Cloud Workstations Change Default Scopes

[Collinbrown95]

Description

In addition to having the necessary IAM roles, the VM instances that are created by cloud workstations need to have the sufficient OAuth scopes for requests made from the instances.

This has presented an issue where users on the RStudio cloud workstations can read from GCS buckets in the same project, but cannot write back to those buckets, despite having sufficient IAM permissions. The problem is that, by default, the VM created by the cloud workstation resource has Storage: "Read Only" access scope, which prevents writing to a bucket by a user of the RStudio cloud workstation.

It should be possible to configure service_account_scope directly in Terraform to grant the VM instances created the read-write scope.

Relevant Resources

• GCP Service Account Docs
• Cloud Storage Scopes
• Terraform configuration for cloud api scopes