From ff603651bb3f66b7ef397749e15557713e9a0f69 Mon Sep 17 00:00:00 2001
From: abhishek kumar tiwari <abhiwa@google.com>
Date: Thu, 2 Jan 2025 12:29:30 +0000
Subject: [PATCH] fix: use less privilege roles for ci service account (#459)

---
 metadata.yaml                                                    | 1 -
 modules/compute_disk_snapshot/metadata.yaml                      | 1 -
 modules/compute_instance/metadata.yaml                           | 1 -
 modules/instance_template/metadata.yaml                          | 1 -
 modules/mig/metadata.yaml                                        | 1 -
 modules/mig_with_percent/metadata.yaml                           | 1 -
 modules/preemptible_and_regular_instance_templates/metadata.yaml | 1 -
 modules/umig/metadata.yaml                                       | 1 -
 test/setup/iam.tf                                                | 1 -
 9 files changed, 9 deletions(-)

diff --git a/metadata.yaml b/metadata.yaml
index c7a0a690..82e5eb91 100644
--- a/metadata.yaml
+++ b/metadata.yaml
@@ -93,7 +93,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser
diff --git a/modules/compute_disk_snapshot/metadata.yaml b/modules/compute_disk_snapshot/metadata.yaml
index 6e5acde4..d2f1661f 100644
--- a/modules/compute_disk_snapshot/metadata.yaml
+++ b/modules/compute_disk_snapshot/metadata.yaml
@@ -159,7 +159,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser
diff --git a/modules/compute_instance/metadata.yaml b/modules/compute_instance/metadata.yaml
index 1fdcfc83..d1417175 100644
--- a/modules/compute_instance/metadata.yaml
+++ b/modules/compute_instance/metadata.yaml
@@ -170,7 +170,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser
diff --git a/modules/instance_template/metadata.yaml b/modules/instance_template/metadata.yaml
index 37b6e79d..517d1eae 100644
--- a/modules/instance_template/metadata.yaml
+++ b/modules/instance_template/metadata.yaml
@@ -374,7 +374,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser
diff --git a/modules/mig/metadata.yaml b/modules/mig/metadata.yaml
index d0a5846f..8993a764 100644
--- a/modules/mig/metadata.yaml
+++ b/modules/mig/metadata.yaml
@@ -313,7 +313,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser
diff --git a/modules/mig_with_percent/metadata.yaml b/modules/mig_with_percent/metadata.yaml
index 029a41e4..2d1bd952 100644
--- a/modules/mig_with_percent/metadata.yaml
+++ b/modules/mig_with_percent/metadata.yaml
@@ -301,7 +301,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser
diff --git a/modules/preemptible_and_regular_instance_templates/metadata.yaml b/modules/preemptible_and_regular_instance_templates/metadata.yaml
index b64b7e5c..e7d98c90 100644
--- a/modules/preemptible_and_regular_instance_templates/metadata.yaml
+++ b/modules/preemptible_and_regular_instance_templates/metadata.yaml
@@ -201,7 +201,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser
diff --git a/modules/umig/metadata.yaml b/modules/umig/metadata.yaml
index 4fc51b1e..b63ec928 100644
--- a/modules/umig/metadata.yaml
+++ b/modules/umig/metadata.yaml
@@ -178,7 +178,6 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/owner
           - roles/compute.admin
           - roles/compute.networkAdmin
           - roles/iam.serviceAccountUser
diff --git a/test/setup/iam.tf b/test/setup/iam.tf
index e37f7575..02230449 100644
--- a/test/setup/iam.tf
+++ b/test/setup/iam.tf
@@ -16,7 +16,6 @@
 
 locals {
   vm_required_roles = [
-    "roles/owner",
     "roles/compute.admin",
     "roles/compute.networkAdmin",
     "roles/iam.serviceAccountUser",