-
Notifications
You must be signed in to change notification settings - Fork 61
feat(delivery): document roles used in CI pipeline #489
Conversation
terraform/modules/emblem-app/main.tf
Outdated
] | ||
} | ||
|
||
resource "google_project_iam_member" "delivery_storage_object_admin_granting_iam_member" { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why not use google_storage_bucket_iam_member
or similar to bind this role to a single bucket without the need for as many conditions?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
EDIT: This is actually a granting permission (permission to grant the storage role), not a storage permission.
AFAICT, this should be kept as-is. 🙂
I've confirmed this works (locally) when run with Once this and #482 are merged, I'll confirm this works on a "from-scratch" E2E test run. |
DO NOT MERGE until this is tested (which requires some other PRs)Fixes #473