Skip to content

run_access_google_db.yml: GCP Database Access Reviews (internal)

attracs-linux-playbooks/gcp/audit/run_access_google_db.yml

How to run

  1. cd attracs-linux-playbooks
  2. ansible-playbook gcp/audit/run_access_google_db.yml --vault-password-file=.vault_password_file (this is the linux vault password file)

Requirements

  1. User has to have cloudsql.instances.connect on all of these projects:
    1. todo: list of projects here

Troubleshooting

Attempting to decrypt but no vault secrets found

TASK [include_vars] ************************************************************************************************************************************************************************************************
fatal: [localhost]: FAILED! => {"ansible_facts": {}, "ansible_included_var_files": [], "changed": false, "message": "Attempting to decrypt but no vault secrets found"}

How to fix

Did you forget to run the playbook with --vault-password-file

db_accounts_0' is undefined

When running the playbook, I get this error:

TASK [Generate user report] ****************************************************************************************************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ansible.errors.AnsibleUndefinedVariable: 'db_accounts_0' is undefined. 'db_accounts_0' is undefined
fatal: [localhost]: FAILED! => {"changed": false, "msg": "AnsibleUndefinedVariable: 'db_accounts_0' is undefined. 'db_accounts_0' is undefined"}

How to fix

Antti forgot or didn't have time to implement the functions: * db_accounts_0 (attracs-sql), * db_accounts_1 (attracs-sql-nightly), * db_accounts_2 (pg-1-nightly) and * db_accounts_3 (pg-1-stable). By adding these as facts in the run_access_google_db.yml you can successfully generate a report:

  - set_fact:
      db_accounts_0: "{{db_accounts.results.0.stdout |from_json}}"

  - set_fact:
      db_accounts_1: "{{db_accounts.results.1.stdout |from_json}}"

  - set_fact:
      db_accounts_2: "{{db_accounts.results.2.stdout |from_json}}"

  - set_fact:
      db_accounts_3: "{{db_accounts.results.3.stdout |from_json}}"