Merge pull request #524 from lsst/tickets/DM-44606

DM-44606: Update permissions for vo-cutouts
lsst · Jun 10, 2024 · cb44ead · cb44ead
2 parents 3c05e03 + 6ea486d
commit cb44ead
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 4 deletions.
diff --git a/environment/deployments/science-platform/cloudsql/main.tf b/environment/deployments/science-platform/cloudsql/main.tf
@@ -196,15 +196,14 @@ resource "google_storage_bucket_iam_binding" "cutouts-bucket-ro-iam-binding" {
   role   = "roles/storage.objectViewer"
   members = [
     "serviceAccount:${local.cutout_service_account}",
-    "serviceAccount:${var.butler_service_account}"
   ]
 }
 
 resource "google_storage_bucket_iam_binding" "cutouts-bucket-rw-iam-binding" {
   bucket = module.cutouts_bucket.name
-  role   = "roles/storage.objectCreator"
+  role   = "roles/storage.legacyBucketWriter"
   members = [
-    "serviceAccount:${var.butler_service_account}"
+    "serviceAccount:${local.cutout_service_account}"
   ]
 }
 

diff --git a/environment/deployments/science-platform/env/dev-cloudsql.tfvars b/environment/deployments/science-platform/env/dev-cloudsql.tfvars
@@ -19,4 +19,4 @@ db_maintenance_window_update_track = "canary"
 backups_enabled                    = true
 
 # Increase this number to force Terraform to update the dev environment.
-# Serial: 11
+# Serial: 12