Authorize bounded staging metadata updates

Authorize bounded staging metadata updates

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified infra/staging/main.tf
modified infra/staging/tests/safety.tftest.hcl

Diff

2 files changed, +15 -0

  member  = google_service_account.deployer.member
}

# Compute requires actAs on an instance's attached service account when the
# deployer replaces metadata. Scope that permission to the staging fleet
# identity; the deployer has no instance-creation or service-account mutation
# permission.
resource "google_service_account_iam_member" "deployer_fleet_act_as" {
  service_account_id = google_service_account.fleet.name
  role               = "roles/iam.serviceAccountUser"
  member             = google_service_account.deployer.member
}

resource "google_project_iam_member" "deployer_runtime" {
  for_each = toset([
    "roles/artifactregistry.reader",

    condition     = google_secret_manager_secret_iam_member.deployer_cookie.role == "roles/secretmanager.secretAccessor"
    error_message = "The deployer identity may read only the cluster cookie secret."
  }

  assert {
    condition     = google_service_account_iam_member.deployer_fleet_act_as.role == "roles/iam.serviceAccountUser"
    error_message = "The deployer may act as only the exact staging fleet service account required by Compute metadata updates."
  }
}

run "rejects_production_project" {

282	282		`member = google_service_account.deployer.member`
283	283		`}`
284	284
	285	+	`# Compute requires actAs on an instance's attached service account when the`
	286	+	`# deployer replaces metadata. Scope that permission to the staging fleet`
	287	+	`# identity; the deployer has no instance-creation or service-account mutation`
	288	+	`# permission.`
	289	+	`resource "google_service_account_iam_member" "deployer_fleet_act_as" {`
	290	+	`service_account_id = google_service_account.fleet.name`
	291	+	`role = "roles/iam.serviceAccountUser"`
	292	+	`member = google_service_account.deployer.member`
	293	+	`}`
	294	+
285	295		`resource "google_project_iam_member" "deployer_runtime" {`
286	296		`for_each = toset([`
287	297		`"roles/artifactregistry.reader",`

122	122		`condition = google_secret_manager_secret_iam_member.deployer_cookie.role == "roles/secretmanager.secretAccessor"`
123	123		`error_message = "The deployer identity may read only the cluster cookie secret."`
124	124		`}`
	125	+
	126	+	`assert {`
	127	+	`condition = google_service_account_iam_member.deployer_fleet_act_as.role == "roles/iam.serviceAccountUser"`
	128	+	`error_message = "The deployer may act as only the exact staging fleet service account required by Compute metadata updates."`
	129	+	`}`
125	130		`}`
126	131
127	132		`run "rejects_production_project" {`