Exercise5: Secure your CI/CD pipeline

Goal

Try to secure CI/CD pipeline from attacks and understand the limitation

Exercises

Configure Branch Protection
- Caution: GitHub Free version doesn't support it. You need to use GitHub Pro or Team
Configure OIDC, then try keyless between GitHub actions and Google Cloud

Additional Exercises

Enter GitHub Actions using Tailscale and reverseshell (The procedure is in the slide)
Steal Google Service Account Token in the keyless environment
Steal IaC's CI(read) token, then see tfstate file on Google Storage
- Then Consider what role CI should have to do Least Privilege policy

Exercises procedure

1. Configure Branch Protection

Target Repository: devenv-security-iac

2. Configure OIDC, then try keyless between GitHub actions and Google Cloud

Target Repository: devenv-security-iac
Rename google_actions_oidc.tf_ to google_actions_oidc.tf (devenv-security-iac/terraform/training-project/)
- Change these lines. (Replace <github org or name> to Your Github Org or Name)
```
  # You need to modify this value
  locals {
    app_repo_name = "<github org or name>/devenv-security-app"
    iac_repo_name = "<github org or name>/devenv-security-iac"
  }
```
- It enables Workload Federation

Modify Iac's Actions Workflows
- devenv-security-iac/.github/workflows/apply.yaml, devenv-security-iac/.github/workflows/plan.yaml
  - Uncomment id-token: 'write'
  - Comment out credentials_json
  - Uncomment workload_identity_provider: 'projects/<Project Number>/locations/global/workloadIdentityPools/training-pool/providers/training-provider'
    - Replace <Project Number> to Your Project Number
  - Uncomment service_account: 'iac-actions-cd@<Project ID>.iam.gserviceaccount.com'
    - Replace <Project ID> to Your Project ID
You can do the same thing to App too.