🧹 Resolve secret for each provider config in GCP (#867)

Initially, the idea was to copy the resolved secret over to the cloned provider configs. That is not ideal since it requires other changes as well. After a discussion with @chris-rock we concluded that resolving secrets multiple times is a vault problem, not a provider problem. This PR makes sure that scanning GCP assets work. In a follow up PR I will address the issue with the retrieval of the same secret multiple times. Signed-off-by: Ivan Milchev <[email protected]>
mondoohq · Feb 1, 2023 · 8568a0b · 8568a0b
1 parent ca8ceef
commit 8568a0b
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 14 deletions.
diff --git a/motor/discovery/gcp/mql_assets.go b/motor/discovery/gcp/mql_assets.go
@@ -1,6 +1,7 @@
 package gcp
 
 import (
+	"context"
 	"errors"
 
 	"github.com/mitchellh/mapstructure"
@@ -13,6 +14,7 @@ import (
 	"go.mondoo.com/cnquery/motor/platform"
 	"go.mondoo.com/cnquery/motor/providers"
 	gcpprovider "go.mondoo.com/cnquery/motor/providers/google"
+	"go.mondoo.com/cnquery/motor/providers/resolver"
 	"go.mondoo.com/cnquery/mql"
 	"go.mondoo.com/cnquery/resources"
 	resource_pack "go.mondoo.com/cnquery/resources/packs/gcp"
@@ -54,14 +56,21 @@ func (md *MqlDiscovery) GetList(query string) []interface{} {
 	return a
 }
 
-func GatherAssets(tc *providers.Config, project string) ([]*asset.Asset, error) {
+func GatherAssets(ctx context.Context, tc *providers.Config, project string, cfn common.CredentialFn) ([]*asset.Asset, error) {
 	assets := []*asset.Asset{}
+	// Note: we use the resolver instead of the direct gcp_provider.New to resolve credentials properly
 	pCfg := tc.Clone()
-	at, err := gcpprovider.New(pCfg)
+	motor, err := resolver.NewMotorConnection(ctx, pCfg, cfn)
 	if err != nil {
 		return nil, err
 	}
-	m, err := NewMQLAssetsDiscovery(at)
+	defer motor.Close()
+
+	provider, ok := motor.Provider.(*gcpprovider.Provider)
+	if !ok {
+		return nil, errors.New("could not create gcp provider")
+	}
+	m, err := NewMQLAssetsDiscovery(provider)
 	if err != nil {
 		return nil, err
 	}

diff --git a/motor/discovery/gcp/resolver_project.go b/motor/discovery/gcp/resolver_project.go
@@ -51,11 +51,6 @@ func (r *GcpProjectResolver) Resolve(ctx context.Context, tc *providers.Config,
 		return nil, errors.New("could not create gcp provider")
 	}
 
-	// If there is a service account provided in the inventory, resolve it and then copy it to the provider config we use
-	if len(tc.Credentials) != 0 {
-		tc.Credentials[0] = provider.GetCredential()
-	}
-
 	identifier, err := provider.Identifier()
 	if err != nil {
 		return nil, err
@@ -95,7 +90,7 @@ func (r *GcpProjectResolver) Resolve(ctx context.Context, tc *providers.Config,
 		DiscoveryGkeClusters,
 		DiscoveryStorageBuckets,
 		DiscoveryBigQueryDatasets) {
-		assetList, err := GatherAssets(tc, project)
+		assetList, err := GatherAssets(ctx, tc, project, cfn)
 		if err != nil {
 			return nil, err
 		}

diff --git a/motor/providers/google/provider.go b/motor/providers/google/provider.go
@@ -10,7 +10,6 @@ import (
 	"go.mondoo.com/cnquery/motor/providers"
 	"go.mondoo.com/cnquery/motor/providers/os/fsutil"
 	"go.mondoo.com/cnquery/motor/vault"
-	"google.golang.org/protobuf/proto"
 )
 
 var (
@@ -144,10 +143,6 @@ type Provider struct {
 	platformOverride      string
 }
 
-func (p *Provider) GetCredential() *vault.Credential {
-	return proto.Clone(p.cred).(*vault.Credential)
-}
-
 func (p *Provider) FS() afero.Fs {
 	return &fsutil.NoFs{}
 }