<commit_before>/**
 * Copyright 2020 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

# The notebook-compute-sa provides the underlying policies that the compute uses to access other resources
# within the project for the data scientist.  
#
# The data scientist should not be given the ability to become an SA.  Instead, they should be given
# OSLogin role and SSH into the notebook
resource "google_service_account" "sa_p_notebook_compute" {
  project      = var.project_trusted_analytics
  account_id   = "sa-p-notebook-compute"
  display_name = "Notebooks in trusted environment"

  depends_on = [module.structure]
}


# grant trusted data scientists the ability to access notebooks thru UI
# established through IAP.
resource "google_service_account_iam_binding" "iam_trusted_scientists" {
  service_account_id = google_service_account.sa_p_notebook_compute.name
  role               = "roles/iam.serviceAccountUser"

  members = var.trusted_scientists
}

# We are giving privileges to the notebook-compute service account
# Compute: compute.instanceAdmin
#    - gce instance adminsitration, shieldedVM, osLogin
# Data
#   - Big Query: roles/bigquery.dataViewer
#       - read data
#   - Big Query: roles/bigquery.jobuser
#       - run BQ jobs and queries
#   - (optional) Storage: roles/storage.objectAdmin
#       - create and destroy temporary buckets to manage state
#   - Pub/Sub: @TODO
#       - receive de-id values for analysis
# Notebooks: roles/notebooks.admin
resource "google_project_iam_member" "notebook_instance_compute" {
  project = var.project_trusted_analytics
  role    = "roles/compute.instanceAdmin"
  member  = "serviceAccount:${google_service_account.sa_p_notebook_compute.email}"
}

// create custom role from dataViewer that doesn't allow export
// Note: resourcemanager.projects.list is not applicable at project level, but is assigned in the BQ DataViewer predefined role (org level)
resource "google_project_iam_custom_role" "role_restricted_data_viewer" {
  project     = var.project_trusted_data
  role_id     = "blueprint_restricted_data_viewer"
  title       = "Restricted Data Viewer"
  description = "BQ Data Viewer role with export removed"
  permissions = [
    "bigquery.datasets.get",
    "bigquery.datasets.getIamPolicy",
    "bigquery.models.getData",
    "bigquery.models.getMetadata",
    "bigquery.models.list",
    "bigquery.routines.get",
    "bigquery.routines.list",
    "bigquery.tables.get",
    "bigquery.tables.getData",
    "bigquery.tables.getIamPolicy",
    "bigquery.tables.list",
    "resourcemanager.projects.get"
  ]
}

resource "google_project_iam_member" "notebook_instance_bq_job" {
  project = var.project_trusted_analytics
  role    = "roles/bigquery.jobUser"
  member  = "serviceAccount:${google_service_account.sa_p_notebook_compute.email}"
}

resource "google_project_iam_member" "notebook_instance_bq_session" {
  project = var.project_trusted_analytics
  role    = "roles/bigquery.readSessionUser"
  member  = "serviceAccount:${google_service_account.sa_p_notebook_compute.email}"
}

resource "google_project_iam_member" "notebook_instance_caip" {
  project = var.project_trusted_analytics
  role    = "roles/notebooks.admin"
  member  = "serviceAccount:${google_service_account.sa_p_notebook_compute.email}"
}

# (optional) uncomment this block, if you desire your data scientist to have code within their notebooks
# that can create a temporary gcs bucket
# resource "google_project_iam_member" "notebook-instance-gcs" {
#   project = var.project
#   role    = "roles/storage.objectAdmin"
#   member  = "serviceAccount:${google_service_account.notebook-compute-sa.email}"
# }
<commit_msg>add project list permission to custom role (#23)<commit_after>/**
 * Copyright 2020 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

# The notebook-compute-sa provides the underlying policies that the compute uses to access other resources
# within the project for the data scientist.  
#
# The data scientist should not be given the ability to become an SA.  Instead, they should be given
# OSLogin role and SSH into the notebook
resource "google_service_account" "sa_p_notebook_compute" {
  project      = var.project_trusted_analytics
  account_id   = "sa-p-notebook-compute"
  display_name = "Notebooks in trusted environment"

  depends_on = [module.structure]
}


# grant trusted data scientists the ability to access notebooks thru UI
# established through IAP.
resource "google_service_account_iam_binding" "iam_trusted_scientists" {
  service_account_id = google_service_account.sa_p_notebook_compute.name
  role               = "roles/iam.serviceAccountUser"

  members = var.trusted_scientists
}

# We are giving privileges to the notebook-compute service account
# Compute: compute.instanceAdmin
#    - gce instance adminsitration, shieldedVM, osLogin
# Data
#   - Big Query: roles/bigquery.dataViewer
#       - read data
#   - Big Query: roles/bigquery.jobuser
#       - run BQ jobs and queries
#   - (optional) Storage: roles/storage.objectAdmin
#       - create and destroy temporary buckets to manage state
#   - Pub/Sub: @TODO
#       - receive de-id values for analysis
# Notebooks: roles/notebooks.admin
resource "google_project_iam_member" "notebook_instance_compute" {
  project = var.project_trusted_analytics
  role    = "roles/compute.instanceAdmin"
  member  = "serviceAccount:${google_service_account.sa_p_notebook_compute.email}"
}

// create custom role from dataViewer that doesn't allow export
// Note: resourcemanager.projects.list is not applicable at project level, but is assigned in the BQ DataViewer predefined role (org level)
resource "google_project_iam_custom_role" "role_restricted_data_viewer" {
  project     = var.project_trusted_data
  role_id     = "blueprint_restricted_data_viewer"
  title       = "Restricted Data Viewer"
  description = "BQ Data Viewer role with export removed"
  permissions = [
    "bigquery.datasets.get",
    "bigquery.datasets.getIamPolicy",
    "bigquery.models.getData",
    "bigquery.models.getMetadata",
    "bigquery.models.list",
    "bigquery.routines.get",
    "bigquery.routines.list",
    "bigquery.tables.get",
    "bigquery.tables.getData",
    "bigquery.tables.getIamPolicy",
    "bigquery.tables.list",
    "resourcemanager.projects.get",
    "resourcemanager.projects.list"
  ]
}

resource "google_project_iam_member" "notebook_instance_bq_job" {
  project = var.project_trusted_analytics
  role    = "roles/bigquery.jobUser"
  member  = "serviceAccount:${google_service_account.sa_p_notebook_compute.email}"
}

resource "google_project_iam_member" "notebook_instance_bq_session" {
  project = var.project_trusted_analytics
  role    = "roles/bigquery.readSessionUser"
  member  = "serviceAccount:${google_service_account.sa_p_notebook_compute.email}"
}

resource "google_project_iam_member" "notebook_instance_caip" {
  project = var.project_trusted_analytics
  role    = "roles/notebooks.admin"
  member  = "serviceAccount:${google_service_account.sa_p_notebook_compute.email}"
}

# (optional) uncomment this block, if you desire your data scientist to have code within their notebooks
# that can create a temporary gcs bucket
# resource "google_project_iam_member" "notebook-instance-gcs" {
#   project = var.project
#   role    = "roles/storage.objectAdmin"
#   member  = "serviceAccount:${google_service_account.notebook-compute-sa.email}"
# }

{'fraction_non_alphanumeric': 0.08471367723615712, 'fraction_numerical': 0.002129673450070989, 'mean_word_length': 4.380649267982177, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1152776', 'n_tokens_mistral': 2546, 'n_tokens_neox': 2498, 'n_words': 696}