Prerequisites¶

This section outlines the prerequisites for setting up the Discovery scanning feature for GCP Cloud SQL PostgreSQL.

Here are some of the prerequisites for setting up the Discovery scanning feature for GCP Cloud SQL PostgreSQL:

• The Cloud SQL PostgreSQL instance must have a private IP in a VPC network that is reachable from the GKE cluster where Privacera is deployed.

• The Cloud SQL Admin API and the IAM Service Account Credentials API must be enabled in the Google Cloud project.

  Enable the required APIs

  Bash
  1	gcloud services enable sqladmin.googleapis.com iamcredentials.googleapis.com --project=<project-id>

• IAM database authentication must be enabled on the instance by setting the cloudsql.iam_authentication database flag to on.

  Enable IAM database authentication

  Bash
  1	gcloud sql instances patch <instance-name> --database-flags=cloudsql.iam_authentication=on

  Warning

  The --database-flags option replaces all existing database flags on the instance. If other flags are already set, include them in the same command.

• Identify the service account to be used for connecting to the database. The recommendation is to create a dedicated service account and allow the Discovery and Portal pods to impersonate it. To allow impersonation, grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the dedicated service account to the Workload Identity used by the Discovery and Portal pods.

  Grant the Service Account Token Creator role

  Bash
  1 2 3	gcloud iam service-accounts add-iam-policy-binding <sa-name>@<project-id>.iam.gserviceaccount.com \ --member="<privacera-pod-identity>" \ --role="roles/iam.serviceAccountTokenCreator"

  If the Discovery and Portal pods use different identities, run the command for each identity.

  Info

  Alternatively, if the Kubernetes service accounts of the Discovery and Portal pods are already annotated with a Google service account (iam.gke.io/gcp-service-account), you can use that service account directly and skip the impersonation setup. Do not add or change this annotation only for Cloud SQL access, as it changes the identity used by Discovery for all Google Cloud services, such as Bigtable, Cloud Storage, and Pub/Sub.

• Grant the Cloud SQL Client (roles/cloudsql.client) and Cloud SQL Instance User (roles/cloudsql.instanceUser) roles to the service account.

  Grant the Cloud SQL roles

  Bash
  1 2 3 4 5 6 7	gcloud projects add-iam-policy-binding <project-id> \ --member="serviceAccount:<sa-name>@<project-id>.iam.gserviceaccount.com" \ --role="roles/cloudsql.client" gcloud projects add-iam-policy-binding <project-id> \ --member="serviceAccount:<sa-name>@<project-id>.iam.gserviceaccount.com" \ --role="roles/cloudsql.instanceUser"

• Add the service account to the instance as an IAM database user, and grant it read permission on the schemas to be scanned.

  Create the IAM database user and grant permissions

  Bash
  1 2 3	gcloud sql users create <sa-name>@<project-id>.iam \ --instance=<instance-name> \ --type=cloud_iam_service_account

  Run the following for each schema to be scanned, for example public:

  SQL
  1 2 3	GRANT CONNECT ON DATABASE <database-name> TO "<sa-name>@<project-id>.iam"; GRANT USAGE ON SCHEMA <schema-name> TO "<sa-name>@<project-id>.iam"; GRANT SELECT ON ALL TABLES IN SCHEMA <schema-name> TO "<sa-name>@<project-id>.iam";

  To include tables created later, also run:

  SQL
  1 2	ALTER DEFAULT PRIVILEGES FOR ROLE <table-owner-role> IN SCHEMA <schema-name> GRANT SELECT ON TABLES TO "<sa-name>@<project-id>.iam";