How to restrict cloud build permission to all other buckets

user_18083901 0
Viewed 140

I created a service account for devs, so they can use the "gcloud run deploy" command. I've manage to find the correct roles: Artifact Registry Administrator and Cloud Run Admin; but there is a third permission about the storage part which I can't find the right for, "Cloud Build Service Account" or "Storage Admin" cause both give full permissions to all buckets and objects.

google-cloud-build service-accounts google-cloud-run google-cloud-storage gcloud
2 Answers

You can enable uniform bucket-level access either when you create a new bucket, or when you explicitly enable uniform bucket-level access on an existing bucket.

Also when you switch to Uniform IAM access, Owner/Viewer/Editor role no longer has access to buckets. (Note that the role/storage.admin isn't included in this primitive role).

Another way is to remove all the IAM permission on the bucket and the project that have access to the bucket except your service account.

You may refer to this documentation for more information regarding behavior, inheritance and consideration.

user_177203630

You can restrict your service account to only the default Cloud Build bucket (<PROJECT_ID>_cloudbuild) by going to the bucket permissions tab and adding a new principal (your service account) with the Storage Admin role.

However, another thing you must do is to give the service account the storage.buckets.list permission for the whole project, which is why you keep seeing the error.

You can verify this by running gcloud run deploy with --verbosity=debug, to see the internal error message:

"error": {
    "code": 403,
    "message": "<SERVICE_ACCOUNT> does not have storage.buckets.list access to the Google Cloud project.",
    ...

To give minimal permissions, you can create a custom role with only the storage.buckets.list permission and assign it to your service account, which is enough to solve the problem as I verified.

Here are the permissions I ended up using for the service account (relevant doc):

  • Cloud Build Editor role (project-wide)
  • Artifact Registry Admin role (project-wide)
  • Storage Admin role (only for cloud build bucket)
  • Cloud Run Admin role (project-wide)
  • Service Account User role (project-wide)
  • Custom role (project wide, only contains storage.buckets.list)

Let me know if this was useful.

user_169298940
Related