A script in golang which demonstrates how to allow a user temporary, time-limited membership to a Google Group. (firecall access, just in time access) You can use this to set on-demand firecall access based on google groups. For example, if you need to let a specific user access to a…

Samples in golang that enables the following where the private key or hmac secret is embedded with a TPM (Trusted Platform Module) HMAC SignedURLs: Import a GCS HMAC secret and use it to generate a SignedURL RSA SignedURL: Generate an RSA Private Key on a TPM Use RSA Private Key…

Shell alias script that will print the active in-use account for GCP application default credentials (ADC). For example, if you run either gcloud config list gcloud auth list this script will print the gcloud cli credentials as well as the application default credentials that are in use. This script will…

A simple way to embed/associate audit logged metadata to GCP API calls. Or in other words, whenever you make any GCP API call like GCS, PubSub, you can automatically attach metadata to the call which will show up in audit logs. One usecase is to attach information about why the…

Simple gRPC client/server for GCP API Gateway and Cloud Run…now with with authentication and authorization! Basically you deploy a gRPC server on Cloud Run, then an API gateway which brokers requests. The gateway is protected by JWT authentication while the Cloud Run backend will only allow requests originating from the…

This is a sample procedure that will exchange an arbitrary OIDC id_token for a GCP credential. You can use the GCP credential then to access any service the mapped principal has GCP IAM permissions on. This article and repo is the second part that explores how to use the workload…

This is a sample procedure that will exchange a long term or short term AWS credential for a GCP credential. You can use the GCP credential to access any service the mapped principal has GCP IAM permissions on. This article and repo is the first part that explores how to…

Deterministic container images for gRPC+golang bazel. The following sample will build a golang gRPC client/server and then embed the binaries into container images. These images are will have a consistent image hash no matter where it is built. For reference, see: Building deterministic Docker images with Bazel Create Container images…

Simple helloworld demonstrating GCP support for Application Layer Transport Security. You can read more about ALTS in that article (no sense in repeating it). ALTS can be thought of intrinsic platform-based security which helps ensure service->service communication uses the machine's bound identity itself. That is, the gRPC communication will utilize…