Home / Ruby / Security

Exports primitive and predefined GCP IAM Roles and their permissions

This repository fetches the ~550 primitive and predefined IAM Roles in JSON format to the roles directory. A GitHub Action is configured to refresh them daily. This allows for automatic tracking of changes as they are made by GCP.
Information
Category: Ruby / Security
Watchers: 2
Star: 12
Fork: 0
Last update: Jul 20, 2020
Resource links
https://github.com/darkbitio/gcp-iam-role-permissions

Fetches all Primitive and Predefined GCP IAM Roles

Fetch all roles

This repository fetches the ~550 primitive and predefined IAM Roles in JSON format to the roles directory. A GitHub Action is configured to refresh them daily. This allows for automatic tracking of changes as they are made by GCP.

A couple of helper scripts are provided to aid in searching/listing of the output:

  • list-all-permissions.sh grabs the unique list of all permissions contained in all roles fetched
  • list-alpha/beta/ga-roles.sh lists the roles labeled by GCP as alpha, beta, or GA (generally available)
  • list-role-with-permission.sh <api.resource.verb> lists the roles that contain a specific permission passed by the first argument. e.g.: ./list-role-with-permission.sh container.clusters.get
0 Open More issues
Closed

Document that the scripts require jq to be in PATH

null

opened Feb 13, 2023 by aryehb 1
Closed

update readme

null

opened Oct 4, 2022 by joshlarsen 0
Open

list-roles-with-permission.sh seems to list each role several times

Hello list-roles-with-permission.sh script seems to duplicate each role, searching for a permission

`./list-roles-with-permission.sh bigquery.jobs.list roles/automlrecommendations.serviceAgent roles/bigquery.admin roles/bigquery.admin roles/bigquery.admin roles/bigquery.resourceAdmin roles/bigquery.resourceAdmin roles/bigquery.resourceAdmin roles/bigquery.resourceEditor roles/bigquery.resourceEditor roles/bigquery.resourceEditor

[...] ` If this works as expected (i.e. if the list adds a line for GA/alpha/beta), is it possible to add this information next to the role name (alpha/beta/GA)?

Thanks for your work

opened Nov 28, 2023 by Ftagn92 0
Open

new script to diff 2 roles

New script diff-role-permissions.sh with customizable output style. Thanks for creating this little tool, I use it a lot 🌟

opened Jan 9, 2023 by wtait1-ff 0

2023-12-07-13-15-05(Dec 7, 2023)

GCP IAM Update 2023-12-07-13-15-05

 gcp_roles_cai.json                               | 24 ++++++++++++------------
 roles/anthosservicemesh.serviceAgent             |  6 ++++++
 roles/bigquery.studioAdmin                       |  2 +-
 roles/binaryauthorization.serviceAgent           |  1 +
 roles/gkemulticloud.nodePoolMachineServiceAgent  |  3 ++-
 roles/mapsanalytics.viewer                       |  2 +-
 roles/networkconnectivity.regionalEndpointAdmin  |  2 +-
 roles/networkconnectivity.regionalEndpointViewer |  2 +-
 roles/workloadmanager.deploymentAdmin            |  2 +-
 roles/workloadmanager.evaluationAdmin            |  2 +-
 roles/workloadmanager.evaluationViewer           |  2 +-
 roles/workloadmanager.evaluationWorker           |  2 +-
 roles/workloadmanager.worker                     |  1 -
 13 files changed, 29 insertions(+), 22 deletions(-)

2023-12-07-01-30-54(Dec 6, 2023)

GCP IAM Update 2023-12-07-01-30-54

 gcp_roles_cai.json                      | 28 ++++++++++++++--------------
 roles/aiplatform.serviceAgent           |  1 +
 roles/bigquery.studioAdmin              |  2 +-
 roles/blockchainnodeengine.viewer       |  2 +-
 roles/capacityplanner.viewer            |  1 +
 roles/clouddeploy.customTargetTypeAdmin |  2 +-
 roles/commercebusinessenablement.admin  |  3 +++
 roles/datamigration.serviceAgent        |  4 +++-
 roles/fleetengine.deliveryAdmin         |  2 +-
 roles/fleetengine.ondemandAdmin         |  2 +-
 roles/iam.securityReviewer              |  1 +
 roles/kubernetesmetadata.publisher      |  2 +-
 roles/viewer                            |  1 +
 roles/workloadmanager.deploymentViewer  |  2 +-
 roles/workloadmanager.worker            |  1 +
 15 files changed, 32 insertions(+), 22 deletions(-)

2023-12-06-13-15-12(Dec 6, 2023)

