kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add conditional grants on security to pf service account in FAST stage 0 (#3338)

Browse Source
This commit is contained in:
norbert-loderer
2025-09-19 06:15:05 +00:00
committed by GitHub
parent ec09e2800a
commit 2aae7b3ab6
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
fast/stages/0-org-setup/data/folders/security/.config.yaml
View File

@@ -26,3 +26,19 @@ iam_by_principals:
- roles/viewer
- roles/resourcemanager.folderViewer
- roles/resourcemanager.tagViewer
$iam_principals:service_accounts/iac-0/iac-pf-rw:
- roles/cloudkms.cryptoKeyEncrypterDecrypter
$iam_principals:service_accounts/iac-0/iac-pf-ro:
- roles/cloudkms.viewer
- $custom_roles:project_iam_viewer
iam_bindings:
project_factory:
role: roles/resourcemanager.projectIamAdmin
members:
- $iam_principals:service_accounts/iac-0/iac-pf-rw
condition:
title: Project factory delegated IAM grant.
expression: |
api.getAttribute('iam.googleapis.com/modifiedGrantsByRole', []).hasOnly([
'roles/cloudkms.cryptoKeyEncrypterDecrypter'
])