mirror of
https://github.com/google/nomulus.git
synced 2025-05-01 04:27:51 +02:00
368c264e3c
Per https://cloud.google.com/container-registry/docs/access-control#granting_users_and_other_projects_access_to_a_registry, for a service account to access GCR, it does not need reader access to *all* buckets in a project, but just the specific one. This is duped from cl/254092941.
16 lines
640 B
HCL
16 lines
640 B
HCL
resource "google_storage_bucket" "proxy_certificate" {
|
|
name = "${var.proxy_certificate_bucket}"
|
|
storage_class = "MULTI_REGIONAL"
|
|
}
|
|
|
|
resource "google_storage_bucket_iam_member" "certificate_viewer" {
|
|
bucket = "${google_storage_bucket.proxy_certificate.name}"
|
|
role = "roles/storage.objectViewer"
|
|
member = "serviceAccount:${google_service_account.proxy_service_account.email}"
|
|
}
|
|
|
|
resource "google_storage_bucket_iam_member" "gcr_viewer" {
|
|
bucket = "artifacts.${var.gcr_project_name}.appspot.com"
|
|
role = "roles/storage.objectViewer"
|
|
member = "serviceAccount:${google_service_account.proxy_service_account.email}"
|
|
}
|