From a575ed2b0b497380163e0bb7708d22f77ce514fd Mon Sep 17 00:00:00 2001 From: Miguel Pais Date: Mon, 29 Apr 2024 18:24:20 +0200 Subject: [PATCH] Adding necessary view only permissions for GCP CSPM in order to view cloud functions and their builds (#27) --- modules/services/service-principal/main.tf | 2 +- modules/services/service-principal/organizational.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/services/service-principal/main.tf b/modules/services/service-principal/main.tf index fafd016..4045f83 100644 --- a/modules/services/service-principal/main.tf +++ b/modules/services/service-principal/main.tf @@ -23,7 +23,7 @@ resource "google_project_iam_member" "browser" { # role permissions for CSPM (GCP Predefined Roles for Sysdig Cloud Secure Posture Management) #--------------------------------------------------------------------------------------------- resource "google_project_iam_member" "cspm" { - for_each = var.is_organizational ? [] : toset(["roles/cloudasset.viewer", "roles/iam.serviceAccountTokenCreator", "roles/logging.viewer"]) + for_each = var.is_organizational ? [] : toset(["roles/cloudasset.viewer", "roles/iam.serviceAccountTokenCreator", "roles/logging.viewer", "roles/cloudfunctions.viewer", "roles/cloudbuild.builds.viewer"]) project = var.project_id role = each.key diff --git a/modules/services/service-principal/organizational.tf b/modules/services/service-principal/organizational.tf index 363f1e7..12ce731 100644 --- a/modules/services/service-principal/organizational.tf +++ b/modules/services/service-principal/organizational.tf @@ -26,7 +26,7 @@ resource "google_organization_iam_member" "browser" { # role permissions for CSPM (GCP Predefined Roles for Sysdig Cloud Secure Posture Management) #--------------------------------------------------------------------------------------------- resource "google_organization_iam_member" "cspm" { - for_each = var.is_organizational ? toset(["roles/cloudasset.viewer", "roles/iam.serviceAccountTokenCreator", "roles/logging.viewer"]) : [] + for_each = var.is_organizational ? toset(["roles/cloudasset.viewer", "roles/iam.serviceAccountTokenCreator", "roles/logging.viewer", "roles/cloudfunctions.viewer", "roles/cloudbuild.builds.viewer"]) : [] org_id = data.google_organization.org[0].org_id role = each.key