Bug: Do not stop enumerating project if resource manager is disabled in SA project.
- Dominant language
- Python
- Stars
- 370
- Forks
- 114
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
The scanner fails if the service account token does not have access to list projects via resources manager. When scanning service account keys json files, that includes `project_id`, this may lead to "false positives" as the SA may have access to other services in the current project.
**To Reproduce**
Steps to reproduce the behavior:
1. Create a SA in a project that has Resource Manager disabled, save the credentials to:
`keys/sa.json`:
```
{
"type": "service_account",
"project_id": "my-project-00",
"private_key_id": "",
"private_key": "",
"client_email": "asdfasdf@my-project-00iam.gserviceaccount.com",
"client_id": "",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://accounts.google.com/o/oauth2/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": ""
}
```
and run `python3 -m gcp_scanner --sa-key-path keys -o output -l INFO`
3. This will give you this output:
```
2023-08-07 10:39:53 - INFO - >> current service account: asdfasdf@my-project-00.iam.gserviceaccount.com
2023-08-07 10:39:53 - INFO - Retrieving projects list
2023-08-07 10:39:53 - INFO - Failed to enumerate projects
2023-08-07 10:39:53 - INFO - (, , )
```
**Expected behavior**
When resource manager is disabled, the scanner should not abort enumerating resources in the current project. It still knows one project from the json file, and the impact in that project can be assessed.
**Current behavior**
See steps to reproduce
**Additional context**
Contributor guide
Assessment
This issue has not been assessed yet.