feat: add attributes (#6)

add support for google host attributes:
- project_id (Required): The project ID associated with the service account
- zone (Required): The deployment area within a region
disable_credential_rotation (Optional): Disables credential rotation by the plugin
- client_email (Optional): The email address associated with the service account. The email address used to uniquely identify the service account. It is required for authentication and authorization. If it is not set, authentication will fail.
- target_service_account_id (Optional): The unique identifier for the service account that will be impersonated.
- disable_credential_rotation (Optional): Disable the rotation of google service account key associated with the plugin

internal/credential/attributes.go

@@ -11,21 +11,33 @@ import (
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
-// CredentialAttributes contain attributes used for authenticating to Google Cloud
+// CredentialAttributes contain attributes used for authenticating to GCP
 // and accessing a list of instances
 type CredentialAttributes struct {
-	Project string
-	Zone    string
+	// ProjectId is the project id associated with the GCP credentials
+	ProjectId string
+
+	// Zone is the zone  associated with the GCP credentials
+	Zone string
+
+	// DisableCredentialRotation disables the rotation of GCP service account key associated with the plugin
+	DisableCredentialRotation bool
+
+	// ClientEmail is the email associated with the GCP cloud credentials
+	ClientEmail string
+
+	// TargetServiceAccount is the unique identifier for the service account that will be impersonated
+	TargetServiceAccountId string
 }
 
-// GetCredentialAttributes checks attributes required by Google Cloud to access
+// GetCredentialAttributes checks attributes required by GCP to access
 // a list of instances and populate them into Boundary's host catalog
 func GetCredentialAttributes(in *structpb.Struct) (*CredentialAttributes, error) {
 	badFields := make(map[string]string)
 
-	project, err := values.GetStringValue(in, ConstProject, true)
+	projectId, err := values.GetStringValue(in, ConstProjectId, true)
 	if err != nil {
-		badFields[fmt.Sprintf("attributes.%s", ConstProject)] = err.Error()
+		badFields[fmt.Sprintf("attributes.%s", ConstProjectId)] = err.Error()
 	}
 
 	zone, err := values.GetStringValue(in, ConstZone, true)
@@ -33,12 +45,30 @@ func GetCredentialAttributes(in *structpb.Struct) (*CredentialAttributes, error)
 		badFields[fmt.Sprintf("attributes.%s", ConstZone)] = err.Error()
 	}
 
+	disableCredentialRotation, err := values.GetBoolValue(in, ConstDisableCredentialRotation, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstDisableCredentialRotation)] = err.Error()
+	}
+
+	clientEmail, err := values.GetStringValue(in, ConstClientEmail, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstClientEmail)] = err.Error()
+	}
+
+	targetServiceAccountId, err := values.GetStringValue(in, ConstTargetServiceAccountID, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstTargetServiceAccountID)] = err.Error()
+	}
+
 	if len(badFields) > 0 {
 		return nil, errors.InvalidArgumentError("Error in the attributes provider", badFields)
 	}
 
 	return &CredentialAttributes{
-		Project: project,
-		Zone:    zone,
+		ProjectId:                 projectId,
+		Zone:                      zone,
+		DisableCredentialRotation: disableCredentialRotation,
+		ClientEmail:               clientEmail,
+		TargetServiceAccountId:    targetServiceAccountId,
 	}, nil
 }

internal/credential/attributes_test.go

@@ -22,7 +22,7 @@ func TestGetCredentialAttributes(t *testing.T) {
 		{
 			name:                "missing project",
 			in:                  map[string]any{},
-			expectedErrContains: "missing required value \"project\"",
+			expectedErrContains: "missing required value \"project_id\"",
 		},
 		{
 			name:                "missing zone",
@@ -32,12 +32,52 @@ func TestGetCredentialAttributes(t *testing.T) {
 		{
 			name: "valid project and zone",
 			in: map[string]any{
-				ConstProject: "test-project",
-				ConstZone:    "us-central-1",
+				ConstProjectId: "test-project",
+				ConstZone:      "us-central-1",
 			},
 			expected: &CredentialAttributes{
-				Project: "test-project",
-				Zone:    "us-central-1",
+				ProjectId:                 "test-project",
+				Zone:                      "us-central-1",
+				DisableCredentialRotation: false,
+			},
+		},
+		{
+			name: "with disable_credential_rotation",
+			in: map[string]any{
+				ConstDisableCredentialRotation: true,
+				ConstProjectId:                 "test-project",
+				ConstZone:                      "us-central-1",
+			},
+			expected: &CredentialAttributes{
+				DisableCredentialRotation: true,
+				ProjectId:                 "test-project",
+				Zone:                      "us-central-1",
+			},
+		},
+		{
+			name: "with client_email",
+			in: map[string]any{
+				ConstClientEmail: "test@test.com",
+				ConstProjectId:   "test-project",
+				ConstZone:        "us-central-1",
+			},
+			expected: &CredentialAttributes{
+				ClientEmail: "test@test.com",
+				ProjectId:   "test-project",
+				Zone:        "us-central-1",
+			},
+		},
+		{
+			name: "with target_service_account_id",
+			in: map[string]any{
+				ConstTargetServiceAccountID: "test-target-service-account",
+				ConstProjectId:              "test-project",
+				ConstZone:                   "us-central-1",
+			},
+			expected: &CredentialAttributes{
+				TargetServiceAccountId: "test-target-service-account",
+				ProjectId:              "test-project",
+				Zone:                   "us-central-1",
 			},
 		},
 	}
@@ -59,7 +99,7 @@ func TestGetCredentialAttributes(t *testing.T) {
 			}
 
 			require.NoError(err)
-			require.EqualValues(tc.expected.Project, actual.Project)
+			require.EqualValues(tc.expected.ProjectId, actual.ProjectId)
 			require.EqualValues(tc.expected.Zone, actual.Zone)
 		})
 	}

internal/credential/const.go

@@ -4,9 +4,21 @@
 package credential
 
 const (
-	// ConstProject defines the attribute name for a Google Cloud project
-	ConstProject = "project"
+	// ConstProjectId defines the attribute name for a GCP project
+	ConstProjectId = "project_id"
 
-	// ConstZone defines the attribute name for a Google Cloud zone
+	// ConstZone defines the attribute name for a GCP zone
 	ConstZone = "zone"
+
+	// ConstDisableCredentialRotation is the key for the disable credential rotation in the GCP credentials.
+	ConstDisableCredentialRotation = "disable_credential_rotation"
+
+	// ConstCredsLastRotatedTime is the key for the last rotated time in the GCP credentials.
+	ConstCredsLastRotatedTime = "creds_last_rotated_time"
+
+	// ConstClientEmail is the email address associated with the service account
+	ConstClientEmail = "client_email"
+
+	// ConstTargetServiceAccountID is the unique identifier for the service account that will be impersonated.
+	ConstTargetServiceAccountID = "target_service_account_id"
 )