Skip to content

Commit 52feb69

Browse files
authored
Adding additional permissions for FxA devs to be able to view job his… (#260)
* Adding additional permissions for FxA devs to be able to view job history for datasets in BQ as well as cloudtask queues. This is specifically for FxA to be able to support the inactive account deletion script that is being implemented * Running terraform fmt * Updating roles/bigquery.resourceadmin to roles/bigquery.resourceViewer
1 parent 2d8d05e commit 52feb69

2 files changed

Lines changed: 30 additions & 0 deletions

File tree

google_permissions/other_roles.tf

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,33 @@ resource "google_folder_iam_binding" "bq_data_viewer" {
2929
)
3030
}
3131

32+
resource "google_folder_iam_binding" "bq_resource_viewer" {
33+
count = contains(var.folder_roles, "roles/bigquery.resourceViewer") && !var.admin_only ? 1 : 0
34+
folder = var.google_folder_id
35+
role = "roles/bigquery.resourceViewer"
36+
members = module.developers_workgroup.members
37+
}
38+
39+
# roles/cloudtasks.queueAdmin as folder_role
40+
41+
resource "google_folder_iam_binding" "cloudtasks_queue_admin" {
42+
count = contains(var.folder_roles, "roles/cloudtasks.queueAdmin") && !var.admin_only ? 1 : 0
43+
folder = var.google_folder_id
44+
role = "roles/cloudtasks.queueAdmin"
45+
members = module.developers_workgroup.members
46+
47+
}
48+
49+
# roles/cloudtasks.taskRunner as folder_role
50+
51+
resource "google_folder_iam_binding" "cloudtasks_task_runner" {
52+
count = contains(var.folder_roles, "roles/cloudtasks.taskRunner") && !var.admin_only ? 1 : 0
53+
folder = var.google_folder_id
54+
role = "roles/cloudtasks.taskRunner"
55+
members = module.developers_workgroup.members
56+
57+
}
58+
3259
# roles/redis.admin as folder_role
3360

3461
resource "google_folder_iam_binding" "developers_redis_admin" {

google_permissions/outputs.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ locals {
55
folder_additional_roles = [
66
"roles/bigquery.jobUser",
77
"roles/bigquery.dataViewer",
8+
"roles/bigquery.resourceViewer",
89
"roles/redis.admin",
910
"roles/logging.admin",
1011
"roles/monitoring.alertPolicyEditor",
@@ -14,6 +15,8 @@ locals {
1415
project_additional_roles = [
1516
"roles/automl.editor",
1617
"roles/cloudsql.admin",
18+
"roles/cloudtasks.queueAdmin",
19+
"roles/cloudtasks.taskRunner",
1720
"roles/cloudtranslate.editor",
1821
"roles/editor",
1922
"roles/monitoring.uptimeCheckConfigEditor",

0 commit comments

Comments
 (0)