GCP Service Account LastAuthentication using PolicyAnalyzer API

main.go

package main

import (
	"encoding/json"
	"flag"
	"fmt"

	"golang.org/x/net/context"
	"google.golang.org/api/policyanalyzer/v1"
)

const (
	activityTypeAuthentication    = "serviceAccountLastAuthentication"
	activityTypeKeyAuthentication = "serviceAccountKeyLastAuthentication"
)

type serviceAccountLastAuthentication struct {
	LastAuthenticatedTime string `json:"lastAuthenticatedTime"`
	ServiceAccount        struct {
		FullResourceName string `json:"fullResourceName"`
		ProjectNumber    string `json:"projectNumber"`
		ServiceAccountId string `json:"serviceAccountId"`
	} `json:"serviceAccount,omitempty"`
	ServiceAccountKey struct {
		FullResourceName string `json:"fullResourceName"`
		ProjectNumber    string `json:"projectNumber"`
		ServiceAccountId string `json:"serviceAccountId"`
	} `json:"serviceAccountKey,omitempty"`
}

var (
	projectID = flag.String("projectID", "fabled-ray-104117", "projectID")

	location = flag.String("location", "global", "location")

	serviceAccountName  = flag.String("projecserviceAccountNametID", "[email protected]", "svc account key name")
	serviceAccountKeyId = flag.String("serviceAccountKeyId", "ea5f19177b3b26cac9bd1f3a9458c7e48223d999", "svc account key id")
)

func main() {

	flag.Parse()
	parent := fmt.Sprintf("projects/%s/locations/%s/activityTypes/%s", *projectID, *location, activityTypeAuthentication)
	filter := fmt.Sprintf("activities.full_resource_name=\"//iam.googleapis.com/projects/%s/serviceAccounts/%s\"", *projectID, *serviceAccountName)

	// parent := fmt.Sprintf("projects/%s/locations/%s/activityTypes/%s", *projectID, *location, *activityTypeKeyAuthentication)
	// filter := fmt.Sprintf("activities.full_resource_name=\"//iam.googleapis.com/projects/%s/serviceAccounts/%s/keys/%s\"", *projectID, *serviceAccountName, *serviceAccountKeyId)

	ctx := context.Background()
	policyanalyzerService, err := policyanalyzer.NewService(ctx)
	if err != nil {
		fmt.Printf("%v", err)
		return
	}

	err = policyanalyzerService.Projects.Locations.ActivityTypes.Activities.Query(parent).Filter(filter).Pages(ctx, func(g *policyanalyzer.GoogleCloudPolicyanalyzerV1QueryActivityResponse) error {
		for _, m := range g.Activities {
			fmt.Printf("%s ObservationPeriod: (%s --> %s)\n", m.ActivityType, m.ObservationPeriod.StartTime, m.ObservationPeriod.EndTime)

			b, err := m.Activity.MarshalJSON()
			if err != nil {
				return err
			}
			var s serviceAccountLastAuthentication
			err = json.Unmarshal(b, &s)
			if err != nil {
				return err
			}
			if m.ActivityType == activityTypeAuthentication {
				fmt.Printf("ServiceAccount.LastAuthenticatedTime %s\n", s.LastAuthenticatedTime)
			} else if m.ActivityType == activityTypeKeyAuthentication {
				fmt.Printf("ServiceAccountKey.LastAuthenticatedTime %s\n", s.LastAuthenticatedTime)
			}

		}
		return nil
	})

	if err != nil {
		fmt.Printf("%v", err)
		return
	}

}