Open onetwopunch opened 3 years ago
ya this is something we discussed a bit in the past. my personal feelings on the matter is i'd like to discourage this behavior as its just so much power to possess and (imo) its just not a good pattern to essentially grant org admin to a GCF. (understanding its not really org admin but the service account will likely have many roles assigned to it.) all it would take is one other service-account in the same project to have runAs to privilege escalate and take control of the entire org.
it could be made safer by adding in deny's etc but imo just granting at a lower level is generally less error prone and safer. having said all that i realize this is something some folks will want to do, which they can do now manually. but at least by keeping it out of terraform we don't actively encourage the behavior.
idk that is my thoughts and opinions on the matter. open to feedback of course.
I have the same struggle of over permissioning service accounts, especially with stuff like Terraform in Cloud Build. I have two propositions.
What are your thoughts?
Currently you cannot enable at the org level and must enable at a list of folders. This may be desirable in many cases but many orgs have projects directly under the org that they would want autoremediation for. This can be as simple as adding a variable and corresponding logic in the terraform: