Clean up of over permissioned IAM accounts on GCP infra in an automated way

CureIAM is an easy-to-use, reliable, and performant engine for Least Privilege Principle Enforcement on GCP cloud infra. It enables DevOps and Security team to quickly clean up accounts in GCP infra that have granted permissions of more than what are required. CureIAM fetches the recommendations and insights from GCP IAM recommender, scores them and enforce those recommendations automatically on daily basic. It takes care of scheduling and all other aspects of running these enforcement jobs at scale. It is built on top of GCP IAM recommender APIs and Cloudmarker framework.

Key features

Discover what makes CureIAM scalable and production grade.

• Config driven : The entire workflow of CureIAM is config driven. Skip to Config section to know more about it.
• Scalable : Its is designed to scale because of its plugin driven, multiprocess and multi-threaded approach.
• Handles Scheduling: Scheduling part is embedded in CureIAM code itself, configure the time, and CureIAM will run daily at that time note.
• Plugin driven: CureIAM codebase is completely plugin oriented, which means, one can plug and play the existing plugins or create new to add more functionality to it.
• Track actionable insights: Every action that CureIAM takes, is recorded for audit purpose, It can do that in file store and in elasticsearch store. If you want you can build other store plugins to push that to other stores for tracking purposes.
• Scoring and Enforcement: Every recommendation that is fetch by CureIAM is scored against various parameters, after that couple of scores like safe_to_apply_score, risk_score, over_privilege_score. Each score serves a different purpose. For safe_to_apply_score identifies the capability to apply recommendation on automated basis, based on the threshold set in CureIAM.yaml config file.

Usage

Since CureIAM is built with python, you can run it locally with these commands. Before running make sure to have a configuration file ready in either of /etc/CureIAM.yaml, ~/.CureIAM.yaml, ~/CureIAM.yaml, or CureIAM.yaml and there is Service account JSON file present in current directory with name preferably cureiamSA.json. This SA private key can be named anything, but for docker image build, it is preferred to use this name. Make you to reference this file in config for GCP cloud.

# Install necessary dependencies
$ pip install -r requirements.txt

# Run CureIAM now
$ python -m CureIAM -n

# Run CureIAM process as schedular
$ python -m CureIAM

# Check CureIAM help
$ python -m CureIAM --help

CureIAM can be also run inside a docker environment, this is completely optional and can be used for CI/CD with K8s cluster deployment.

# Build docker image from dockerfile
$ docker build -t cureiam . 

# Run the image, as schedular
$ docker run -d cureiam 

# Run the image now
$ docker run -f cureiam -m cureiam -n 

Config

CureIAM.yaml configuration file is the heart of CureIAM engine. Everything that engine does it does it based on the pipeline configured in this config file. Let’s break this down in different sections to make this config look simpler.

1. Let’s configure first section, which is logging configuration and scheduler configuration.

This subsection of config uses, Rich logging module and schedules CureIAM to run daily at 16:00.

2. Next section is configure different modules, which we MIGHT use in pipeline. This falls under plugins section in CureIAM.yaml. You can think of this section as declaration for different plugins.

  plugins:
    gcpCloud:
      plugin: CureIAM.plugins.gcp.gcpcloud.GCPCloudIAMRecommendations
      params:
        key_file_path: cureiamSA.json

    filestore:
      plugin: CureIAM.plugins.files.filestore.FileStore

    gcpIamProcessor:
      plugin: CureIAM.plugins.gcp.gcpcloudiam.GCPIAMRecommendationProcessor
      params:
        mode_scan: true
        mode_enforce: true
        enforcer:
          key_file_path: cureiamSA.json
          allowlist_projects:
            - alpha
          blocklist_projects:
            - beta
          blocklist_accounts:
            - [email protected]
          allowlist_account_types:
            - user
            - group
            - serviceAccount
          blocklist_account_types:
            - None
          min_safe_to_apply_score_user: 0
          min_safe_to_apply_scor   e_group: 0
          min_safe_to_apply_score_SA: 50

    esstore:
      plugin: CureIAM.plugins.elastic.esstore.EsStore
      params:
        # Change http to https later if your elastic are using https
        scheme: http
        host: es-host.com
        port: 9200
        index: cureiam-stg
        username: security
        password: securepassword

Each of these plugins declaration has to be of this form:

  audits:
    IAMAudit:
      clouds:
        - gcpCloud
      processors:
        - gcpIamProcessor
      stores:
        - filestore
        - esstore

  run:
    - IAMAudits

Running docker compose: docker-compose -f docker_compose_es.yaml up 

      mode_scan: true
      mode_enforce: false