Convalida la tua IaC in base ai criteri dell'organizzazione Google Cloud
Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Questo documento descrive come convalidare l'infrastruttura come codice (IaC) in base ai criteri dell'organizzazione e ai detector di Security Health Analytics che hai definito nella tua organizzazione Google Cloud . IaC ti consente di creare e gestire le risorse cloud utilizzando linguaggi come Terraform, in modo da poter eseguire il deployment delle risorse utilizzando un flusso di lavoro di sviluppo. La funzionalità di convalida dell'IaC
supporta solo i rilevatori di Security Health Analytics e i criteri dell'organizzazione.
La convalida dell'IaC ti consente di determinare se le definizioni delle risorse nuove o modificate violano le norme esistenti applicate alle tue risorseGoogle Cloud (ad esempio cluster, bucket o istanza). Puoi
definire queste norme utilizzando le posture di
sicurezza, ma la funzionalità di convalida IaC
analizza il codice e lo confronta con le norme effettive
definite nelle posture implementate nella tua Google Cloud organizzazione.
La convalida dell'IaC aiuta gli sviluppatori a identificare e correggere eventuali problemi di sicurezza nella
configurazione IaC di asset o risorse prima che vengano applicati al tuo
ambienteGoogle Cloud .
La funzionalità di convalida IaC supporta i file di piano Terraform. Puoi convalidare il tuo piano Terraform utilizzando Google Cloud CLI oppure puoi integrare il processo di convalida nel tuo flusso di lavoro di sviluppo di Cloud Build, Jenkins o GitHub Actions.
Prima di iniziare
Completa queste attività per iniziare a utilizzare la convalida dell'IaC.
Attiva il livello Premium o Enterprise di Security Command Center
In the Principal column, find all rows that identify you or a group that
you're included in. To learn which groups you're included in, contact your
administrator.
For all rows that specify or include you, check the Role column to see whether
the list of roles includes the required roles.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
Per configurare gcloud CLI in modo che utilizzi la simulazione dell'identità dei service account per l'autenticazione alle
API di Google, anziché le tue credenziali utente, esegui questo comando:
Utilizza i tuoi flussi di lavoro e strumenti per sviluppatori per creare un file Terraform che includa
gli Google Cloud asset che vuoi creare o modificare.
Considera quanto segue:
Compila l'attributo padre (il progetto, la cartella o l'organizzazione) di ogni risorsa o asset nella configurazione Terraform.
Modifica gli asset e le norme separatamente. L'API non supporta la convalida dei file di piano Terraform che modificano contemporaneamente asset e criteri.
Non includere informazioni sensibili come password o altre informazioni
che consentono l'identificazione personale nel file di piano Terraform. Se la funzionalità di convalida
rileva campi contrassegnati come sensibili nelle modifiche alle risorse, i
campi vengono rimossi.
Dopo aver creato il codice Terraform, puoi eseguire il report di convalida dell'IaC. Puoi utilizzare gcloud CLI, Cloud Build, Jenkins o GitHub Actions.
Utilizzare Google Cloud CLI per creare un report di convalida IaC
Per creare un report di convalida IaC:
In gcloud CLI, esegui terraform init.
Verifica di eseguire Terraform provider versione v5.5 o successive. Se
necessario, esegui l'upgrade all'ultima versione del provider Google:
terraform init -upgrade
Converti il file del piano Terraform in formato JSON:
terraform plan -out TF_PLAN_FILENAME
terraform show -json TF_PLAN_FILENAME > TF_PLAN_JSON_FILENAME.json
Sostituisci quanto segue:
TF_PLAN_FILENAME: il nome del file di piano Terraform.
TF_PLAN_JSON_FILENAME: il nome del file che
conterrà il piano Terraform in formato JSON.
PARENT: L'organizzazione in cui creare il report di convalida IaC. Google Cloud Il formato è
organizations/ORGANIZATION_ID/locations/LOCATION. LOCATION è global.
TF_PLAN_JSON_FILENAME: il percorso del file JSON
che contiene il piano IaC che vuoi convalidare.