GCP IAM Update 2023-12-06-13-15-12

 gcp_roles_cai.json                                 | 48 +++++++++++-----------
 roles/aiplatform.serviceAgent                      |  1 -
 roles/bigquery.studioAdmin                         |  2 +-
 roles/bigquery.studioUser                          |  2 +-
 roles/binaryauthorization.serviceAgent             |  1 -
 roles/blockchainnodeengine.admin                   |  2 +-
 roles/blockchainnodeengine.viewer                  |  2 +-
 roles/clouddeploy.customTargetTypeAdmin            |  2 +-
 roles/commercebusinessenablement.viewer            |  1 +
 roles/dataplex.serviceAgent                        |  1 -
 roles/editor                                       |  3 ++
 roles/fleetengine.deliveryAdmin                    |  2 +-
 .../gkemulticloud.controlPlaneMachineServiceAgent  |  3 +-
 roles/gkemulticloud.nodePoolMachineServiceAgent    |  3 +-
 roles/iam.securityAdmin                            |  1 +
 roles/kubernetesmetadata.publisher                 |  2 +-
 roles/mapsanalytics.viewer                         |  2 +-
 roles/networkconnectivity.regionalEndpointAdmin    |  2 +-
 roles/owner                                        |  3 ++
 roles/visionai.serviceAgent                        | 23 -----------
 roles/workflows.invoker                            |  4 +-
 roles/workloadmanager.deploymentAdmin              |  2 +-
 roles/workloadmanager.evaluationAdmin              |  2 +-
 roles/workloadmanager.evaluationViewer             |  2 +-
 roles/workloadmanager.worker                       |  1 -
 25 files changed, 47 insertions(+), 70 deletions(-)

2023-12-06-01-30-59(Dec 5, 2023)

GCP IAM Update 2023-12-06-01-30-59

 gcp_roles_cai.json                                 | 30 +++++++++++-----------
 roles/aiplatform.serviceAgent                      |  1 +
 roles/bigquery.studioAdmin                         |  2 +-
 roles/binaryauthorization.serviceAgent             |  1 +
 roles/blockchainnodeengine.viewer                  |  2 +-
 roles/clouddeploy.customTargetTypeAdmin            |  2 +-
 roles/dataplex.serviceAgent                        |  1 +
 roles/fleetengine.deliveryAdmin                    |  2 +-
 roles/fleetengine.ondemandAdmin                    |  2 +-
 .../gkemulticloud.controlPlaneMachineServiceAgent  |  3 ++-
 roles/gkemulticloud.nodePoolMachineServiceAgent    |  3 ++-
 roles/kubernetesmetadata.publisher                 |  2 +-
 roles/mapsanalytics.viewer                         |  2 +-
 roles/visionai.serviceAgent                        | 23 +++++++++++++++++
 roles/workflows.invoker                            |  4 ++-
 roles/workloadmanager.worker                       |  1 +
 16 files changed, 56 insertions(+), 25 deletions(-)

2023-12-05-13-12-59(Dec 5, 2023)

GCP IAM Update 2023-12-05-13-12-59

 gcp_roles_cai.json                                  | 16 ++++++++--------
 roles/binaryauthorization.serviceAgent              |  1 -
 roles/blockchainnodeengine.admin                    |  2 +-
 roles/blockchainnodeengine.viewer                   |  2 +-
 roles/clouddeploy.customTargetTypeAdmin             |  2 +-
 roles/gkemulticloud.controlPlaneMachineServiceAgent |  3 +--
 roles/gkemulticloud.nodePoolMachineServiceAgent     |  3 +--
 roles/workloadmanager.deploymentViewer              |  2 +-
 roles/workloadmanager.worker                        |  1 -
 9 files changed, 14 insertions(+), 18 deletions(-)

2023-12-05-01-31-14(Dec 4, 2023)

GCP IAM Update 2023-12-05-01-31-14

 gcp_roles_cai.json                                  | 16 ++++++++--------
 roles/binaryauthorization.serviceAgent              |  1 +
 roles/blockchainnodeengine.admin                    |  2 +-
 roles/blockchainnodeengine.viewer                   |  2 +-
 roles/clouddeploy.customTargetTypeAdmin             |  2 +-
 roles/gkemulticloud.controlPlaneMachineServiceAgent |  3 ++-
 roles/gkemulticloud.nodePoolMachineServiceAgent     |  3 ++-
 roles/workloadmanager.deploymentViewer              |  2 +-
 roles/workloadmanager.worker                        |  1 +
 9 files changed, 18 insertions(+), 14 deletions(-)

