chore: use less privilege roles for ci service account (#965)

terraform-google-modules · Jan 2, 2025 · c42536c · c42536c
1 parent b3e801f
commit c42536c
Show file tree

Hide file tree

Showing 11 changed files with 1 addition and 20 deletions.
diff --git a/Makefile b/Makefile
@@ -90,6 +90,7 @@ docker_test_lint:
 .PHONY: docker_generate_docs
 docker_generate_docs:
 	docker run --rm -it \
+		-e ENABLE_BPMETADATA \
 		-v "${CURDIR}":/workspace \
 		$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
 		/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs'

diff --git a/metadata.yaml b/metadata.yaml
@@ -361,15 +361,13 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/budget/metadata.yaml b/modules/budget/metadata.yaml
@@ -127,15 +127,13 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/essential_contacts/metadata.yaml b/modules/essential_contacts/metadata.yaml
@@ -84,15 +84,13 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/fabric-project/metadata.yaml b/modules/fabric-project/metadata.yaml
@@ -158,15 +158,13 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/gsuite_enabled/metadata.yaml b/modules/gsuite_enabled/metadata.yaml
@@ -255,15 +255,13 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/project_services/metadata.yaml b/modules/project_services/metadata.yaml
@@ -109,15 +109,13 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/quota_manager/metadata.yaml b/modules/quota_manager/metadata.yaml
@@ -84,15 +84,13 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/shared_vpc_access/metadata.yaml b/modules/shared_vpc_access/metadata.yaml
@@ -111,15 +111,13 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/svpc_service_project/metadata.yaml b/modules/svpc_service_project/metadata.yaml
@@ -242,15 +242,13 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/test/setup/iam.tf b/test/setup/iam.tf
@@ -16,7 +16,6 @@
 
 locals {
   int_required_project_roles = [
-    "roles/owner",
     "roles/compute.admin",
     "roles/iam.serviceAccountAdmin",
     "roles/resourcemanager.projectIamAdmin",
@@ -26,7 +25,6 @@ locals {
   ]
 
   int_required_folder_roles = [
-    "roles/owner",
     "roles/resourcemanager.projectCreator",
     "roles/resourcemanager.folderAdmin",
     "roles/resourcemanager.folderIamAdmin",