Ad esempio, per creare un report di convalida IaC nell'organizzazione organizations/3589215982/locations/global con un piano IaC incluso in planFile.json, esegui il seguente comando:
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers) (requires [organization-level activation](/security-command-center/docs/activate-scc-overview#overview_of_organization-level_activation))\n\nThis document describes how to validate your [infrastructure as code\n(IaC)](https://en.wikipedia.org/wiki/Infrastructure_as_code) against the\n[organization policies](/resource-manager/docs/organization-policy/overview#organization_policy)\nand\n[Security Health Analytics detectors](/security-command-center/docs/concepts-security-health-analytics#sha-detection-modules)\nthat you have defined in your Google Cloud organization. IaC lets you create and\nmanage your cloud resources using languages such as Terraform so that you can\ndeploy the resources using a development workflow. The IaC validation feature\nsupports organization policies and Security Health Analytics detectors only.\n\nValidating your IaC lets you determine whether your new or modified resource\ndefinitions violate the existing policies that are applied to your\nGoogle Cloud resources (for example, cluster, bucket, or instance). You can\ndefine these policies using [security\npostures](/security-command-center/docs/security-posture-overview), but the IaC validation\nfeature analyzes the code and compares the code against any effective policies\ndefined in postures that are deployed on your Google Cloud organization.\nIaC validation helps your developers identify and fix any security issues in the\nIaC configuration of assets or resources before they are applied to your\nGoogle Cloud environment.\n\nThe IaC validation feature supports Terraform plan files. You can validate your\nTerraform plan using Google Cloud CLI, or you can integrate the validation\nprocess into your Cloud Build, Jenkins, or GitHub Actions developer\nworkflow.\n\nBefore you begin\n\nComplete these tasks to get started with IaC validation.\n\nActivate the Security Command Center Premium tier or Enterprise tier\n\nVerify that the\n[Security Command Center Premium tier or Enterprise tier](/security-command-center/docs/activate-scc-overview)\nis activated at the organization level.\n\nActivating Security Command Center enables the `securityposture.googleapis.com` and\n`securitycentermanagement.googleapis.com` APIs.\n\nSet up permissions\n\n1. Make sure that you have the following role or roles on the organization: Security Posture Shift-Left Validator\n\nCheck for the roles\n\n1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=organizationId)\n2. Select the organization.\n3.\n In the **Principal** column, find all rows that identify you or a group that\n you're included in. To learn which groups you're included in, contact your\n administrator.\n\n4. For all rows that specify or include you, check the **Role** column to see whether the list of roles includes the required roles.\n\nGrant the roles\n\n1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=organizationId)\n2. Select the organization.\n3. Click person_add **Grant access**.\n4.\n In the **New principals** field, enter your user identifier.\n\n This is typically the email address for a Google Account.\n\n5. In the **Select a role** list, select a role.\n6. To grant additional roles, click add **Add\n another role** and add each additional role.\n7. Click **Save**.\n\n\u003cbr /\u003e\n\nFor more information about IaC validation permissions, see\n[IAM for organization-level\nactivations](/security-command-center/docs/access-control-org).\n\nSet up Google Cloud CLI\n\nIn the Google Cloud console, activate Cloud Shell.\n\n[Activate Cloud Shell](https://console.cloud.google.com/?cloudshell=true)\n\n\nAt the bottom of the Google Cloud console, a\n[Cloud Shell](/shell/docs/how-cloud-shell-works)\nsession starts and displays a command-line prompt. Cloud Shell is a shell environment\nwith the Google Cloud CLI\nalready installed and with values already set for\nyour current project. It can take a few seconds for the session to initialize.\n\n\nTo set up the gcloud CLI to use service account impersonation to authenticate to\nGoogle APIs, rather than your user credentials, run the following command: \n\n```bash\ngcloud config set auth/impersonate_service_account SERVICE_ACCT_EMAIL\n```\n\n\nFor more information, see [Service account impersonation](/security-command-center/docs/reference/authentication#sa-impersonation).