Executive Summary

Firetiger (firetiger.com) is an observability platform currently being evaluated by your organization. Firetiger is deployed within your Organization’s own GCP Project.

Currently, Firetiger cannot be successfully deployed into the organization’s GCP project due to a GCP Organization Policy for Domain Restricted Sharing. This document describes the issue in-depth, and a proposal for how you can update your Organization policy for Firetiger to successfully deploy.

Problem

The Firetiger deployment uses Google Cloud Run as part of its server infrastructure. Some of the Firetiger Cloud Run services - Ingress and Query Servers - are deployed as public HTTP endpoints, with built-in authentication and authorization that is independent of GCP IAM. For this use case, Cloud Run requires these services be configured with IAM policies that grant roles/run.invoker to member allUsers

We’re encountering an issue deploying Firetiger into the the Organization’s GCP Project because the GCP Organization currently has Domain Restricted Sharing enabled. Domain Restricted Sharing prevents Firetiger from deploying these cloud run services in this scenario. The error is roughly:

“One or more users named in the policy do not belong to a permitted customer, perhaps due to an organization policy.”

Google Cloud has the following document describing this exact issue, why its a valid use case, and some solutions: https://cloud.google.com/blog/topics/developers-practitioners/how-create-public-cloud-run-services-when-domain-restricted-sharing-enforced

The main idea is to create/update a Conditional Organization Policy that uses GCP’s Resource Manager Tags to make an exception for explicitly tagged resources to allow the allUsers identity.

Proposed Solution

A Solution, based on the above Google Cloud Documentation:

1. Creates an Organization Tag with key: allUsersIngress, value: True

gcloud resource-manager tags keys create allUsersIngress \
--parent=organizations/YOUR_ORGANIZATION_ID

gcloud resource-manager tags values create True \
--parent=YOUR_ORGANIZATION_ID/allUsersIngress \
--description="Allow for allUsers for internal Cloud Run services"

1. Grant Firetiger’s deployment service account permission to use the Tags: https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing#managing_access
   1. Firetiger Service Account: [email protected]
2. Update your Organization Domain Restricted Sharing Policy to make an exception for this allUsersIngress Resource Manager tag. Ex:

name: organizations/YOUR_ORGANIZATION_ID/policies/iam.allowedPolicyMemberDomains
spec:
  rules:
  # Existing rules
  - values:
      allowedValues:
      - DIRECTORY_CUSTOMER_ID
  # Exception for tagged resources:
  - allowAll: true
    condition:
      expression: resource.matchTag("YOUR_ORGANIZATION_ID/allUsersIngress", "True")
      title: allowAllUsersIngress