GoogleCloudPlatform / GoogleCloudPlatform/deploymentmanager-samples
Unable to create iamMemberBinding with a condition
- Dominant language
- Jinja
- Stars
- 951
- Forks
- 700
- PR merge metrics
- No merged PRs in 30d
Description
Type `gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding` doesn't seem to support conditions in bindings, which is a feature lack.
My configurations is as follows:
*iam-test.yaml*
```
imports:
- path: iam-test.jinja
resources:
- name: iam
type: iam-test.jinja
```
*iam-test.jinja*
```
resources:
- type: gcp-types/iam-v1:projects.serviceAccounts
name: my-gsa
properties:
accountId: my-gsa
displayName: my-gsa
accessControl:
gcpIamPolicy:
bindings:
- role: roles/iam.workloadIdentityUser
members:
- "serviceAccount:{{ env["project"] }}.svc.id.goog[my-namespace/my-ksa]"
- name: my-gsa-binding
type: gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding
properties:
resource: {{ env["project"] }}
member: "serviceAccount:my-gsa@my-project.iam.gserviceaccount.com"
role: roles/storage.objectViewer
condition:
expression: resource.name == "projects/_/buckets/my_unique_app_bucket"
title: access to my_unique_app_bucket
metadata:
dependsOn:
- my-gsa
```
The workflow:
```
$ gcloud deployment-manager deployments create iam-test --config=iam-test.yaml --verbosity=debug
...
Waiting for create [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]...failed.
DEBUG: (gcloud.deployment-manager.deployments.create) Error in Operation [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]: errors:
- code: RESOURCE_ERROR
location: /deployments/iam-test/resources/my-gsa-binding
message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"description":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field."}]}],"statusMessage":"Bad
Request","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/my-project:setIamPolicy","httpMethod":"POST"}}'
Traceback (most recent call last):
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/googlecloudsdk/calliope/cli.py", line 982, in Execute
resources = calliope_command.Run(cli=self, args=args)
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/googlecloudsdk/calliope/backend.py", line 809, in Run
resources = command_instance.Run(args)
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/surface/deployment_manager/deployments/create.py", line 213, in Run
response = self._HandleOperationError(error,
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/surface/deployment_manager/deployments/create.py", line 252, in _HandleOperationError
raise error
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/surface/deployment_manager/deployments/create.py", line 201, in Run
operation = dm_write.WaitForOperation(
File "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/lib/googlecloudsdk/command_lib/deployment_manager/dm_write.py", line 126, in WaitForOperation
raise exceptions.OperationError(
googlecloudsdk.api_lib.deployment_manager.exceptions.OperationError: Error in Operation [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]: errors:
- code: RESOURCE_ERROR
location: /deployments/iam-test/resources/my-gsa-binding
message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"description":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field."}]}],"statusMessage":"Bad
Request","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/my-project:setIamPolicy","httpMethod":"POST"}}'
ERROR: (gcloud.deployment-manager.deployments.create) Error in Operation [operation-1614873050523-5bcb7ee88a629-332ec2d7-979d1ee6]: errors:
- code: RESOURCE_ERROR
location: /deployments/iam-test/resources/my-gsa-binding
message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:virtual.projects.iamMemberBinding","ResourceErrorCode":"400","ResourceErrorMessage":{"code":400,"message":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field.","status":"INVALID_ARGUMENT","details":[{"@type":"type.googleapis.com/google.rpc.BadRequest","fieldViolations":[{"description":"Invalid
JSON payload received. Unknown name \"condition\": Cannot find field."}]}],"statusMessage":"Bad
Request","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/my-project:setIamPolicy","httpMethod":"POST"}}'
```
How do I achieve managing IAM bindings with conditions in IaC manner using Deployment Manager?
I was able to configure the condition via Console UI, which is not what is desired.
Contributor guide
Assessment
This issue has not been assessed yet.