Creation of a RoleSet wipes conditions from the IAM Policy

[trolleksii]

We are using both IAM Bindings with time expiry conditions to grant users temporary access to GCP resources and Vault GCP Secrets Engine to issue Service Account keys for our pipelines. We noticed that conditions disappear after the RoleSet creation/update, effectively making all our temporary access grants(including ones that already expired) permanent.

How to reproduce:

1. Create a Project in GCP.
2. Grant yourself any Role with any condition.
3. Get the IAM Policy(gcloud projects get-iam-policy <PROJECT_ID>), the condition will be present.
4. Create a Roleset with at least one project-scope binding:

vault write gcp/roleset/my-key-roleset \
    project="<PROJECT_ID>" \
    secret_type="service_account_key"  \
    bindings=-<<EOF
      resource "//cloudresourcemanager.googleapis.com/projects/<PROJECT_ID>" {
        roles = ["roles/viewer"]
      }
EOF

5. Get the IAM Policy(gcloud projects get-iam-policy <PROJECT_ID>) again. The condition will be missing.

This example is for the Project Role Bindings but the same behavior can be observed with other resources.

It seems like the bug is caused by the ChangedBindings function in the plugin/iamutil/iam_policy.go. It fails to copy the conditions to the updated IAM Policy Object.

I will submit the PR to fix this shortly.

[trolleksii]

Prepared the PR#114 to fix the bug.

[davidcharbonnier]

Hello,
Is there any plans from Hashicorp team to take a look at this? Fix is already ready and just needs to be reviewed.
Thank you :)

[maxcoulombe]

Fix was reviewed and merged. Thanks for looking into this!

I'll take care of the merge back into Vault so the fix in part of the upcoming 1.13 release.