為了從谷歌云存儲桶中刪除身份，我使用了 GCP 示例存儲庫中提供的示例：此處。我想知道我是否遺漏了什么，我有正確的云帳戶根憑據，以及項目所有權憑據?；旧希瑒h除操作不會同時來自Java代碼和使用gsutil來自gcpWeb 控制臺的功能。這是原始政策：Policy{ bindings= { roles/storage.legacyBucketOwner= [ projectOwner:csbauditor ], roles/storage.objectAdmin= [ serviceAccount:[email protected], serviceAccount:[email protected], serviceAccount:[email protected], serviceAccount:[email protected], serviceAccount:customer-0c1e8536-8bf5-46f4-8e@csbauditor.iam.gserviceaccount.com, serviceAccount:[email protected], serviceAccount:[email protected], serviceAccount:[email protected], serviceAccount:[email protected], serviceAccount:[email protected], serviceAccount:customer-6a53ee71-95eb-49b2-8a@csbauditor.iam.gserviceaccount.com, serviceAccount:[email protected] ], roles/storage.legacyBucketReader= [ projectViewer:csbauditor ], roles/storage.objectViewer= [ serviceAccount:[email protected] ] }, etag=CLgE, version=0 }這是寫入 IAM 之前的第二個策略版本： Policy{ bindings= { roles/storage.legacyBucketOwner= [ projectOwner:csbauditor ],
1 回答
小怪獸愛吃肉
TA貢獻1852條經驗 獲得超1個贊
我在您的代碼中發現了問題。雖然我不能完全確定這是唯一的問題，因為我無法編譯您的代碼，但我也不得不更改幾個類。
在我能夠編譯并運行代碼后，我注意到即使執行了“刪除”功能，也沒有真正發生任何事情，在打印了幾張之后，我注意到它正在嘗試使用錯誤的“角色”刪除服務帳戶，因為您正在更改“for”循環中的“role”值，如果“set”不等于“attacker-service-account”，則循環進行另一次迭代并更改“role”值。
這是我班級的代碼（對示例片段的修改）：
package com.google.cloud.examples.storage.snippets;
import com.google.cloud.Identity;
import com.google.cloud.Policy;
import com.google.cloud.Role;
import com.google.cloud.storage.Storage;
import com.google.cloud.storage.StorageOptions;
import com.google.cloud.storage.StorageRoles;
import java.util.Map;
import java.util.Set;
import java.util.Arrays;
import java.util.HashMap;
import java.util.HashSet;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
/** This class contains Bucket-level IAM snippets for the {@link Storage} interface. */
public class BucketIamSnippets {
? /** Example of listing the Bucket-Level IAM Roles and Members */
? public Policy listBucketIamMembers(String bucketName) {
? ? // [START view_bucket_iam_members]
? ? // Initialize a Cloud Storage client
? ? Storage storage = StorageOptions.getDefaultInstance().getService();
? ? // Get IAM Policy for a bucket
? ? Policy policy = storage.getIamPolicy(bucketName);
? ? // Print Roles and its identities
? ? Map<Role, Set<Identity>> policyBindings = policy.getBindings();
? ? for (Map.Entry<Role, Set<Identity>> entry : policyBindings.entrySet()) {
? ? ? System.out.printf("Role: %s Identities: %s\n", entry.getKey(), entry.getValue());
? ? }
? ? // [END view_bucket_iam_members]
? ? return policy;
? }
? /** Example of adding a member to the Bucket-level IAM */
? public Policy addBucketIamMember(String bucketName, Role role, Identity identity) {
? ? // [START add_bucket_iam_member]
? ? // Initialize a Cloud Storage client
? ? Storage storage = StorageOptions.getDefaultInstance().getService();
? ? // Get IAM Policy for a bucket
? ? Policy policy = storage.getIamPolicy(bucketName);
? ? // Add identity to Bucket-level IAM role
? ? Policy updatedPolicy =
? ? ? ? storage.setIamPolicy(bucketName, policy.toBuilder().addIdentity(role, identity).build());
? ? if (updatedPolicy.getBindings().get(role).contains(identity)) {
? ? ? System.out.printf("Added %s with role %s to %s\n", identity, role, bucketName);
? ? }
? ? // [END add_bucket_iam_member]
? ? return updatedPolicy;
? }
? public static void removeUserFromBucketUsingEmail(String bucketName, Role role, String email)? {
? ? ? ? Storage storage = StorageOptions.getDefaultInstance().getService();?
