davidcueva

gcloud services enable dataproc.googleapis.com sqladmin.googleapis.com \
  cloudkms.googleapis.com

davidcueva

export PROJECT_ID=$(gcloud info --format='value(config.project)')
export REGION=us-central1
export ZONE=us-central1-b

davidcueva

gcloud iam service-accounts create visualization-security-sa \
  --description="Used by products in visualization security" \
  --display-name="Visualization security service account"

davidcueva

bash -c 'array=( dataproc.worker cloudsql.editor cloudkms.cryptoKeyDecrypter )
for i in "${array[@]}"
do
  gcloud projects add-iam-policy-binding ${PROJECT_ID} \
    --member "serviceAccount:visualization-security-sa@${PROJECT_ID}.iam.gserviceaccount.com" \
    --role roles/$i
done'

davidcueva

export CLOUD_SQL_NAME=cloudsql-mysql
gcloud sql instances create ${CLOUD_SQL_NAME} \
  --tier=db-n1-standard-1 --region=${REGION}

davidcueva

gcloud sql users set-password root \
  --host=% --instance ${CLOUD_SQL_NAME} --password mysql-root-password-99

davidcueva

gcloud kms keyrings create my-keyring --location global

davidcueva

gcloud kms keys create my-key \
  --location global \
  --keyring my-keyring \
  --purpose encryption

davidcueva

echo "ranger-admin-password-99" | \
gcloud kms encrypt \
  --location=global \
  --keyring=my-keyring \
  --key=my-key \
  --plaintext-file=- \
  --ciphertext-file=ranger-admin-password.encrypted

davidcueva

echo "ranger-db-admin-password-99" | \
gcloud kms encrypt \
  --location=global \
  --keyring=my-keyring \
  --key=my-key \
  --plaintext-file=- \
  --ciphertext-file=ranger-db-admin-password.encrypted