chore: downgrade roles

terraform-google-modules · Dec 30, 2024 · 9463812 · 9463812
1 parent ed2cbd5
commit 9463812
Show file tree

Hide file tree

Showing 11 changed files with 64 additions and 82 deletions.
diff --git a/Makefile b/Makefile
@@ -18,7 +18,7 @@
 # Make will use bash instead of sh
 SHELL := /usr/bin/env bash
 
-DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.22
+DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.23
 DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
 REGISTRY_URL := gcr.io/cloud-foundation-cicd
 
@@ -90,6 +90,7 @@ docker_test_lint:
 .PHONY: docker_generate_docs
 docker_generate_docs:
 	docker run --rm -it \
+		-e ENABLE_BPMETADATA \
 		-v "${CURDIR}":/workspace \
 		$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
 		/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs'

diff --git a/metadata.yaml b/metadata.yaml
@@ -356,27 +356,25 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
-          - roles/compute.admin
-          - roles/iam.serviceAccountAdmin
-          - roles/resourcemanager.projectIamAdmin
-          - roles/storage.admin
-          - roles/iam.serviceAccountUser
-          - roles/billing.projectManager
+          - roles/accesscontextmanager.policyAdmin
+          - roles/resourcemanager.organizationViewer
+          - roles/resourcemanager.tagAdmin
+          - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
+          - roles/iam.serviceAccountUser
+          - roles/billing.projectManager
     services:
       - admin.googleapis.com
       - appengine.googleapis.com

diff --git a/modules/budget/metadata.yaml b/modules/budget/metadata.yaml
@@ -122,21 +122,19 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
+          - roles/accesscontextmanager.policyAdmin
+          - roles/resourcemanager.organizationViewer
+          - roles/resourcemanager.tagAdmin
+          - roles/resourcemanager.tagUser
+      - level: Project
+        roles:
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/essential_contacts/metadata.yaml b/modules/essential_contacts/metadata.yaml
@@ -79,21 +79,19 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
+          - roles/accesscontextmanager.policyAdmin
+          - roles/resourcemanager.organizationViewer
+          - roles/resourcemanager.tagAdmin
+          - roles/resourcemanager.tagUser
+      - level: Project
+        roles:
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/fabric-project/metadata.yaml b/modules/fabric-project/metadata.yaml
@@ -159,21 +159,19 @@ spec:
           - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
+          - roles/resourcemanager.projectCreator
+          - roles/resourcemanager.folderAdmin
+          - roles/resourcemanager.folderIamAdmin
+          - roles/billing.projectManager
+          - roles/compute.xpnAdmin
+      - level: Project
+        roles:
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin
           - roles/storage.admin
           - roles/iam.serviceAccountUser
           - roles/billing.projectManager
-      - level: Project
-        roles:
-          - roles/owner
-          - roles/resourcemanager.projectCreator
-          - roles/resourcemanager.folderAdmin
-          - roles/resourcemanager.folderIamAdmin
-          - roles/billing.projectManager
-          - roles/compute.xpnAdmin
     services:
       - admin.googleapis.com
       - appengine.googleapis.com

diff --git a/modules/gsuite_enabled/metadata.yaml b/modules/gsuite_enabled/metadata.yaml
@@ -250,27 +250,25 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
-          - roles/compute.admin
-          - roles/iam.serviceAccountAdmin
-          - roles/resourcemanager.projectIamAdmin
-          - roles/storage.admin
-          - roles/iam.serviceAccountUser
-          - roles/billing.projectManager
+          - roles/accesscontextmanager.policyAdmin
+          - roles/resourcemanager.organizationViewer
+          - roles/resourcemanager.tagAdmin
+          - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
+          - roles/iam.serviceAccountUser
+          - roles/billing.projectManager
     services:
       - admin.googleapis.com
       - appengine.googleapis.com

diff --git a/modules/project_services/metadata.yaml b/modules/project_services/metadata.yaml
@@ -1,4 +1,4 @@
-# Copyright 2022 Google LLC
+# Copyright 2024 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -104,7 +104,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin

diff --git a/modules/quota_manager/metadata.yaml b/modules/quota_manager/metadata.yaml
@@ -79,27 +79,25 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
-          - roles/compute.admin
-          - roles/iam.serviceAccountAdmin
-          - roles/resourcemanager.projectIamAdmin
-          - roles/storage.admin
-          - roles/iam.serviceAccountUser
-          - roles/billing.projectManager
+          - roles/accesscontextmanager.policyAdmin
+          - roles/resourcemanager.organizationViewer
+          - roles/resourcemanager.tagAdmin
+          - roles/resourcemanager.tagUser
       - level: Project
         roles:
-          - roles/owner
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
+          - roles/compute.admin
+          - roles/iam.serviceAccountAdmin
+          - roles/resourcemanager.projectIamAdmin
+          - roles/storage.admin
+          - roles/iam.serviceAccountUser
+          - roles/billing.projectManager
     services:
       - admin.googleapis.com
       - appengine.googleapis.com

diff --git a/modules/shared_vpc_access/metadata.yaml b/modules/shared_vpc_access/metadata.yaml
@@ -106,21 +106,19 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
+          - roles/accesscontextmanager.policyAdmin
+          - roles/resourcemanager.organizationViewer
+          - roles/resourcemanager.tagAdmin
+          - roles/resourcemanager.tagUser
+      - level: Project
+        roles:
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/modules/svpc_service_project/metadata.yaml b/modules/svpc_service_project/metadata.yaml
@@ -237,21 +237,19 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
+          - roles/accesscontextmanager.policyAdmin
+          - roles/resourcemanager.organizationViewer
+          - roles/resourcemanager.tagAdmin
+          - roles/resourcemanager.tagUser
+      - level: Project
+        roles:
           - roles/resourcemanager.projectCreator
           - roles/resourcemanager.folderAdmin
           - roles/resourcemanager.folderIamAdmin
           - roles/billing.projectManager
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/accesscontextmanager.policyAdmin
-          - roles/resourcemanager.organizationViewer
-          - roles/resourcemanager.tagAdmin
-          - roles/resourcemanager.tagUser
-      - level: Project
-        roles:
-          - roles/owner
           - roles/compute.admin
           - roles/iam.serviceAccountAdmin
           - roles/resourcemanager.projectIamAdmin

diff --git a/test/setup/iam.tf b/test/setup/iam.tf
@@ -16,7 +16,6 @@
 
 locals {
   int_required_project_roles = [
-    "roles/owner",
     "roles/compute.admin",
     "roles/iam.serviceAccountAdmin",
     "roles/resourcemanager.projectIamAdmin",
@@ -26,7 +25,6 @@ locals {
   ]
 
   int_required_folder_roles = [
-    "roles/owner",
     "roles/resourcemanager.projectCreator",
     "roles/resourcemanager.folderAdmin",
     "roles/resourcemanager.folderIamAdmin",