fix: use less privilege roles for ci service account (#459)

terraform-google-modules · Jan 2, 2025 · ff60365 · ff60365
1 parent ef60927
commit ff60365
Show file tree

Hide file tree

Showing 9 changed files with 0 additions and 9 deletions.
diff --git a/metadata.yaml b/metadata.yaml
@@ -93,7 +93,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser

diff --git a/modules/compute_disk_snapshot/metadata.yaml b/modules/compute_disk_snapshot/metadata.yaml
@@ -159,7 +159,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser

diff --git a/modules/compute_instance/metadata.yaml b/modules/compute_instance/metadata.yaml
@@ -170,7 +170,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser

diff --git a/modules/instance_template/metadata.yaml b/modules/instance_template/metadata.yaml
@@ -374,7 +374,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser

diff --git a/modules/mig/metadata.yaml b/modules/mig/metadata.yaml
@@ -313,7 +313,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser

diff --git a/modules/mig_with_percent/metadata.yaml b/modules/mig_with_percent/metadata.yaml
@@ -301,7 +301,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser

diff --git a/modules/preemptible_and_regular_instance_templates/metadata.yaml b/modules/preemptible_and_regular_instance_templates/metadata.yaml
@@ -201,7 +201,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser

diff --git a/modules/umig/metadata.yaml b/modules/umig/metadata.yaml
@@ -178,7 +178,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser

diff --git a/test/setup/iam.tf b/test/setup/iam.tf
@@ -16,7 +16,6 @@
 
 locals {
   vm_required_roles = [
-    "roles/owner",
     "roles/compute.admin",
     "roles/compute.networkAdmin",
     "roles/iam.serviceAccountUser",