Open m0ar opened 3 years ago
This approach does not work. Probably because the Cloud Resource Manager virtual type only refers to the project level?
- name: iam-role-user123-secretAccessor
type: gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding
properties:
resource: projects/[PROJECT_NUMBER]/secrets/auth_secret
role: roles/secretmanager.secretAccessor
member: serviceAccount:user123@[PROJECT_ID].iam.gserviceaccount.com
metadata:
dependsOn:
- account-user123
- secret-version-auth_secret_payload
Resulting deployment error:
ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-1599118517912-5ae63cb36c47e-ae5c4d90-e5270e72]: errors:
- code: CONDITION_NOT_MET
location: /deployments/secret-test/resources/iam-role-user123-secretAccessor->$.properties->$.policy
message: |-
InputMapping for field [policy] for method [setIamPolicy] could not be set from input, mapping was: [$.gcpIamMemberBinding($.intent, $.inputs.policy.response, $.resource.properties)], and evaluation context was:
{
"deployment" : {
"id" : 4104525605007860895,
"name" : "secret-test"
},
"extensions" : {
"EnableAdditionalJsonPathFunctions" : true,
"EnableGoogleTypeProviderFunctionsExperiment" : true
},
"inputs" : {
"policy" : {
"error" : {
"code" : "400",
"message" : "{\"code\":400,\"message\":\"Request contains an invalid argument.\",\"status\":\"INVALID_ARGUMENT\",\"statusMessage\":\"Bad Request\",\"requestPath\":\"https://cloudresourcemanager.googleapis.com/v1/projects/projects%2F[PROJECT_NUMBER]%2Fsecrets%2Fauth_secret:getIamPolicy\",\"httpMethod\":\"POST\"}"
}
}
},
"intent" : "CREATE",
"matches" : [ ],
"project" : "[PROJECT_ID]",
"requestId" : "993e73d8-6001-34bc-8611-b78e0f989830",
"resource" : {
"name" : "iam-role-user123-secretAccessor",
"previous" : { },
"properties" : {
"member" : "serviceAccount:user123@[PROJECT_ID].iam.gserviceaccount.com",
"resource" : "projects/[PROJECT_NUMBER]/secrets/auth_secret",
"role" : "roles/secretmanager.secretAccessor"
},
"self" : { }
}
}
Error was:
Parameter for gcpIamMemberBinding at position 1 is not of type map, value was [null]
Adding the role directly to the secret does not work either, since it's an action and not an actual type:
- name: secret-parent-up-auth_secret
action: [PROJECT_ID]/secret-manager:secretmanager.projects.secrets.create
properties:
replication:
automatic: {}
parent: projects/[PROJECT_ID]
secretId: auth_secret
metadata:
runtimePolicy:
- CREATE
dependsOn:
- api-secretmanager
- type-provider-secret-manager
accessControl:
gcpIamPolicy:
bindings:
- role: roles/secretmanager.secretaccessor
members:
- serviceAccount:user123@[PROJECT_ID].iam.gserviceaccount.com
Error:
ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-1599118883118-5ae63e0fb5ddb-8498faf3-33ecf823]: errors:
- code: INVALID_FIELD_VALUE
location: /deployments/secret-test/manifests/manifest-1599118883319->$.expandedConfig->$.resources[2].accessControl
message: accessControl is not supported for actions
Is there a way to deploy the secret using an actual type, possibly enabling assigning the role in this way?
What does work, but gives access to all project secrets (which is obviously too generous):
- name: iam-projectRole-user123-secretAccessor
type: gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding
properties:
resource: [PROJECT_ID]
role: roles/secretmanager.secretAccessor
member: serviceAccount:user123@[PROJECT_ID].iam.gserviceaccount.com
metadata:
dependsOn:
- account-user123
- secret-version-auth_secret_payload
Please note, actions
is an ALPHA feature of DM.
type: gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding
gives project wide iam bindings.
There are a few virtual types for resource level bindings for example gcp-types/cloudfunctions-v1:virtual.projects.locations.functions.iamMemberBinding
for Cloud Functions. As of today there is no such virtual type for secrets.
What should work for you is to call the action: [PROJECT_ID]/secret-manager:secretmanager.projects.secrets.getIamPolicy
and then action: [PROJECT_ID]/secret-manager:secretmanager.projects.secrets.setIamPolicy
.
(For reference, here is the old implementation. )
@ocsig Got it, thanks for the insights :heart:
In our new deployments, I've been trying to assign
secretmanager.secretAccessor
on a specific secret to a given service account.Is this an impossible feat? I've managed to create a type provider for the secret manager API, but cannot assign the required permissions.
This is a minimal deployment of the secret: