deployment - 谷歌云部署管理器 : How to set up IAM when creating bucket

Question

我已经使用 Google Cloud Deployment Manager 创建了一个存储桶(见下文)，但是权限部分被忽略了，我找不到任何在使用 Google Cloud Deployment Manager 时设置 IAM 的示例。你能帮忙吗？

    resources:
    - name: {{ env["name"] }}
      type: storage.v1.bucket
      properties:
        kind: storage#bucket
        location: eu
        storageClass: MULTI_REGIONAL
        iam-policy:
          bindings:
          - role: roles/storage.objectViewer
            members:
            - allUsers

Answer 1

您现在可以使用 IAM 绑定(bind)装饰部署管理器对象。这样的事情应该有效:

- name: <BUCKETNAME>
  type: storage.v1.bucket
  properties:
    storageClass: REGIONAL
    location: us-west1
  accessControl:
    gcpIamPolicy:
      bindings:
      - role: roles/storage.objectViewer
        members:
        - "serviceAccount:<YOURSERVICEACCOUNT>"
      - role: roles/storage.legacyBucketOwner
        members:
        - "projectEditor:<YOURPROJECT>"
        - "projectOwner:<YOURPROJECT>"
      - role: roles/storage.legacyBucketReader
        members:
        - "projectViewer:<YOURPROJECT>"

参见 https://cloud.google.com/deployment-manager/docs/configuration/set-access-control-resources了解更多信息。请注意，IAM 绑定(bind)与存储桶 ACL 和/或对象 ACL 相关但不同。参见 https://cloud.google.com/storage/docs/access-control/有关 GCS 访问控制的更多信息。

另请注意，您需要在上述示例中包括完整的 IAM 绑定(bind)集。