Merge pull request kubernetes-sigs#18 from davidz627/fix/GCPRole

Reduced IAM Policy Role scope to minimal storageAdmin role
krunaljain · Jun 21, 2018 · fb1c44b · fb1c44b
2 parents 50b58c6 + 8e7a639
commit fb1c44b
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/deploy/setup-project.sh b/deploy/setup-project.sh
@@ -13,5 +13,4 @@ gcloud iam service-accounts delete "${IAM_NAME}" --quiet
 # Create new Service Account and Keys
 gcloud iam service-accounts create "${GCEPD_SA_NAME}"
 gcloud iam service-accounts keys create "${SA_FILE}" --iam-account "${IAM_NAME}"
-# TODO: Reduce scope of role to only what it necessary when cloud IAM fixes bugs.
-gcloud projects add-iam-policy-binding "${PROJECT}" --member serviceAccount:"${IAM_NAME}" --role roles/owner
+gcloud projects add-iam-policy-binding "${PROJECT}" --member serviceAccount:"${IAM_NAME}" --role roles/compute.storageAdmin