Google Cloud Platform (GCP)¶

Note

Use Amazon Web Services (AWS), unless an application requires access to Google-exclusive services like Google Drive.

Review projects¶

See also

Security recommendations

Periodically review all projects:

gcloud services list --enabled --project=$PROJECT

Review Credentials, or:

gcloud iam service-accounts list --project=$PROJECT

gcloud asset search-all-iam-policies --scope=projects/$PROJECT

for account in (gcloud iam service-accounts list --project=$PROJECT --format="value(email)")
    echo "== $account"
    gcloud iam service-accounts keys list --iam-account=$account --managed-by=user
end

Review Asset Inventory, or:

gcloud asset search-all-resources --scope=projects/$PROJECT --format="table(assetType, displayName, location, state, createTime)" \
  | grep -vE 'cloudresourcemanager\.googleapis\.com/Project|logging\.googleapis\.com/(LogBucket|LogSink)|iam\.googleapis\.com/ServiceAccount|serviceusage\.googleapis\.com/Service'

Review history in the Activity tab, or:

gcloud logging read 'severity>=DEFAULT' --project=$P --freshness=400d --limit=30 --order=desc \
  --format="table(timestamp, resource.type, protoPayload.methodName, protoPayload.authenticationInfo.principalEmail)"

Known projects¶

DREAM BI

Project ID

dream-bi

Contact

Andrii

Documentation

Configuration

GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in deploy-pillar-private
GOOGLE_APPLICATION_CREDENTIALS in vibes

APIs

See Enabled APIs & services

Credentials

DREAM BI Qlik login for Qlik Sense Authentication API
google-analytics-data@dream-bi.iam.gserviceaccount.com to use APIs in vibes

GAM

Project ID

gam-project-9yro6

Contact

James

Documentation

Google Apps Manager (GAM)

Configuration

~/.gam/ directory

APIs

See Enabled APIs & services

Credentials

GAM for gam commands
gam-project-9yro6@gam-project-9yro6.iam.gserviceaccount.com for gam user commands
Domain-wide Delegation
App Access Control

GYB

Project ID

gyb-project-haj-zu2-x36

Contact

James

Documentation

Got Your Back (GYB)

Configuration

~/bin/gyb/ directory (--config-folder to override)

APIs

See Enabled APIs & services

Credentials

GYB for gyb commands
gyb-project-haj-zu2-x36@gyb-project-haj-zu2-x36.iam.gserviceaccount.com for gyb commands
Domain-wide Delegation

Library

Project ID

ocp-library

Contact

James

Documentation

The New York Times Library

Configuration

Heroku settings

APIs

Google Drive API

Credentials

library to use Sign in with Google
cloud-datastore-user@ocp-library.iam.gserviceaccount.com to use APIs in nytimes/library

Pelican

Project ID

pelican-289615

Contact

James

Documentation

Pelican

Configuration

pelican-289615 in deploy and deploy-pillar-private

APIs

Google Docs API
Google Drive API

Credentials

pelican@pelican-289615.iam.gserviceaccount.com to use APIs in pelican-frontend

Troubleshoot¶

If an administrator lacks access to a project, run, for example:

gcloud projects add-iam-policy-binding ocds-172716 --member user:jmckinney@open-contracting.org --role roles/owner

If the user interface lacks access to an organization, run, for example:

gcloud organizations add-iam-policy-binding organizations/1015889055088 --member domain:open-contracting.org --role roles/recommender.viewer