public/terraform-provider-google
0
0
Fork 0
mirror of https://github.com/letic/terraform-provider-google.git synced 2024-06-29 06:42:36 +00:00
Code Issues Projects Releases Wiki Activity

#843: Add policy support to storage buckets (#1190)

Browse Source
This commit is contained in:
Rene Kroon 2018-05-08 23:00:48 +02:00 committed by Nathan McKinley
parent b3ceef76ee
commit dda26771d3
5 changed files with 180 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
google/iam_storage_bucket.go
View File

@ -51,6 +51,11 @@ func (u *StorageBucketIamUpdater) SetResourceIamPolicy(policy *cloudresourcemana
return errwrap.Wrapf(fmt.Sprintf("Invalid IAM policy for %s: {{err}}", u.DescribeResource()), err)
}
ppolicy, err := u.Config.clientStorage.Buckets.GetIamPolicy(u.bucket).Do()
if err != nil {
return errwrap.Wrapf(fmt.Sprintf("Error setting IAM policy for %s: {{err}}", u.DescribeResource()), err)
}
storagePolicy.Etag = ppolicy.Etag
_, err = u.Config.clientStorage.Buckets.SetIamPolicy(u.bucket, storagePolicy).Do()
if err != nil {

1
google/provider.go
View File

@ -215,6 +215,7 @@ func Provider() terraform.ResourceProvider {
// google_storage_bucket_iam_policy resource.
"google_storage_bucket_iam_binding": ResourceIamBinding(IamStorageBucketSchema, NewStorageBucketIamUpdater),
"google_storage_bucket_iam_member": ResourceIamMember(IamStorageBucketSchema, NewStorageBucketIamUpdater),
"google_storage_bucket_iam_policy": ResourceIamPolicy(IamStorageBucketSchema, NewStorageBucketIamUpdater),
"google_storage_bucket_object": resourceStorageBucketObject(),
"google_storage_object_acl": resourceStorageObjectAcl(),
"google_storage_default_object_acl": resourceStorageDefaultObjectAcl(),

9
google/provider_test.go
View File

@ -37,6 +37,10 @@ var orgEnvVars = []string{
"GOOGLE_ORG",
}
var serviceAccountEnvVars = []string{
"GOOGLE_SERVICE_ACCOUNT",
}
var orgTargetEnvVars = []string{
"GOOGLE_ORG_2",
}
@ -168,6 +172,11 @@ func getTestBillingAccountFromEnv(t *testing.T) string {
return multiEnvSearch(billingAccountEnvVars)
}
func getTestServiceAccountFromEnv(t *testing.T) string {
skipIfEnvNotSet(t, serviceAccountEnvVars...)
return multiEnvSearch(serviceAccountEnvVars)
}
func multiEnvSearch(ks []string) string {
for _, k := range ks {
if v := os.Getenv(k); v != "" {