? ? ? ? Policy policy = storage.getIamPolicy(bucketName);
? ? ? ? Identity identity = Identity.serviceAccount(email);
? ? ? ? String eTag = policy.getEtag();
? ? ? ? System.out.println("etag: " + eTag);
? ? ? ? Policy updatedPolicy = storage.setIamPolicy(bucketName, policy.toBuilder().removeIdentity(role, identity).build());
? ? if (updatedPolicy.getBindings().get(role) == null
? ? ? ? || !updatedPolicy.getBindings().get(role).contains(identity)) {
? ? ? System.out.printf("Removed %s with role %s from %s\n", identity, role, bucketName);
? ? }
? ? }
public static void main(String... args) throws Exception {
? ? try
? ? {
? ? String bucketName = "my-bucket-name";
? ? BucketIamSnippets obj = new BucketIamSnippets ();
? ? Role role_admin = StorageRoles.objectAdmin();
? ? String acc_1 = "[email protected]";
? ? String acc_2 = "[email protected]";
? ? Identity identity_1 = Identity.serviceAccount(acc_1);
? ? Identity identity_2 = Identity.serviceAccount(acc_2);
? ? ?System.out.println(obj.addBucketIamMember (bucketName, role_admin, identity_1 ));
? ? ?System.out.println(obj.addBucketIamMember (bucketName, role_admin, identity_2 ));
? ? ? Storage storage = StorageOptions.getDefaultInstance().getService();
? ? ? ? Policy policy = storage.getIamPolicy(bucketName);
? ? ? ? System.out.println(policy);
? ? ? ? //List<Role> roleList = new ArrayList<>();
? ? ? ? List<Set<Identity>> identities = new ArrayList<>();
? ? ? ? // Print Roles and its identities
? ? ? ? Set<Identity> wrongIdentities = new HashSet<Identity>();
? ? ? ? Role aux = null;
? ? ? ? Map<Role, Set<Identity>> policyBindings = policy.getBindings();
? ? ? ? Set<Identity> setidentities = new HashSet<>();
? ? ? ? for (Map.Entry<Role, Set<Identity>> entry : policyBindings.entrySet()) {
? ? ? ? ? ? aux = entry.getKey();
? ? ? ? ? ? System.out.println("role plain " + aux);
? ? ? ? ? ? System.out.println("role other? " + aux.getValue());
? ? ? ? ? ? if (aux.getValue().equals("roles/storage.objectAdmin")) {
? ? ? ? ? ? ? ? System.out.println("role :" + aux.getValue());
? ? ? ? ? ? ? ? System.out.println("Identities getV :" + entry.getValue());
? ? ? ? ? ? ? ? System.out.println("Identities getK :" + entry.getKey());
? ? ? ? ? ? ? ? setidentities = entry.getValue();
? ? ? ? ? ? ? ? System.out.println("setidentities? :" + setidentities);
? ? ? ? ? ? ? ? System.out.println("setidentities size :" + setidentities.size());
? ? ? ? ? ? ? ? for (Identity set : setidentities) {
? ? ? ? ? ? ? ? ? ? if ((set.equals("serviceAccount: [email protected]"))) {
? ? ? ? ? ? ? ? ? ? ? ? System.out.println("strong one : " + set);
? ? ? ? ? ? ? ? ? ? ? ? continue;
? ? ? ? ? ? ? ? ? ? } else {
? ? ? ? ? ? ? ? ? ? ? ? wrongIdentities.add(set);
? ? ? ? ? ? ? ? ? ? ? ? System.out.println("strong one : " + set);
? ? ? ? ? ? ? ? ? ? }
? ? ? ? ? ? ? ? ? ? System.out.println("wrongIdentities.size() : " + wrongIdentities.size());
? ? ? ? ? ? ? ? }
? ? ? ? ? ? }
? ? ? ? }
? ? ? ? System.out.println("ww " + wrongIdentities);
? ? ? ? System.out.println("policyEtag " + policy.getEtag());
? ? ? ? //GCSFunctions function = new GCSFunctions();?
? ? ? ? for (Identity identity : wrongIdentities) {
? ? ? ? ? ? BucketIamSnippets.removeUserFromBucketUsingEmail(bucketName, role_admin, identity.getValue());
? ? ? ? }
? ? }
? ? catch (Exception e)
? ? {
? ? ? ? e.printStackTrace ();
? ? }
}
}
筆記：
我添加了兩個測試服務帳戶，然后運行您的代碼（稍作修改）。
我直接將“角色”初始化為 objectAdmin，這就是我傳遞給刪除函數的內容。
修改代碼以符合您的實際用例。
我用示例中使用的相同依賴項編譯了它
添加回答
舉報
0/150
提交
取消