chore: use less privilege roles for ci service account (#113)

GoogleCloudPlatform · Jan 2, 2025 · 9c8cb6e · 9c8cb6e
1 parent 6294316
commit 9c8cb6e
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 3 deletions.
diff --git a/examples/kms/main.tf b/examples/kms/main.tf
@@ -38,10 +38,16 @@ resource "google_project_service_identity" "secretmanager_identity" {
   service  = "secretmanager.googleapis.com"
 }
 
+resource "time_sleep" "wait_service_identity_propagation" {
+  depends_on      = [google_project_service_identity.secretmanager_identity]
+  create_duration = "180s"
+}
+
 resource "google_kms_crypto_key_iam_member" "sm_sa_encrypter_decrypter" {
   role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
   member        = "serviceAccount:${google_project_service_identity.secretmanager_identity.email}"
   crypto_key_id = google_kms_crypto_key.crypto_key.id
+  depends_on    = [time_sleep.wait_service_identity_propagation]
 }
 
 module "secret-manager" {

diff --git a/metadata.yaml b/metadata.yaml
@@ -96,7 +96,9 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
+          - roles/secretmanager.admin
+          - roles/cloudkms.admin
+          - roles/pubsub.admin
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

diff --git a/modules/simple-secret/metadata.yaml b/modules/simple-secret/metadata.yaml
@@ -125,7 +125,9 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
+          - roles/secretmanager.admin
+          - roles/cloudkms.admin
+          - roles/pubsub.admin
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

diff --git a/test/setup/iam.tf b/test/setup/iam.tf
@@ -16,7 +16,9 @@
 
 locals {
   int_required_roles = [
-    "roles/owner"
+    "roles/secretmanager.admin",
+    "roles/cloudkms.admin",
+    "roles/pubsub.admin",
   ]
 }