163
google/resource_storage_bucket_iam_test.go
View File

@ -40,6 +40,36 @@ func TestAccStorageBucketIamBinding(t *testing.T) {
})
}
func TestAccStorageBucketIamPolicy(t *testing.T) {
t.Parallel()
bucket := acctest.RandomWithPrefix("tf-test")
account := acctest.RandomWithPrefix("tf-test")
serviceAcct := getTestServiceAccountFromEnv(t)
resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
Steps: []resource.TestStep{
{
// Test IAM Policy creation
Config: testAccStorageBucketIamPolicy_basic(bucket, account, serviceAcct),
Check: testAccCheckGoogleStorageBucketIam(bucket, "roles/storage.objectViewer", []string{
fmt.Sprintf("serviceAccount:%s-1@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
}),
},
{
// Test IAM Policy update
Config: testAccStorageBucketIamPolicy_update(bucket, account, serviceAcct),
Check: testAccCheckGoogleStorageBucketIam(bucket, "roles/storage.objectViewer", []string{
fmt.Sprintf("serviceAccount:%s-1@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
fmt.Sprintf("serviceAccount:%s-2@%s.iam.gserviceaccount.com", account, getTestProjectFromEnv()),
}),
},
},
})
}
func TestAccStorageBucketIamMember(t *testing.T) {
t.Parallel()
@ -86,23 +116,104 @@ func testAccCheckGoogleStorageBucketIam(bucket, role string, members []string) r
}
}
func testAccStorageBucketIamBinding_basic(bucket, account string) string {
func testAccStorageBucketIamPolicy_update(bucket, account, serviceAcct string) string {
return fmt.Sprintf(`
resource "google_storage_bucket" "bucket" {
name = "%s"
name = "%s"
}
resource "google_service_account" "test-account-1" {
account_id = "%s-1"
display_name = "Iam Testing Account"
account_id = "%s-1"
display_name = "Iam Testing Account"
}
resource "google_service_account" "test-account-2" {
account_id = "%s-2"
display_name = "Iam Testing Account"
}
data "google_iam_policy" "foo-policy" {
binding {
role = "roles/storage.objectViewer"
members = [
"serviceAccount:${google_service_account.test-account-1.email}",
"serviceAccount:${google_service_account.test-account-2.email}",
]
}
binding {
role = "roles/storage.admin"
members = [
"serviceAccount:%s",
]
}
}
resource "google_storage_bucket_iam_policy" "bucket-binding" {
bucket = "${google_storage_bucket.bucket.name}"
policy_data = "${data.google_iam_policy.foo-policy.policy_data}"
}
`, bucket, account, account, serviceAcct)
}
func testAccStorageBucketIamPolicy_basic(bucket, account, serviceAcct string) string {
return fmt.Sprintf(`
resource "google_storage_bucket" "bucket" {
name = "%s"
}
resource "google_service_account" "test-account-1" {
account_id = "%s-1"
display_name = "Iam Testing Account"
}
data "google_iam_policy" "foo-policy" {
binding {
role = "roles/storage.objectViewer"
members = [
"serviceAccount:${google_service_account.test-account-1.email}",
]
}
binding {
role = "roles/storage.admin"
members = [
"serviceAccount:%s",
]
}
}
resource "google_storage_bucket_iam_policy" "bucket-binding" {
bucket = "${google_storage_bucket.bucket.name}"
policy_data = "${data.google_iam_policy.foo-policy.policy_data}"
}
`, bucket, account, serviceAcct)
}
func testAccStorageBucketIamBinding_basic(bucket, account string) string {
return fmt.Sprintf(`
resource "google_storage_bucket" "bucket" {
name = "%s"
}
resource "google_service_account" "test-account-1" {
account_id = "%s-1"
display_name = "Iam Testing Account"
}
resource "google_storage_bucket_iam_binding" "foo" {
bucket = "${google_storage_bucket.bucket.name}"
role = "roles/storage.objectViewer"
members = [
"serviceAccount:${google_service_account.test-account-1.email}",
]
bucket = "${google_storage_bucket.bucket.name}"
role = "roles/storage.objectViewer"
members = [
"serviceAccount:${google_service_account.test-account-1.email}",
]
}
`, bucket, account)
}
@ -110,26 +221,26 @@ resource "google_storage_bucket_iam_binding" "foo" {
func testAccStorageBucketIamBinding_update(bucket, account string) string {
return fmt.Sprintf(`
resource "google_storage_bucket" "bucket" {
name = "%s"
name = "%s"
}
resource "google_service_account" "test-account-1" {
account_id = "%s-1"
display_name = "Iam Testing Account"
account_id = "%s-1"
display_name = "Iam Testing Account"
}
resource "google_service_account" "test-account-2" {
account_id = "%s-2"
display_name = "Iam Testing Account"
account_id = "%s-2"
display_name = "Iam Testing Account"
}
resource "google_storage_bucket_iam_binding" "foo" {
bucket = "${google_storage_bucket.bucket.name}"
role = "roles/storage.objectViewer"
members = [
"serviceAccount:${google_service_account.test-account-1.email}",
"serviceAccount:${google_service_account.test-account-2.email}",
]
bucket = "${google_storage_bucket.bucket.name}"
role = "roles/storage.objectViewer"
members = [
"serviceAccount:${google_service_account.test-account-1.email}",
"serviceAccount:${google_service_account.test-account-2.email}",
]
}
`, bucket, account, account)
}
@ -137,18 +248,18 @@ resource "google_storage_bucket_iam_binding" "foo" {
func testAccStorageBucketIamMember_basic(bucket, account string) string {
return fmt.Sprintf(`
resource "google_storage_bucket" "bucket" {
name = "%s"
name = "%s"
}
resource "google_service_account" "test-account-1" {
account_id = "%s-1"
display_name = "Iam Testing Account"
account_id = "%s-1"
display_name = "Iam Testing Account"
}
resource "google_storage_bucket_iam_member" "foo" {
bucket = "${google_storage_bucket.bucket.name}"
role = "roles/storage.admin"
member = "serviceAccount:${google_service_account.test-account-1.email}"
bucket = "${google_storage_bucket.bucket.name}"
role = "roles/storage.admin"
member = "serviceAccount:${google_service_account.test-account-1.email}"
}
`, bucket, account)
}

30
website/docs/r/storage_bucket_iam.html.markdown
View File

@ -8,10 +8,12 @@ description: |-
# IAM policy for Google storage bucket
Two different resources help you manage your IAM policy for storage bucket. Each of these resources serves a different use case:
Three different resources help you manage your IAM policy for storage bucket. Each of these resources serves a different use case:
* `google_storage_bucket_iam_binding`: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the storage bucket are preserved.
* `google_storage_bucket_iam_member`: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the storage bucket are preserved.
* `google_storage_bucket_iam_policy`: Setting a policy removes all other permissions on the bucket, and if done incorrectly, there's a real chance you will lock yourself out of the bucket. If possible for your use case, using multiple google_storage_bucket_iam_binding resources will be much safer. See the usage example on how to work with policy correctly.
~> **Note:** `google_storage_bucket_iam_binding` resources **can be** used in conjunction with `google_storage_bucket_iam_member` resources **only if** they do not grant privilege to the same role.
@ -38,6 +40,30 @@ resource "google_storage_bucket_iam_member" "member" {
}
```
## google\_storage\_bucket\_iam\_policy
When applying a policy that does not include the roles listed below, you lose the default permissions which google adds to your bucket:
* `roles/storage.legacyBucketOwner`
* `roles/storage.legacyBucketReader`
If this happens only an entity with `roles/storage.admin` privileges can repair this bucket's policies. It is recommended to include the above roles in policies to get the same behaviour as with the other two options.
```hcl
data "google_iam_policy" "foo-policy" {
binding {
role = "roles/your-role"
members = [ "group:yourgroup@example.com" ]
}
}
resource "google_storage_bucket_iam_policy" "member" {
bucket = "your-bucket-name"
policy_data = "${data.google_iam_policy.foo-policy.policy_data}"
}
```
## Argument Reference
The following arguments are supported:
@ -61,4 +87,4 @@ The following arguments are supported:
In addition to the arguments listed above, the following computed attributes are
exported:
* `etag` - (Computed) The etag of the storage bucket's IAM policy.
* `etag` - (Computed) The etag of the storage bucket's IAM policy.