I m looking at <https docs cerbos dev cerbos latest configur Cerbos Community #help

I'm looking at <https://docs.cerbos.dev/cerbos/lat...

Jesum Yip

11/01/2021, 1:30 AM

I'm looking at https://docs.cerbos.dev/cerbos/latest/configuration/storage.html and I notice for the blob driver I don't see any examples where you can specify credentials for connecting to the blob storage service. Is it assumed that the blob storage service provides unrestricted access to cerbos?

Jesum Yip

11/01/2021, 1:31 AM

Copy code

storage:
  driver: "blob"
  blob:
    bucket: "<gs://my-bucket-name>"
    workDir: ${HOME}/tmp/cerbos/work
    updatePollInterval: 10s

So how do I ensure my blob storage service is only accessible to Cerbos? I don't want prying eyes to see the policies in my blob storage service.

Jesum Yip

11/01/2021, 1:33 AM

With GIT driver, I can see where you need to include credentials.

Copy code

storage:
  driver: "git"
  git:
    protocol: https
    url: <https://github.com/cerbos/policy-test.git>
    branch: main
    subDir: policies
    checkoutDir: ${HOME}/tmp/work/policies
    updatePollInterval: 60s
    operationTimeout: 30s
    https:
      username: cerbos
      password: ${GITHUB_TOKEN}

Dennis (Cerbos)

11/01/2021, 1:34 AM

Credentials are taken from environment.

Dennis (Cerbos)

11/01/2021, 1:37 AM

For example, you can use

GOOGLE_APPLICATION_CREDENTIALS

environment variable to specify service account key

👍 1

Jesum Yip

11/01/2021, 1:44 AM

Is there cerbos documentation that explains this? Can you kindly point me to it?

Jesum Yip

11/01/2021, 1:46 AM

So in the yaml for the storage driver, how do I specify it to use the environment variable? For example with gcs, what do I put in the yaml?

Dennis (Cerbos)

11/01/2021, 1:50 AM

Sorry, the docs do not say much now - we should expand it. The docs might have a reference to the appropriate cloud provider documentation, because Cerbos does not do anything about authentication and delegate this to SDK which takes credentials from environment.

Jesum Yip

11/01/2021, 1:50 AM

Aaah i see. Ok thank you.

Dennis (Cerbos)

11/01/2021, 1:51 AM

Authenticating as a service account https://cloud.google.com/docs/authentication/production

Dennis (Cerbos)

11/01/2021, 1:52 AM

The only exception is that you can add query parameters to the bucket URL:

Copy code

// The following query parameters are supported:
//
//   - access_id: sets Options.GoogleAccessID
//   - private_key_path: path to read for Options.PrivateKey
//
// Currently their use is limited to SignedURL.

Dennis (Cerbos)

11/01/2021, 1:55 AM

This probably sounds obscure unfortunately

Jesum Yip

11/01/2021, 2:37 AM

Jesum Yip

11/01/2021, 2:37 AM

Thanks.

3 Views

Open in Slack

Previous Next