Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow access to manage gcp log views #42

Merged
merged 2 commits into from
Jan 24, 2025
Merged

Allow access to manage gcp log views #42

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a63799d
Allow full admin access for gcp log views
mhotan Nov 26, 2024
fccfddb
Update union-ai-admin-role
mhotan Nov 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions union-ai-admin/gcp/union-ai-admin-role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -507,6 +507,16 @@ includedPermissions:
- iam.serviceAccounts.list
- iam.serviceAccounts.setIamPolicy
- iam.serviceAccounts.update
- logging.views.create
- logging.views.delete
- logging.views.get
- logging.views.getIamPolicy
- logging.views.list
- logging.views.listLogs
- logging.views.listResourceKeys
- logging.views.listResourceValues
- logging.views.setIamPolicy
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is setting and updating required for what we need?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should have looked at the other PR first ;). I see that it is. I think the question now is one around opt-in. The team had chatted before about potential issues with gaining carte-blanche access to logs. I'm curious if the approach would be to require the customer to apply those specific permissions (temporarily if needed) themselves or opt in to a more flexible set of permissions.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is setting and updating required for what we need?

Yes

Let's follow up offline

- logging.views.update
- resourcemanager.projects.get
- resourcemanager.projects.getIamPolicy
- resourcemanager.projects.setIamPolicy
Expand Down