GCP IAM Binding with Conditions

[ghost]

This issue was originally opened by @parmarsumit as hashicorp/terraform#20078. It was migrated here as a result of the provider split. The original body of the issue is below.

---

[nat-henderson]

@parmasurmit - do you mean that you would like the existing IAM resources to support an optional "condition" field, where you could specify freeform conditions as described in https://cloud.google.com/iam/docs/conditions-overview?

[parmarsumit]

Yes Please exactly

…

On Wed, Jan 23, 2019 at 8:26 PM Nathan McKinley ***@***.***> wrote: @parmasurmit - do you mean that you would like the existing IAM resources to support an optional "condition" field, where you could specify freeform conditions as described in https://cloud.google.com/iam/docs/conditions-overview? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2909 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADE35-zRsqB7Dy3bLQe2GZkh6Vu9Me8Zks5vGMVlgaJpZM4aNo3B> .

--

-- Regards, Sumit Parmar +353 - 0894583082 +91 - 9555541566 [email protected]

[primeroz]

This is really important for us as well.

Is there any roadmap for this feature ?

[redbaron]

@danawillow , that PR seems to be stalled :( Do you plan to continue work on it or it can be picked up by someone else? What is left to do to make it mergeable?

[danawillow]

Yup, I think I'll be able to get to it later this week, or next week at the latest. If I don't, I'll publish a draft of what I have so far so someone else can take it over.

[dancmeyers]

Just another voice to say this would be really handy for us as well. I just got pointed to the docs about IAM conditions by our Google account manager and thought it was exactly what we needed, but everything else we have is in Terraform and we don't want a separate process just for this.

[morgante]

@danawillow is this on the team radar? I saw you added it for service accounts, could we roll it out for projects as well?

[danawillow]

Yup, my plan is to add it for every resource that we can before our next release so they all go out together.

[dancmeyers]

Amazing :D It is GCS access permissions we wanted it for, so that's great to hear!

[danawillow]

Quick update- I wasn't able to get the rest out in time for this recent release, so my new plan is to add it for every resource that we can before our next release.

[janmasarik]

So next release (2.21.0) @danawillow? :-)

We're also waiting for this and it would be amazing to have it there

[danawillow]

GCS was harder than I expected (I'm doing it by migrate resources to magic modules in order to avoid a ton of copy/pasting) and we're pushing real hard towards 3.0 right now, so probably not until 3.1 unfortunately.

[janmasarik]

Thanks a lot for the prompt response, but not even GoogleCloudPlatform/magic-modules#2633 will be released before 3.0? 😞

[danawillow]

That's in 2.20! https://github.com/terraform-providers/terraform-provider-google-beta/blob/master/CHANGELOG.md#2200-november-13-2019

[janmasarik]

Wow, I totally overlooked that! Thank you very much! :)

[danawillow]

GoogleCloudPlatform/magic-modules#2794 is out for review for GCS. After that, I believe the only remaining product is KMS. Once that's done, I'll close this issue out, and as more GCP products support conditions they can be requested separately.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!