do not attach a service account to compute resources or use the default service account, we recommend creating a new service account for the compute resources. Create a service account to attach to compute resources and impersonate the federation service account.
Create an authorization policy to allow the federation service account to authenticate to Endor Labs.
Provision the compute resources with the appropriate permissions.
Test Keyless authentication.

Create GCP service accounts and authorization policies

To create your service accounts, first export your GCP project name as an environment variable:

export PROJECT=<insert-gcp-project>

Create a federation service account

Create a federation service account called endorlabs-federation:

gcloud iam service-accounts create endorlabs-federation --description="Endor Labs Keyless Federation Service Account" --display-name="Endor Labs Federation Service Account"

Create a compute service account

Create a keyless authentication service account to assign to compute resources called endorlabs-compute-service:

gcloud iam service-accounts create endorlabs-compute-service --description="Endor Labs Service account for keyless authentication" --display-name="Endor Labs Compute Instance SA"

This is needed if you don’t already have service accounts for your compute resources. If you do, you need to modify the existing permissions to allow the existing service account to create a federation token.

Assign impersonation permissions

Assign the serviceAccountOpenIdTokenCreator role to the endorlabs-compute-service service account:

gcloud projects add-iam-policy-binding $PROJECT --member="serviceAccount:endorlabs-compute-service@$PROJECT.iam.gserviceaccount.com" --role="roles/iam.serviceAccountOpenIdTokenCreator"

Create an authorization policy in Endor Labs

Use the following command to create an authorization policy to allow the endorlabs-federation account to authenticate to your Endor Labs tenant.

Replace <your-tenant> with your Endor Labs tenant name and <insert-your-project> with your GCP project name.

If you use Endor Labs with an EU tenant, use https://api.eu.endorlabs.com instead of https://api.endorlabs.com.

endorctl api create -r AuthorizationPolicy -d '{
    "tenant_meta": { "namespace": "<your-tenant>" },
    "meta": {
        "name": "Keyless Auth",
        "kind": "AuthorizationPolicy",
        "tags": ["gcp"]
     },
     "spec": {
        "clause": ["email=endorlabs-federation@<insert-your-project>.iam.gserviceaccount.com", "gcp"],
        "target_namespaces": ["<your-tenant>"],
        "propagate": true,
        "permissions": {
            "rules": {},
            "roles": [
                "SYSTEM_ROLE_CODE_SCANNER"
            ]
        },
    }
}'

You’ve now set up the foundation of keyless authentication. You’ll now need to provision your compute resources with the appropriate GCP scopes and service account. See Provision and test keyless authentication for GKE workloads for instructions on setting up GKE for keyless authentication. See Provision and Test Keyless Authentication for GCP Virtual Machine Instances for instructions on setting up a virtual machine instance for keyless authentication.

Provision and test keyless authentication for GKE workloads

Prerequisites

The following prerequisites are required to setup keyless authentication on GKE workloads:

Workload identity is enabled on the target GKE cluster. See the GCP documentation on using workload identity for instructions on migrating existing cluster node pools or creating new clusters to use GCP workload identity.
The gcloud auth plugin is installed and operational on your machine. See the GCP instructions on enabling the gcloud auth plugin for more details.
The kubectl CLI is installed. See the Kubernetes documentation for instructions.

Procedure

The following instructions require you to export these environment variables:

export PROJECT=<Insert_GCP_Project>
export CLUSTER_NAME=<GKE_CLUSTER>

Create a GKE cluster with workload identity

Optionally, create a GKE cluster with workload identity enabled if you do not already have one:

gcloud container clusters create keyless-test --workload-pool=endor-github.svc.id.goog --scopes https://www.googleapis.com/auth/cloud-platform

Authenticate to the GKE cluster

gcloud container clusters get-credentials $CLUSTER_NAME

Create a namespace for Endor Labs scans

Optionally, create a dedicated namespace:

kubectl create namespace endorlabs

Create a Kubernetes service account

kubectl create serviceaccount endorlabs-compute-service -n endorlabs

Bind the Kubernetes service account to your GCP compute service account

Replace <insert-your-project> with your GCP project name.

gcloud iam service-accounts add-iam-policy-binding endorlabs-compute-service@$PROJECT.iam.gserviceaccount.com --role roles/iam.workloadIdentityUser --member "serviceAccount:<insert-your-project>.svc.id.goog[endorlabs/endorlabs-compute-service]"

Annotate the Kubernetes service account

If you created a different service account name, replace endorlabs-compute-service with the appropriate name.

kubectl annotate serviceaccount endorlabs-compute-service -n endorlabs iam.gke.io/gcp-service-account=endorlabs-compute-service@$PROJECT.iam.gserviceaccount.com

Test a scanning workload using keyless authentication

Run a test scan to confirm keyless authentication is working correctly.

Provision and Test Keyless Authentication for GCP Virtual Machine Instances

The following instructions require you to export the following environment variable:

export PROJECT=<Insert_GCP_Project>

Create a virtual machine instance with the appropriate scopes

gcloud compute instances create test-keyless --service-account endorlabs-compute-service@$PROJECT.iam.gserviceaccount.com --scopes https://www.googleapis.com/auth/cloud-platform

Download and install endorctl on the virtual machine instance

SSH to the virtual machine instance:

gcloud compute ssh --zone "us-west1-b" "test-keyless"  --project $PROJECT

Then download and install the latest version of endorctl. See our documentation for instructions on downloading the latest version.

Launch a test scan with keyless authentication

Use the --gcp-service-account flag for federated access to Endor Labs:

endorctl api list --gcp-service-account=endorlabs-federation@<insert-your-project>.iam.gserviceaccount.com -r Project -n <insert-your-tenant> --count

If this scan runs successfully you’ve tested and scanned a project with keyless authentication to Endor Labs.

Introduction

Setup & Deployment

Inventory & Insights

Scan with Endor Labs

Risk Remediation

Integrations

Secure AI Coding

Platform Administration

Best Practices

Research Open Source Risks

Trust & Compliance

Create GCP service accounts and authorization policies

Provision and test keyless authentication for GKE workloads

Prerequisites

Procedure

Provision and Test Keyless Authentication for GCP Virtual Machine Instances

​Create GCP service accounts and authorization policies

​Provision and test keyless authentication for GKE workloads

​Prerequisites

​Procedure

​Provision and Test Keyless Authentication for GCP Virtual Machine Instances

Create GCP service accounts and authorization policies

Provision and test keyless authentication for GKE workloads

Prerequisites

Procedure

Provision and Test Keyless Authentication for GCP Virtual Machine Instances