Open wilsonfv opened 2 years ago
@slevenick to investigate prior to triage
Request is for fine-grained google_compute_resource_policy_attachment resource to mirror google_compute_instance.resource_policies
field to remove circular dependency when using google_compute_instance_iam_binding
on the instance
Community Note
Description
GCP has a feature to add schedule to start / stop VM. All of steps described from above official documentation can be achieved using following terraform resources
However in order to follow Principle of Least Privilege, we should bind permission to Compute Service Agent at instance level rather than on project level. This means using resource google_project_iam_binding is against Principle of Least Privilege.
Replacing google_project_iam_binding with google_compute_instance_iam_binding is currently possible and google_compute_instance_iam_binding is at instance level which would be better fit for Principle of Least Privilege however it will also introduce another dependency problem described following
If we were using google_compute_instance_iam_binding to bind permission to Compute Service Agent, the full steps to add schedule to VM can be described following
Notably in current terraform implementation, step 1 & 4 are actual one-step in terraform resource, see below
However step 4 will depend on step 2 & 3 and step 4 & 1 are actual one step so there is no way inject these dependencies with exiting terraform resources if we bind permission to Compute Service Agent at VM level
New or Affected Resource(s)
Potential Terraform Configuration
In order to follow Principle of Least Privilege, we could run step 1 & 4 with separate terraform resources similar to existing google_compute_region_disk_resource_policy_attachment. A proposed new terraform resource google_compute_resource_policy_attachment and relevant configuration could look like below