From 47057b62ff62e129a730c35bcb94906ae0d6a898 Mon Sep 17 00:00:00 2001 From: Rob Rankin Date: Wed, 13 Nov 2024 15:33:41 +0000 Subject: [PATCH] Swap groups_iam/iam_group for iam_by_principals in bootstrap README (#2680) --- fast/stages/0-bootstrap/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fast/stages/0-bootstrap/README.md b/fast/stages/0-bootstrap/README.md index 52f7da0645..c1887e84af 100644 --- a/fast/stages/0-bootstrap/README.md +++ b/fast/stages/0-bootstrap/README.md @@ -468,10 +468,10 @@ One other area where we directly support customizations is IAM. The code here, a In code, the distinction above reflects on how IAM bindings are specified in the underlying module variables: -- group roles "for humans" always use `iam_groups` variables +- group roles "for humans" always use `iam_by_principals` variables - service account roles always use `iam` variables -This makes it easy to tweak user roles by adding mappings to the `iam_groups` variables of the relevant resources, without having to understand and deal with the details of service account roles. +This makes it easy to tweak user roles by adding mappings to the `iam_by_principals` variables of the relevant resources, without having to understand and deal with the details of service account roles. One more critical difference in IAM bindings is between authoritative and additive: @@ -482,7 +482,7 @@ This stage groups all IAM definitions in the [organization-iam.tf](./organizatio When customizations are needed, three stage-level variables allow injecting additional bindings to match the desired setup: -- `group_iam` allows adding authoritative bindings for groups +- `iam_by_principals` allows adding authoritative bindings for groups - `iam` allows adding authoritative bindings for any type of supported principal, and is merged with the internal `iam` local and then with group bindings at the module level - `iam_bindings_additive` allows adding individual role/member pairs, and also supports IAM conditions