ansible-collections / ansible-collections/google.cloud

Support assigning IAM roles to users

Open
#238 21 comments 16 reactions 0 assignees View on GitHub
enhancement stale
Dominant language
Python
Stars
105
Forks
144
Avg merge
5d 10h
Merged PRs (30d)
4

Description

##### SUMMARY
Right now it's not possible to bind an IAM role with a user in an ansible-friendly way. This use case should be supported since roles are only created to be assigned to users. A role without users is useless

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
Either add the functionality to the `gcp_iam_role` module to be able to create and bind roles in one task or create a new module to exclusively bind roles to users

##### ADDITIONAL INFORMATION

There's no use on creating roles if they can't be added to a user. Right now my workaround is to use the `command` module to add the role using `gcloud`
```yaml
name: assign role to user
command: gcloud projects add-iam-policy-binding {{gcp_project}} --member "serviceAccount:myAccount@{{gcp_project}}.iam.gserviceaccount.com" --role "projects/{{gcp_project}}/roles/myRole"
```
But that has a lot of requirements. You need to have `gcloud` locally, you need to be authenticated, it is not idempotent, etc etc

The simplest way that I can think for this new feature would be to add a parameter `bindings` to the gcp_iam_role module to be able to bind the role to a list of users
e.g.
```yaml
- name: Create and bind my role
gcp_iam_role:
name: "myRole"
title: Dummy role
project: "{{gcp_project}}"
included_permissions:
- compute.addresses.create
- compute.addresses.get
bindings: # new parameter
- serviceAccount:myAccount@{{gcp_project}}.iam.gserviceaccount.com
```

Contributor guide

Open the contributing guide

Research direction

Start with the existing gcp_iam_role module and trace how it creates roles and handles project IAM data. Decide whether binding belongs in that module or a separate module, then verify the proposed example can assign users or service accounts idempotently without requiring the gcloud command.】【。} 老虎机? Wait invalid trailing? Need clean JSON. Also phrase

Written by the indexing model from the issue text.

Assessment

Tech stack
gcp, python
Domain
authorization, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.