Add storage.objectViewer role to GCP_READ_IAM_ROLES

GCP_READ_IAM_ROLES lacks permission storage.buckets.get to retrieve bucket ACLs when running the inventory.
forseti-security · May 15, 2019 · 77af416 · 77af416
1 parent b261a51
commit 77af416
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/install/gcp/installer/util/constants.py b/install/gcp/installer/util/constants.py
@@ -96,6 +96,7 @@ class DeploymentStatus(Enum):
     'roles/orgpolicy.policyViewer',
     'roles/servicemanagement.quotaViewer',
     'roles/serviceusage.serviceUsageConsumer',
+    'roles/storage.objectViewer'
 ]
 
 GCP_WRITE_IAM_ROLES = [