Contents

    cloud-ace Generating tf files and tfstate from existing GCP resources.
    prisma-cloud IAMFinder enumerates and finds users and IAM roles in a target AWS account.
    glassechidna Assume AWS IAM roles from GitHub Actions workflows with no stored secrets
    aripalo CDK constructs to use OpenID Connect for authenticating your Github Action workflow with AWS IAM
    hjwdzh PrimitiveNet: Primitive Instance Segmentation with Local Primitive Embedding under Adversarial Metric (ICCV 2021)
    spatie Associate users with roles and permissions
    LaravelDaily Laravel 6 adminpanel starter boilerplate project with roles-permissions management.
    bridgecrewio Least privilege AWS IAM Terraformer
    kubernetes-sigs A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster
    jtblin kube2iam provides different AWS IAM roles for pods running on Kubernetes
    sergejsha Simple RxJava library for requesting and observing Android runtime permissions
    holidaycheck Simplifying Android Permissions
    dalibo :elephant: :busts_in_silhouette: Manage PostgreSQL roles and privileges from YAML or LDAP
    anthonygore vue-router-user-roles - Protects routes based on user roles. Add your own authentication.
    carrotsearch High Performance Primitive Collections for Java
    ondras JS port of primitive.lol
    Jnesselr Export your designs across all hubs, projects, files, and components. It exports them in STL, STEP, and IGES format.
    sindresorhus Add `module.exports` for Babel and TypeScript compiled code
    spotty-cloud Training deep learning models on AWS and GCP instances
    gsarti Tutorial to pretrain & fine-tune a 🤗 Flax T5 model on a TPUv3-8 with GCP
    bregman-arie Linux, Jenkins, AWS, SRE, Prometheus, Docker, Python, Ansible, Git, Kubernetes, Terraform, OpenStack, SQL, NoSQL, Azure, GCP, DNS, Elastic, Network, Virtualization
    Share this repo

    Related Repos


    Security
    45
    Metasploit Modules Development
    0x727 Metasploit Modules Development
     
    Security
    26
    Application-level encryption for Redis and Memcached
    ankane Encrypts keys, values, list elements, set members, and hash fields while still being able to perform a majority of operations 🎉
     
    Security
    12
    Exports primitive and predefined GCP IAM Roles and their permissions
    darkbitio This repository fetches the ~550 primitive and predefined IAM Roles in JSON format to the roles directory. A GitHub Action is configured to refresh them daily. This allows for automatic tracking of changes as they are made by GCP.
     
    Security
    30
    Ruby sensitive filter using DFA algorithm
    luolinae86 Ruby sensitive filter using DFA algorithm
     
    Security
    14
    CVE-2020-8163 - Remote code execution of user-provided local names in Rails
    sh286 CVE-2020-8163 - Remote code execution of user-provided local names in Rails
     
    Security
    8
    jpm is a password manager using openssl and signify (and optionally xclip)
    jeremyevans jpm is a password manager using openssl and signify (and optionally xclip). Technically, it doesn't have anything to do with passwords, it just manages encrypted and signed files.
     
    Security
    242
    This tool is used to map out the network data flow to help penetration testers identify po...
    vonahisec This tool is used to map out the network data flow to help penetration testers identify potentially valuable targets
     
    Security
    1.3k
    Modern encryption for Rails
    ankane Lockbox 🔒 File encryption for Ruby and Rails Supports Active Storage and CarrierWave Uses AES-GCM by default for authenticated encryption Makes key rotation easy Check out this post for more info on securing se
     
    Security
    1.3k
    Authorization framework for Ruby/Rails applications
    palkan Action Policy Authorization framework for Ruby and Rails applications. Composable. Extensible. Performant. 📑 Documentation Resources RubyRussia, 2019 "Welcome, or access denied?" talk (video [RU],
     
    Security
    433
    A secret manager backed by Keybase and KBFS.
    kbsecret Warning: KBSecret is currently maintained on a best-effort basis. PRs are strongly preferred over new issues. KBSecret is a command line utility and library for managing secrets. Quick links: Installation instructions
     
    Security
    503
    Sign in (or up) with Google for Rails applications
    basecamp Google Sign-In for Rails This gem allows you to add Google sign-in to your Rails app. You can let users sign up for and sign in to your service with their Google accounts. Installation Add google_sign_in to your Rails
     
    Security
    1.8k
    Checklist of security precautions for Ruby on Rails applications.
    brunofacca Zen Rails Security Checklist Summary This document provides a not necessarily comprehensive list of security measures to be implemented when developing a Ruby on Rails application. It is designed to serve as a quick re
     
    Security
    191
    Freeze all core ruby classes
    jeremyevans Refrigerator Refrigerator offers an easy way to freeze all ruby core classes and modules. It's designed to be used in production to make sure that no code is making unexpected changes to core classes or modules at runtime.
     
    Security
    126
    Underlock makes it dead simple to encrypt and decrypt your data and files. It comes with l...
    metaware Underlock Underlock makes it dead simple to encrypt and decrypt your data and files. It comes with little to no dependencies and has a very small API surface. Installation Add this line to your application's Gemfi
     
    Security
    1.3k
    :key: Community-driven Rails Security Checklist (see our GitHub Issues for the newest chec...
    eliotsykes Rails Security Checklist This checklist is limited to Rails security precautions and there are many other aspects of running a Rails app that need to be secured (e.g. up-to-date operating system and other software) that this does