Epic - GCP Permissions Match Conceptual Plan

[mrtopsyt]

Epic - GCP Permissions Match Security Plan

As an engineer concerned about security, I want to make sure that our GCP permissions align with the Conceptual Permissions Plan for payments data.

Acceptance Criteria

Groups

• There are GCP groups on prod and staging linked to MS Entra groups that match the conceptual groups defined in the permissions plan (Set up new security groups to give finer access controls #5268)
  • Admin ~ DDS_Cloud_Admins
  • Cal-ITP Payments Workers ~ DDS_Payments_Admins
  • Agency Payments Users ~ NA (this group only has Metabase access in the plan)
  • Data Workers ~ DOT_DDS_Data_Pipeline_and_Warehouse_Users
  • Data Consumers ~ NA (this group only has Metabase access in the plan)
  • Flex ~ DDS_Warehouse_Users_Flex
  • Public ~ NA
• Group admins can add and remove users from the Entra groups, and know that those users are quickly added and removed from the linked GCP groups on prod and staging (Set up new security groups to give finer access controls #5268, Adding and Removing Users from Entra Groups Affects their GCP Access #5693)

Secrets / Service Accounts

• Only users who are in the Cal-ITP Payments Workers group and Admin group can access secrets that grant non-destructive access to payments data
  • Metabase API keys with payments access (reader/writer keys, agency keys)
  • LPay AWS keys
• Only users who are in the Admin group can access secrets for payments infrastructure
  • Elavon + Enghouse SFTP private keys
  • Metabase Admin Keys
• Only users who are in the Cal-ITP Payments Workers group and Admin group can generate and view keys for payment agency service accounts

Buckets

• There is a list of existing buckets on prod and staging that are important for non-payments analyst work (bucket access is on a whitelist basis, because most buckets are not important for analyst work)
• Users in the Data Workers and Flex groups can only access buckets in the list of buckets that are important for non-payments analyst work
  • On staging
  • On prod
• Buckets that are important for non-payments analyst work do not contain payments data on prod and on staging

Tables

• Users in the Data Workers and Flex groups cannot access external, staging, and mart tables in the payments and benefits groups; they can access all other tables (table access is on a blacklist basis, because sensitive data should always be in those two categories)
  • On staging
  • On prod
• Users in the Cal-ITP Payments Workers and Admin Groups can access all tables
  • On staging
  • On prod

Documentation / Wrap up

• A review has been conducted of other pathways for access to sensitive payments data on prod and on staging
• The Conceptual Permissions Plan is updated with these changes (under Current Status)
• Documentation exists on how to configure permissions for new data sources

[mrtopsyt]

Notes from call w/ Daniel?

• Q: Do we need to scope access to buckets?
  • Yes - Data Workers need access to calitp-analytics-data, calitp-reports-data, etc for their job., but cannot have access to payments buckets
• Q: Do we need to care about read/write access
  • Not really - ideally, the payments workers group could not edit payments buckets, but it is considered low risk due to soft delete policies