Search in sources :

Example 31 with Binding

use of com.google.api.services.iam.v1.model.Binding in project terra-cli by DataBiosphere.

the class Workspace method grantBreakGlass.

/**
 * Grant break-glass access to a user of this workspace. The Editor and Project IAM Admin roles
 * are granted to the user's proxy group.
 *
 * @param granteeEmail email of the workspace user requesting break-glass access
 * @param userProjectsAdminCredentials credentials for a SA that has permission to set IAM policy
 *     on workspace projects in this WSM deployment (e.g. WSM application SA)
 * @return the proxy group email of the workspace user that was granted break-glass access
 */
public String grantBreakGlass(String granteeEmail, ServiceAccountCredentials userProjectsAdminCredentials) {
    // fetch the user's proxy group email from SAM
    String granteeProxyGroupEmail = SamService.fromContext().getProxyGroupEmail(granteeEmail);
    logger.debug("granteeProxyGroupEmail: {}", granteeProxyGroupEmail);
    // grant the Editor role to the user's proxy group email on the workspace project
    CloudResourceManagerCow resourceManagerCow = CrlUtils.createCloudResourceManagerCow(userProjectsAdminCredentials);
    try {
        Policy policy = resourceManagerCow.projects().getIamPolicy(googleProjectId, new GetIamPolicyRequest()).execute();
        List<Binding> updatedBindings = Optional.ofNullable(policy.getBindings()).orElse(new ArrayList<>());
        updatedBindings.add(new Binding().setRole("roles/editor").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
        updatedBindings.add(new Binding().setRole("roles/resourcemanager.projectIamAdmin").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
        policy.setBindings(updatedBindings);
        resourceManagerCow.projects().setIamPolicy(googleProjectId, new SetIamPolicyRequest().setPolicy(policy)).execute();
    } catch (IOException ioEx) {
        throw new SystemException("Error granting the Editor and Project IAM Admin roles to the user's proxy group.", ioEx);
    }
    return granteeProxyGroupEmail;
}
Also used : Policy(com.google.api.services.cloudresourcemanager.v3.model.Policy) Binding(com.google.api.services.cloudresourcemanager.v3.model.Binding) CloudResourceManagerCow(bio.terra.cloudres.google.cloudresourcemanager.CloudResourceManagerCow) SystemException(bio.terra.cli.exception.SystemException) SetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.SetIamPolicyRequest) IOException(java.io.IOException) GetIamPolicyRequest(com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest)

Aggregations

Binding (com.google.api.services.cloudresourcemanager.v3.model.Binding)12 IOException (java.io.IOException)10 Policy (com.google.api.services.cloudresourcemanager.v3.model.Policy)9 Binding (com.google.api.services.iam.v1.model.Binding)6 ArrayList (java.util.ArrayList)6 Policy (com.google.api.services.iam.v1.model.Policy)5 ServiceAccount (com.google.api.services.iam.v1.model.ServiceAccount)5 SetIamPolicyRequest (com.google.api.services.iam.v1.model.SetIamPolicyRequest)5 CloudKMS (com.google.api.services.cloudkms.v1.CloudKMS)4 Binding (com.google.api.services.cloudkms.v1.model.Binding)4 Policy (com.google.api.services.cloudkms.v1.model.Policy)4 SetIamPolicyRequest (com.google.api.services.cloudkms.v1.model.SetIamPolicyRequest)4 GetIamPolicyRequest (com.google.api.services.cloudresourcemanager.v3.model.GetIamPolicyRequest)4 SetIamPolicyRequest (com.google.api.services.cloudresourcemanager.v3.model.SetIamPolicyRequest)4 CloudHealthcare (com.google.api.services.healthcare.v1.CloudHealthcare)4 Binding (com.google.api.services.healthcare.v1.model.Binding)4 Policy (com.google.api.services.healthcare.v1.model.Policy)4 SetIamPolicyRequest (com.google.api.services.healthcare.v1.model.SetIamPolicyRequest)4 CreateServiceAccountRequest (com.google.api.services.iam.v1.model.CreateServiceAccountRequest)4 ServiceAccountName (bio.terra.cloudres.google.iam.ServiceAccountName)3