v1.0 for Steampipe, Powerpipe, Flowpipe, 116 plugins, and 44 mods →

Plugins Docs Home

turbot/terraform_gcp_compliance

artifact_registry_repository_encrypted_with_kms_cmk artifact_registry_repository_not_publicly_accessible bigquery_dataset_encrypted_with_cmk bigquery_dataset_not_publicly_accessible bigquery_table_deletion_protection_enabled bigquery_table_encrypted_with_cmk bigquery_table_not_publicly_accessible bigtable_instance_deletion_protection_enabled bigtable_instance_encrypted_with_kms_cmk cloudbuild_workers_use_private_ip cloudfunction_not_publicly_accessible cloudrun_not_publicly_accessible compute_disk_encrypted_with_csk compute_firewall_allow_ftp_port_20_ingress compute_firewall_allow_ftp_port_21_ingress compute_firewall_allow_http_port_80_ingress compute_firewall_allow_mysql_port_3306_ingress compute_firewall_allow_rdp_port_3389_ingress compute_firewall_allow_ssh_port_22_ingress compute_instance_block_project_wide_ssh_enabled compute_instance_boot_disk_encryption_enabled compute_instance_confidential_computing_enabled compute_instance_ip_forwarding_disabled compute_instance_oslogin_enabled compute_instance_serial_port_connection_disabled compute_instance_shielded_vm_enabled compute_instance_with_no_default_service_account compute_instance_with_no_default_service_account_with_full_access compute_instance_with_no_public_ip_addresses compute_network_contains_no_default_network compute_network_contains_no_legacy_network compute_security_policy_prevent_message_lookup compute_subnetwork_flow_log_enabled compute_subnetwork_private_ip_google_access compute_subnetwork_private_ipv6_google_access dataflow_encrypted_with_kms_cmk dataflow_job_not_publicly_accessible datafusion_instance_not_publicly_accessible datafusion_instance_stackdriver_logging_enabled datafusion_instance_stackdriver_monitoring_enabled dataproc_cluster_encrypted_with_kms_cmk dataproc_cluster_not_publicly_accessible dataproc_cluster_public_ip_disabled dns_managed_zone_dnssec_enabled dns_managed_zone_key_signing_not_using_rsasha1 dns_managed_zone_zone_signing_not_using_rsasha1 iam_folder_impersonation_role iam_folder_use_basic_role iam_folder_use_default_service_role iam_organization_impersonation_role iam_organization_use_basic_role iam_organization_use_default_service_role iam_project_impersonation_role iam_project_no_service_account_token_creator_role iam_project_use_basic_role iam_project_use_default_service_role iam_service_account_gcp_managed_key iam_service_account_no_admin_priviledge iam_workload_identity_restricted kms_key_not_publicly_accessible kms_key_prevent_destroy_enabled kms_key_rotated_within_100_day kms_key_rotated_within_90_day kubernetes_cluster_alias_ip_range_enabled kubernetes_cluster_authenticator_group_configured kubernetes_cluster_auto_repair_enabled kubernetes_cluster_auto_upgrade_enabled kubernetes_cluster_binary_auth_enabled kubernetes_cluster_client_certificate_authentication_disabled kubernetes_cluster_control_plane_restrict_public_access kubernetes_cluster_cos_node_image kubernetes_cluster_intranodal_visibility_enabled kubernetes_cluster_legacy_abac_enabled kubernetes_cluster_legacy_endpoints_disabled kubernetes_cluster_master_authorized_network_enabled kubernetes_cluster_metadata_server_enabled kubernetes_cluster_network_policy_installed kubernetes_cluster_no_cluster_level_node_pool kubernetes_cluster_node_config_image_cos_containerd kubernetes_cluster_private_cluster_config_enabled kubernetes_cluster_release_channel_configured kubernetes_cluster_resource_label_configured kubernetes_cluster_shielded_node_integrity_monitoring_enabled kubernetes_cluster_shielded_node_secure_boot_enabled kubernetes_cluster_shielded_nodes_enabled kubernetes_cluster_stackdriver_logging_enabled kubernetes_cluster_stackdriver_monitoring_enabled logging_bucket_retention_policy_enabled pubsub_topic_encrypted_with_kms_cmk pubsub_topic_repository_not_publicly_accessible redis_instance_auth_enabled redis_instance_encryption_in_transit_enabled spanner_database_deletion_protection_enabled spanner_database_drop_protection_enabled spanner_database_encrypted_with_kms_cmk sql_instance_automated_backups_enabled sql_instance_mysql_local_infile_database_flag_off sql_instance_mysql_skip_show_database_flag_on sql_instance_postgresql_log_checkpoints_database_flag_on sql_instance_postgresql_log_connections_database_flag_on sql_instance_postgresql_log_disconnections_database_flag_on sql_instance_postgresql_log_duration_database_flag_on sql_instance_postgresql_log_executor_stats_database_flag_off sql_instance_postgresql_log_hostname_database_flag_configured sql_instance_postgresql_log_lock_waits_database_flag_on sql_instance_postgresql_log_min_duration_statement_database_flag_disabled sql_instance_postgresql_log_min_error_statement_flag_set sql_instance_postgresql_log_min_messages_flag_set sql_instance_postgresql_log_parser_stats_database_flag_off sql_instance_postgresql_log_planner_stats_database_flag_off sql_instance_postgresql_log_statement_flag_set sql_instance_postgresql_log_statement_stats_database_flag_off sql_instance_postgresql_log_temp_files_database_flag_0 sql_instance_postgresql_pgaudit_database_flag_on sql_instance_publicly_accessible sql_instance_require_ssl_enabled sql_instance_sql_3625_trace_database_flag_off sql_instance_sql_contained_database_authentication_database_flag_off sql_instance_sql_cross_db_ownership_chaining_database_flag_off sql_instance_sql_external_scripts_enabled_database_flag_off sql_instance_sql_remote_access_database_flag_off sql_instance_sql_user_options_database_flag_not_configured sql_instance_sql_with_no_public_ip sql_instance_using_latest_major_database_version storage_bucket_logging_enabled storage_bucket_not_publicly_accessible storage_bucket_public_access_prevention_enforced storage_bucket_self_logging_disabled storage_bucket_uniform_access_enabled storage_bucket_versioning_enabled vertex_ai_dataset_encrypted_with_cmk vertex_ai_notebook_instance_restrict_public_access

