Skip to content

fix: fix gcp permissions for gcp relay in terraform module (JIRA https://stacklet.atlassian.net/browse/ENG-5290) #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix: fix gcp permissions for gcp relay in terraform module (JIRA https://stacklet.atlassian.net/browse/ENG-5290) #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c9ed8ef
fix-gcp-permissions
hiteshmck Jun 23, 2025
6542b8c
fixed project link
hiteshmck Jun 23, 2025
c14ea81
incorporated PR feedback
hiteshmck Jun 24, 2025
1d6dc51
conditional permission assignment
hiteshmck Jun 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions asset_feed_func.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,11 @@ resource "google_cloudfunctions2_function" "asset_change_relay" {
}

event_trigger {
trigger_region = var.location
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
pubsub_topic = google_pubsub_topic.asset_feed[0].id
retry_policy = "RETRY_POLICY_RETRY"
trigger_region = var.location
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
pubsub_topic = google_pubsub_topic.asset_feed[0].id
retry_policy = "RETRY_POLICY_RETRY"
service_account_email = var.service_account
}
}
resource "google_cloudfunctions2_function_iam_member" "asset_change_relay_invoker" {
Expand Down
9 changes: 5 additions & 4 deletions audit_log_feed_func.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,11 @@ resource "google_cloudfunctions2_function" "audit_log_relay" {
}

event_trigger {
trigger_region = var.location
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
pubsub_topic = google_pubsub_topic.audit_feed[0].id
retry_policy = "RETRY_POLICY_RETRY"
trigger_region = var.location
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
pubsub_topic = google_pubsub_topic.audit_feed[0].id
retry_policy = "RETRY_POLICY_RETRY"
service_account_email = var.service_account
}
}

Expand Down
18 changes: 18 additions & 0 deletions bootstrap/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,24 @@ resource "google_service_account" "service_account" {
depends_on = [google_project_service.iam]
}

# Get project data
data "google_project" "gcp_project" {
project_id = local.project_id
}

# Grant Cloud Build service account Artifact Registry permissions
resource "google_project_iam_member" "cloud_build_artifact_registry" {
for_each = var.create_project ? toset([
"roles/artifactregistry.writer",
"roles/logging.logWriter",
"roles/storage.objectViewer"
]) : toset([])

project = local.project_id
role = each.value
member = "serviceAccount:${data.google_project.gcp_project.number}-compute@developer.gserviceaccount.com"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might only make sense when we have create_project set and so we probably only want to do it when we are creating the project:

terraform-gcp-stacklet-relay/bootstrap/main.tf

Lines 6 to 15 in 90fd290

resource "google_project" "stacklet_relay" {
count = var.create_project ? 1 : 0
name = var.project_name
project_id = var.project_id
folder_id = var.folder_id
billing_account = var.billing_account
tags = var.project_tags
deletion_policy = "DELETE"
}

Otherwise we should just expect the project_id they give us to have proper permissions set and we shouldn't try to modify it.

Copy link
Author

@hiteshmck hiteshmck Jun 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sontek If we don't want to use terraform to give their project compute sa any permissions, we should atleast have some documentation sayting this is the minimum permissions we expect on the google compute service account.

And if we are documenting this, why not automate, if we can.

Just some thoughts....

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wouldn't expect us to have access to modify IAM if we don't have access to compute. Most companies lock down IAM more than any other service.

We definitely should have documentation for the permissions necessary though. We shouldn't leave it up to the customer to guess what permissions they need.

But if they are passing in project_id its because they want us to use a project they created without modifications because its most likely controlled by IaC on their end and any changes we make to it will be reverted with the IaC that controls it

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thx for the feedback.
For Epsilon, they are using their own project and still expect the terraform to work out of the box, by giving permission to the service accounts it needs in the terraform itself.

Maybe a middle ground be to add documentation about extra permissions, and at the same time, have a setting in terraform to control , if they want our terraform to give additional permissions as well for their project.

Does it make sense ?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not a big fan of allowing a customer to pass in a project ID but then trying to modify that project after the fact. Most customers will not expect that behavior. Maybe if create_project is false we could use the datasource to verify the proper permissions are there?

Untested but something like:

data "google_project_iam_policy" "project" {
  project = var.project_id
}

output "check_if_role_exists" {
  value = contains([
    for binding in data.google_project_iam_policy.project.bindings :
    binding.role
  ], "roles/compute.admin")
}

with whatever roles are necessary? Although I think documentation attached to the project_id var is enough

}

output "project_id" {
value = local.project_id
}
Expand Down
9 changes: 5 additions & 4 deletions scc_feed_func.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,11 @@ resource "google_cloudfunctions2_function" "scc_finding_relay" {
}

event_trigger {
trigger_region = var.location
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
pubsub_topic = google_pubsub_topic.scc_findings_feed[0].id
retry_policy = "RETRY_POLICY_RETRY"
trigger_region = var.location
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
pubsub_topic = google_pubsub_topic.scc_findings_feed[0].id
retry_policy = "RETRY_POLICY_RETRY"
service_account_email = var.service_account
}
}

Expand Down