How to add IAM policy binding to a service account using Google Cloud Deployment Manager?

0
votes

I want to write a GCP Deployment Manager resource template that can create a IAM policy binding to a service account as a resource. In particular, I want to configure allowing a member to impersonate a single service account with Deployment Manager.

I know this can be done with GCP console, gcloud SDK or Pulumi.

Maybe I'm missing something, but how can I achieve this with Deployment Manager?

1
google-cloud-platformgoogle-iamgoogle-deployment-manager

1 Answers

4
votes

You can use the Deployment Manager to create a IAM policy binding to a Service Account at the Service Account creation.

I test it in my own project using the following jinja file.

  1. I created a deploy.jinja
resources:
- name: test-name-deploy
  type: iam.v1.serviceAccount
  properties:
    accountId: testing
    displayName: testing-sa
  accessControl:
    gcpIamPolicy:
      bindings:
      - role: roles/editor
        members:
        - "user:[email protected]"
  1. I created a deployment:
gcloud deployment-manager deployments create mytestdm --template=deploy.jinja

And I received the following result:

NAME              TYPE                   STATE      ERRORS  INTENT
test-name-deploy  iam.v1.serviceAccount  COMPLETED  []

Take in consideration that you need the API iam.googleapis.com enable.

You can check the following documentation for further information.