Vault GCP Project Level Role Binding

1
votes

I am trying to apply the role binding below to grant the Storage Admin Role to a GCP roleset in Vault. 

resource "//cloudresourcemanager.googleapis.com/projects/{project_id_number}" {
  roles = [
    "roles/storage.admin"
  ]
}

I want to grant access to the project level, not a specific bucket so that the GCP roleset can access and read/write to the Google Container Registry.

When I try to create this roleset in Vault, I get this error:

Error writing data to gcp/roleset/my-roleset: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/gcp/roleset/my-roleset
Code: 400. Errors:

* unable to set policy: googleapi: Error 403: The caller does not have permission

My Vault cluster is running in a GKE cluster which has OAuth Scopes for all Cloud APIs, I am the project owner, and the service account Vault is using has the following permissions:

  • Cloud KMS CryptoKey Encrypter/Decrypter
  • Service Account Actor
  • Service Account Admin
  • Service Account Key Admin
  • Service Account Token Creator
  • Logs Writer
  • Storage Admin
  • Storage Object Admin

I have tried giving the service account both Editor and Owner roles, and I still get the same error.

Firstly, am I using the correct resource to create a roleset for the Storage Admin Role at the project level?

Secondly, if so, what could be causing this permission error?

1
google-cloud-platformhashicorp-vaultgoogle-iam

1 Answers

0
votes

I had previously recreated the cluster and skipped this step:

vault write gcp/config [email protected]

Adding the key file fixed this.

There is also a chance that following the steps to create a custom role here and adding that custom role played a part.