ansible-collections / ansible-collections/google.cloud
Support assigning IAM roles to users
- Dominant language
- Python
- Stars
- 105
- Forks
- 144
- Avg merge
- 5d 10h
- Merged PRs (30d)
- 4
Description
##### SUMMARY
Right now it's not possible to bind an IAM role with a user in an ansible-friendly way. This use case should be supported since roles are only created to be assigned to users. A role without users is useless
##### ISSUE TYPE
- Feature Idea
##### COMPONENT NAME
Either add the functionality to the `gcp_iam_role` module to be able to create and bind roles in one task or create a new module to exclusively bind roles to users
##### ADDITIONAL INFORMATION
There's no use on creating roles if they can't be added to a user. Right now my workaround is to use the `command` module to add the role using `gcloud`
```yaml
name: assign role to user
command: gcloud projects add-iam-policy-binding {{gcp_project}} --member "serviceAccount:myAccount@{{gcp_project}}.iam.gserviceaccount.com" --role "projects/{{gcp_project}}/roles/myRole"
```
But that has a lot of requirements. You need to have `gcloud` locally, you need to be authenticated, it is not idempotent, etc etc
The simplest way that I can think for this new feature would be to add a parameter `bindings` to the gcp_iam_role module to be able to bind the role to a list of users
e.g.
```yaml
- name: Create and bind my role
gcp_iam_role:
name: "myRole"
title: Dummy role
project: "{{gcp_project}}"
included_permissions:
- compute.addresses.create
- compute.addresses.get
bindings: # new parameter
- serviceAccount:myAccount@{{gcp_project}}.iam.gserviceaccount.com
```
Contributor guide
Research direction
Start with the existing gcp_iam_role module and trace how it creates roles and handles project IAM data. Decide whether binding belongs in that module or a separate module, then verify the proposed example can assign users or service accounts idempotently without requiring the gcloud command.】【。} 老虎机? Wait invalid trailing? Need clean JSON. Also phrase
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gcp, python
- Domain
- authorization, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100