\n\nDefine your policies\n\nDefine your\n[organization policies](/resource-manager/docs/organization-policy/creating-managing-policies)\nand\n[Security Health Analytics detectors](/security-command-center/docs/concepts-security-health-analytics).\nTo define these policies using a security posture, complete the tasks in\n[Create and deploy a posture](/security-command-center/docs/how-to-use-security-posture#create_and_deploy_a_posture).\n\nCreate your Terraform code\n\nUse your developer workflows and tools to create a Terraform file that includes\nthe Google Cloud assets that you want to create or modify.\n\nConsider the following:\n\n- Populate the parent attribute (the project, folder, or organization) of every resource or asset in the Terraform configuration.\n- Modify assets and policies separately. The API doesn't support validation of Terraform plan files which modify both assets and policies at the same time.\n- Use supported asset types and policies only. For a list of supported asset types and policies, see [Supported asset types and policies for IaC validation](/security-command-center/docs/supported-iac-assets-policies).\n- Review the [limitations for IaC validation](/security-command-center/quotas#infrastructure_as_code_validation_limitations).\n- Don't include sensitive information such as passwords or other personally identifiable information in your Terraform plan file. If the validation feature encounters fields marked as sensitive in the resource changes, the fields are removed.\n\nAfter you create your Terraform code, you can run the IaC validation report. You\ncan use the gcloud CLI,\n[Cloud Build](/security-command-center/docs/iac-validation-cloud-build),\n[Jenkins](/security-command-center/docs/iac-validation-jenkins), or\n[GitHub Actions](/security-command-center/docs/iac-validation-github-actions).\n\nUse Google Cloud CLI to create an IaC validation report\n\nTo create an IaC validation report, complete the following:\n\n1. In gcloud CLI, run `terraform init`.\n\n Verify that you're running Terraform provider version v5.5 or later. If\n required, upgrade to the latest Google provider version: \n\n terraform init -upgrade\n\n2. Convert the Terraform plan file to JSON format:\n\n ```\n terraform plan -out TF_PLAN_FILENAME\n terraform show -json TF_PLAN_FILENAME \u003e TF_PLAN_JSON_FILENAME.json\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eTF_PLAN_FILENAME\u003c/var\u003e: The name for the Terraform plan file.\n - \u003cvar translate=\"no\"\u003eTF_PLAN_JSON_FILENAME\u003c/var\u003e: The name of the file that will contain the Terraform plan in JSON format.\n3. Create the IaC validation report:\n\n ```\n gcloud scc iac-validation-reports create PARENT \\\n --tf-plan-file=TF_PLAN_JSON_FILENAME.json\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePARENT\u003c/var\u003e: The Google Cloud organization in which to create the IaC Validation report. The format is `organizations/`\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e`/locations/`\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e. \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e is `global`.\n - \u003cvar translate=\"no\"\u003eTF_PLAN_JSON_FILENAME\u003c/var\u003e: The path to the JSON file that contains the IaC plan that you want to validate.\n\n For example, to create an IaC validation report under the\n `organizations/3589215982/locations/global` organization with an IaC plan\n included in `planFile.json`, run the following command: \n\n ```\n gcloud scc iac-validation-reports create organizations/3589215982/locations/global --tf-plan-file=planFile.json\n ```\n\n This command returns the operation details for creating the IAC validation\n report. To get information about the operation, see\n [View information about a posture deployment operation](/security-command-center/docs/how-to-use-security-posture#view-operation).\n\nWhat's next\n\n- [Review the sample tutorial](/security-command-center/docs/iac-validation-tutorial).\n- Integrate IaC validation with your [Cloud Build workflow](/security-command-center/docs/iac-validation-cloud-build).\n- Integrate IaC validation with your [GitHub Actions](/security-command-center/docs/iac-validation-github-actions) or your [Jenkins project](/security-command-center/docs/iac-validation-jenkins).\n- [Manage your security posture](/security-command-center/docs/how-to-use-security-posture)."]]
