[test-org] Create long-living SA which has G-Suite access. #481
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…roject-factory tests of gsuite functionality and can be used in other gsuite-related tests in other modules.
cray0000
requested review from
aaron-lane,
morgante and
ocsig
as code owners
aaron-lane
approved these changes
Nov 28, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Used for project-factory tests of gsuite functionality.
Can later be used in other gsuite-related tests in other modules.
Note for @aaron-lane:
Added an output
ci_gsuite_sa_emailwith the SA email which will need to be used when going through the delegation guide here:https://developers.google.com/admin-sdk/directory/v1/guides/delegation
The guide has to be followed all the way up to granting SA the domain-wide access to Admin SDK Directory API.
Also we'll use the
[email protected]user account to impersonate this newly created SA account (https://github.com/terraform-google-modules/terraform-google-project-factory/blob/master/build/int.cloudbuild.yaml#L24).Don't really know if any additional linkage has to be setup between
[email protected]and the created SA, but the guide says nothing about it, so probably any real user account can be impersonated by the SA.Related to terraform-google-modules/terraform-google-project-factory#111.