Grant read-only access to auditors

relaycorp · Mar 4, 2024 · 4fd5101 · 4fd5101
1 parent 4522f29
commit 4fd5101
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/environments/belgium/gateway.tf b/environments/belgium/gateway.tf
@@ -16,3 +16,13 @@ module "gateway" {
 
   gcp_shared_infra_project_id = var.shared_infra_gcp_project_id
 }
+
+// TODO: Remove once the security audit is over
+resource "google_project_iam_member" "temporary_auditors" {
+  // repeat for each auditor_uris
+  for_each = toset(var.temporary_auditor_iam_uris)
+
+  project = var.gcp_project_id
+  role    = "roles/viewer"
+  member  = each.value
+}
diff --git a/environments/belgium/variables.tf b/environments/belgium/variables.tf
@@ -7,3 +7,8 @@ variable "gcp_project_id" {}
 variable "shared_infra_gcp_project_id" {}
 
 variable "mongodbatlas_project_id" {}
+
+// TODO: Remove once the security audit is over
+variable "temporary_auditor_iam_uris" {
+  type = list(string)
+}