back with constraint/iam.automaticIamGrantsForDefaultServiceAccounts …

…to org step
terraform-google-modules · Sep 26, 2024 · b8885e0 · b8885e0
1 parent 688c755
commit b8885e0
Show file tree

Hide file tree

Showing 4 changed files with 3 additions and 3 deletions.
diff --git a/0-bootstrap/org_policy.tf b/0-bootstrap/org_policy.tf
@@ -20,8 +20,7 @@ locals {
   policy_for      = var.parent_folder != "" ? "folder" : "organization"
 
   boolean_type_organization_policies = toset([
-    "compute.skipDefaultNetworkCreation",
-    "iam.automaticIamGrantsForDefaultServiceAccounts"
+    "compute.skipDefaultNetworkCreation"
   ])
 }
 

diff --git a/1-org/envs/shared/org_policy.tf b/1-org/envs/shared/org_policy.tf
@@ -34,6 +34,7 @@ locals {
     "sql.restrictPublicIp",
     "sql.restrictAuthorizedNetworks",
     "iam.disableServiceAccountKeyCreation",
+    "iam.automaticIamGrantsForDefaultServiceAccounts",
     "iam.disableServiceAccountKeyUpload",
     "storage.uniformBucketLevelAccess",
     "storage.publicAccessPrevention"

diff --git a/test/integration/bootstrap/bootstrap_test.go b/test/integration/bootstrap/bootstrap_test.go
@@ -309,7 +309,6 @@ func TestBootstrap(t *testing.T) {
 			// boolean organization policies
 			for _, booleanConstraint := range []string{
 				"constraints/compute.skipDefaultNetworkCreation",
-				"constraints/iam.automaticIamGrantsForDefaultServiceAccounts",
 			} {
 				orgPolicy := gcloud.Runf(t, "resource-manager org-policies describe %s --folder %s", booleanConstraint, parentFolder)
 				assert.True(orgPolicy.Get("booleanPolicy.enforced").Bool(), fmt.Sprintf("org policy %s should be enforced", booleanConstraint))

diff --git a/test/integration/org/org_test.go b/test/integration/org/org_test.go
@@ -164,6 +164,7 @@ func TestOrg(t *testing.T) {
 				"constraints/iam.disableServiceAccountKeyCreation",
 				"constraints/storage.uniformBucketLevelAccess",
 				"constraints/storage.publicAccessPrevention",
+				"constraints/iam.automaticIamGrantsForDefaultServiceAccounts",
 			} {
 				orgPolicy := gcloud.Runf(t, "resource-manager org-policies describe %s --folder %s", booleanConstraint, parentFolder)
 				assert.True(orgPolicy.Get("booleanPolicy.enforced").Bool(), fmt.Sprintf("org policy %s should be enforced", booleanConstraint))