Security Command Center の IaC 検証を GitHub Actions で実行してみた

bootstrap/   # SA・WIF（このセクション。スキャン対象とは別ステート）
terraform/   # スキャン対象（違反する main.tf）

terraform {
  required_version = ">= 1.15"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"
    }
  }
}

variable "project_id" {
  description = "サービスアカウントと WIF プールを作るプロジェクト ID"
  type        = string
}

variable "organization_id" {
  description = "Shift-Left Validator ロールを付与する組織 ID"
  type        = string
}

variable "github_repository" {
  description = "認証を許可する GitHub リポジトリ（owner/repo 形式）"
  type        = string
}

variable "pool_id" {
  description = "Workload Identity プール ID"
  type        = string
  default     = "github-pool"
}

variable "provider_id" {
  description = "Workload Identity プロバイダ ID"
  type        = string
  default     = "github-provider"
}

# 検証用サービスアカウント
resource "google_service_account" "scc_iac_validator" {
  project      = var.project_id
  account_id   = "scc-iac-validator"
  display_name = "SCC IaC Validator"
}

# 組織レベルで Shift-Left Validator ロール（実 ID は reportCreator）を付与
resource "google_organization_iam_member" "report_creator" {
  org_id = var.organization_id
  role   = "roles/securityposture.reportCreator"
  member = "serviceAccount:${google_service_account.scc_iac_validator.email}"
}

# Workload Identity プール
resource "google_iam_workload_identity_pool" "github" {
  project                   = var.project_id
  workload_identity_pool_id = var.pool_id
  display_name              = "GitHub Actions Pool"
}

# GitHub OIDC プロバイダ
resource "google_iam_workload_identity_pool_provider" "github" {
  project                            = var.project_id
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = var.provider_id
  display_name                       = "GitHub Actions Provider"

  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.repository" = "assertion.repository"
  }

  # 指定したリポジトリ以外のトークンを弾く（無いと全リポジトリを信頼してしまう）
  attribute_condition = "assertion.repository == '${var.github_repository}'"

  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}

# 該当リポジトリの principal に workloadIdentityUser を付与
resource "google_service_account_iam_member" "wif_binding" {
  service_account_id = google_service_account.scc_iac_validator.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository/${var.github_repository}"
}

output "workload_identity_provider" {
  description = "ワークフローの workload_identity_provider に指定する値"
  value       = google_iam_workload_identity_pool_provider.github.name
}

output "service_account_email" {
  description = "ワークフローの service_account に指定する値"
  value       = google_service_account.scc_iac_validator.email
}

cd bootstrap
terraform init
terraform apply
terraform output workload_identity_provider

name: IaC Security Scan

on:
  pull_request:
    paths:
      - 'terraform/**'

jobs:
  security-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: 'read'
      id-token: 'write'
    steps:
      - uses: 'actions/checkout@v6'

      - name: 'Authenticate to Google Cloud'
        id: 'auth'
        uses: 'google-github-actions/auth@v3'
        with:
          workload_identity_provider: '${{ secrets.GCP_WIF_PROVIDER }}'
          service_account: '${{ secrets.GCP_SERVICE_ACCOUNT }}'

      - name: 'Set up Terraform'
        uses: 'hashicorp/setup-terraform@v4'
        with:
          terraform_wrapper: false

      - name: 'Generate Terraform Plan'
        env:
          TF_VAR_project_id: '${{ secrets.GCP_PROJECT_ID }}'
        run: |
          cd terraform
          terraform init
          terraform plan -out=tfplan
          terraform show -json tfplan > tf_plan.json

      - name: 'Analyze Code Security'
        id: 'analyze-code-security-scc'
        uses: 'google-github-actions/analyze-code-security-scc@v1'
        with:
          organization_id: '${{ secrets.GCP_ORGANIZATION_ID }}'
          scan_file_ref: './terraform/tf_plan.json'
          iac_type: 'terraform'
          scan_timeout: '3m'
          ignore_violations: false
          failure_criteria: 'Critical:1,High:1,Medium:1,Low:1,Operator:OR'
          fail_silently: false

      - if: |-
          ${{ !cancelled() && steps.analyze-code-security-scc.outputs.iac_scan_result_sarif_path != '' }}
        uses: 'actions/upload-artifact@v7'
        with:
          name: 'sarif'
          path: '${{ steps.analyze-code-security-scc.outputs.iac_scan_result_sarif_path }}'

IaC Scanning Action invoked
Successfully read IaC file from: ./terraform/tf_plan.json, IaC type: terraform
Fetching violations report for IaC file
Processing report generation for violations fetched
##[error]google-github-actions/analyze-code-security-scc, reason: failure_criteria was satisfied.
IaC Scanning completed

{
  "ruleId": "projects/<PROJECT_NUMBER>/locations/global/effectiveSecurityHealthAnalyticsCustomModules/<ID>",
  "message": { "text": "Asset type: compute.googleapis.com/Network has a violation, next steps: Only create networks whose MTU is 1000." },
  "locations": [
    { "logicalLocations": [{ "fullyQualifiedName": "//compute.googleapis.com/projects/<PROJECT_ID>/global/networks/example-network-1" }] }
  ],
  "properties": { "assetType": "compute.googleapis.com/Network" }
}