GoogleCloudPlatform / GoogleCloudPlatform/deploymentmanager-samples

Unable to create iamMemberBinding with a condition

Open
#624 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Jinja
Stars
951
Forks
700
PR merge metrics
No merged PRs in 30d

Description

Type `gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding` doesn't seem to support conditions in bindings, which is a feature lack.

My configurations is as follows:
*iam-test.yaml*
```
imports:
- path: iam-test.jinja
resources:
- name: iam
type: iam-test.jinja
```

*iam-test.jinja*
```
resources:

- type: gcp-types/iam-v1:projects.serviceAccounts
name: my-gsa
properties:
accountId: my-gsa
displayName: my-gsa
accessControl:
gcpIamPolicy:
bindings:
- role: roles/iam.workloadIdentityUser
members:
- "serviceAccount:{{ env["project"] }}.svc.id.goog[my-namespace/my-ksa]"

- name: my-gsa-binding
type: gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding
properties:
resource: {{ env["project"] }}
member: "serviceAccount:my-gsa@my-project.iam.gserviceaccount.com"
role: roles/storage.objectViewer
condition:
expression: resource.name == "projects/_/buckets/my_unique_app_bucket"
title: access to my_unique_app_bucket
metadata:
dependsOn:
- my-gsa
```
The workflow:
```
$ gcloud deployment-manager deployments create iam-test --config=iam-test.yaml --verbosity=debug
...
Waiting for create [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]...failed.
DEBUG: (gcloud.deployment-manager.deployments.create) Error in Operation [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]: errors:
- code: RESOURCE_ERROR
location: /deployments/iam-test/resources/my-gsa-binding
message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"description":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field."}]}],"statusMessage":"Bad
Request","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/my-project:setIamPolicy","httpMethod":"POST"}}'
Traceback (most recent call last):
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/googlecloudsdk/calliope/cli.py", line 982, in Execute
resources = calliope_command.Run(cli=self, args=args)
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/googlecloudsdk/calliope/backend.py", line 809, in Run
resources = command_instance.Run(args)
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/surface/deployment_manager/deployments/create.py", line 213, in Run
response = self._HandleOperationError(error,
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/surface/deployment_manager/deployments/create.py", line 252, in _HandleOperationError
raise error
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/surface/deployment_manager/deployments/create.py", line 201, in Run
operation = dm_write.WaitForOperation(
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/googlecloudsdk/command_lib/deployment_manager/dm_write.py", line 126, in WaitForOperation
raise exceptions.OperationError(
googlecloudsdk.api_lib.deployment_manager.exceptions.OperationError: Error in Operation [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]: errors:
- code: RESOURCE_ERROR
location: /deployments/iam-test/resources/my-gsa-binding
message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"description":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field."}]}],"statusMessage":"Bad
Request","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/my-project:setIamPolicy","httpMethod":"POST"}}'

ERROR: (gcloud.deployment-manager.deployments.create) Error in Operation [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]: errors:
- code: RESOURCE_ERROR
location: /deployments/iam-test/resources/my-gsa-binding
message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"description":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field."}]}],"statusMessage":"Bad
Request","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/my-project:setIamPolicy","httpMethod":"POST"}}'
```

How do I achieve managing IAM bindings with conditions in IaC manner using Deployment Manager?
I was able to configure the condition via Console UI, which is not what is desired.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.