Skip to content

FAST: Clear default resourcemanager.projectCreator and billing.admin authoritatively at the root of the org #1220

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
drebes opened this issue Mar 7, 2023 · 1 comment · Fixed by #1222
Closed

FAST: Clear default resourcemanager.projectCreator and billing.admin authoritatively at the root of the org #1220

drebes opened this issue Mar 7, 2023 · 1 comment · Fixed by #1222

Comments

@drebes
Copy link
Member

drebes commented Mar 7, 2023

For tracking: on freshly created GCP organizations, there's a default "domain:" level binding at the root of the org for the roles resourcemanager.projectCreator and billing.admin. FAST should authoritatively manage these roles, removing these default (explicit) grants.
@juliocc
Copy link
Collaborator

juliocc commented Mar 7, 2023

projectCreator is already managed authoritatively. We only have to do the same for roles/billing.creator

juliocc added a commit that referenced this issue Mar 7, 2023
@juliocc
Manage billing.creator role authoritatively in FAST bootstrap.
c7938ba 
By default new orgs grant billing.creator and
resourcemanager.projectCreator to the whole domain[1]. This PR makes
FAST remove the former binding during the bootstrap (the latter is
already managed by FAST).

Fixes #1220

[1] https://cloud.google.com/resource-manager/docs/default-access-control
@juliocc juliocc mentioned this issue Mar 7, 2023
Merged
juliocc added a commit that referenced this issue Mar 7, 2023
@juliocc
Manage billing.creator role authoritatively in FAST bootstrap.
38808b3 
By default new orgs grant billing.creator and
resourcemanager.projectCreator to the whole domain[1]. This PR makes
FAST remove the former binding during the bootstrap (the latter is
already managed by FAST).

Fixes #1220

[1] https://cloud.google.com/resource-manager/docs/default-access-control
lcaggio pushed a commit that referenced this issue May 5, 2023
@juliocc @lcaggio
Manage billing.creator role authoritatively in FAST bootstrap.
8b91a02 
By default new orgs grant billing.creator and
resourcemanager.projectCreator to the whole domain[1]. This PR makes
FAST remove the former binding during the bootstrap (the latter is
already managed by FAST).

Fixes #1220

[1] https://cloud.google.com/resource-manager/docs/default-access-control
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@juliocc @drebes