remove owner role

terraform-google-modules · Feb 24, 2025 · 09150c1 · 09150c1
1 parent 49c4d06
commit 09150c1
Show file tree

Hide file tree

Showing 6 changed files with 25 additions and 7 deletions.
diff --git a/metadata.yaml b/metadata.yaml
@@ -333,8 +333,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

diff --git a/modules/backend/metadata.yaml b/modules/backend/metadata.yaml
@@ -300,8 +300,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

diff --git a/modules/dynamic_backends/metadata.yaml b/modules/dynamic_backends/metadata.yaml
@@ -325,8 +325,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

diff --git a/modules/frontend/metadata.yaml b/modules/frontend/metadata.yaml
@@ -214,8 +214,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

diff --git a/modules/serverless_negs/metadata.yaml b/modules/serverless_negs/metadata.yaml
@@ -289,8 +289,11 @@ spec:
           - roles/compute.xpnAdmin
       - level: Project
         roles:
-          - roles/owner
           - roles/storage.admin
+          - roles/compute.admin
+          - roles/run.admin
+          - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com

diff --git a/test/setup/iam.tf b/test/setup/iam.tf
@@ -16,8 +16,11 @@
 
 locals {
   int_required_project_roles = [
-    "roles/owner",
-    "roles/storage.admin"
+    "roles/storage.admin",
+    "roles/compute.admin",
+    "roles/run.admin",
+    "roles/iam.serviceAccountUser",
+    "roles/certificatemanager.owner"
   ]
   int_required_folder_roles = [
     "roles/compute.xpnAdmin"