Add IAM support for storage bucket

[sebglon]

Hi there,

Thank you for opening an issue. Please note that we try to keep the Terraform issue tracker reserved for bug reports and feature requests. For general usage questions, please see: https://www.terraform.io/community.html.

Terraform Version

This is a feature proposal

Affected Resource(s)

Please list the resources as a list, for example:

• google_storage_bucket
• google_storage_bucket_acl
• google_storage_object_acl
• google_storage_object

Expected Behavior

Add support for IAM Role on Google storage bucket

Actual Behavior

use new feature : https://cloud.google.com/storage/docs/json_api/v1/buckets/setIamPolicy

[sebglon]

proposition:

resource "google_storage_bucket" "image-store" {
  name     = "image-store-bucket"
  location = "EU"
}

resource "google_storage_bucket_iam" "image-store-iam" {
  bucket = "${google_storage_bucket.image-store.name}"

  policy_data = "<reuse google_iam_pilicy>"
}
  ]
}

[sebglon]

for using SetIamPolicy, we can upgrade "google.golang.org/api/storage/v1" to a more recent version
andu ugrade "google.golang.org/api/gensupport"

[TiGz]

I want this too! kthxbye :)

[danawillow]

@emilymye

[greendog99]

Looks like the PR is nearly done (thanks @sebglon!). Any idea which upcoming release this might end up in? Looking forward to this feature!

[amoiseiev]

@rosbo @danawillow hey guys. It looks like you are close to the finish line on this one. Do you think it can be merged or checked / commented in the next week or two? GCS is one of the core components and the ability to use IAM bindings is must have.

[rosbo]

I haven't started the work for this but with the refactor I did in #744 and #776 it shouldn't take long.

One thing to note, after looking briefly at the API, it seems like we can only attach IAM policies to buckets, not particular objects. I updated the name of the issue to reflect this.

[sebglon]

The ACL is no on specific object, it is on object action in the bucket.

[benbro]

I suggest adding two resources:

• google_storage_bucket_iam_member
• google_storage_bucket_iam_binding

In my opinion it's much cleaner and intuitive than using iam_policy.
Similar to google_project_iam_binding and google_project_iam_member.

[sebglon]

Alredy exist with another name on #493

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!