00-pre-req-terraform-samples/vpc-sc-scoped-policy.tf (28 lines of code) (raw):

/** * Copyright 2024 The Isolator Authors * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /****************************************** Scoped Policy for Isolator *****************************************/ # Scoped Policy (set up at the folder level) resource "google_access_context_manager_access_policy" "isolator_vpcsc_scoped_policy" { parent = "organizations/${var.organization_id}" title = "Isolator Scoped Policy" scopes = ["folders/${var.isolator_folder_id}"] } # Add the IAM Members to manage this scoped policy resource "google_access_context_manager_access_policy_iam_member" "isolator_vpc_sc_poc_pipeline_member" { name = google_access_context_manager_access_policy.isolator_vpcsc_scoped_policy.name role = "roles/accesscontextmanager.policyAdmin" member = "serviceAccount:${var.sa_03_vpc_sc}" }