Query: iam_project_impersonation_role

Usage

powerpipe query terraform_gcp_compliance.query.iam_project_impersonation_role

Steampipe Tables

terraform_resource

Terraform plugin

SQL

select
  address as resource,
  case
    when (attributes_std ->> 'role') like any (array ['roles/owner', 'roles/editor', 'roles/iam.securityAdmin', 'roles/iam.serviceAccountAdmin', 'roles/iam.serviceAccountKeyAdmin', 'roles/iam.serviceAccountUser', 'roles/iam.serviceAccountTokenCreator', 'roles/iam.workloadIdentityUser', 'roles/dataproc.editor', 'roles/dataproc.admin', 'roles/dataflow.developer', 'roles/resourcemanager.folderAdmin', 'roles/resourcemanager.folderIamAdmin', 'roles/resourcemanager.projectIamAdmin', 'roles/resourcemanager.organizationAdmin', 'roles/serverless.serviceAgent', 'roles/dataproc.serviceAgent']) then 'alarm'
    else 'ok'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std ->> 'role') like any (array ['roles/owner', 'roles/editor', 'roles/iam.securityAdmin', 'roles/iam.serviceAccountAdmin', 'roles/iam.serviceAccountKeyAdmin', 'roles/iam.serviceAccountUser', 'roles/iam.serviceAccountTokenCreator', 'roles/iam.workloadIdentityUser', 'roles/dataproc.editor', 'roles/dataproc.admin', 'roles/dataflow.developer', 'roles/resourcemanager.folderAdmin', 'roles/resourcemanager.folderIamAdmin', 'roles/resourcemanager.projectIamAdmin', 'roles/resourcemanager.organizationAdmin', 'roles/serverless.serviceAgent', 'roles/dataproc.serviceAgent']) then ' impersonates or manages Service Accounts'
    else ' does not impersonate or manage Service Accounts'
  end || '.' reason
  , path || ':' || start_line
from
  terraform_resource
where
  type in ('google_project_iam_member', 'google_project_iam_binding');

Controls

The query is being used by the following controls:

Ensure roles do not impersonate or manage Service Accounts used at project level