disable iam for cloud run

Author: Cyclenerd

CLOUD_SHELL_TUTORIAL.md

@@ -45,12 +45,6 @@ Check Ingress (Should be `allowAll: true`):
 gcloud org-policies describe "run.allowedIngress" --effective --project="$GOOGLE_CLOUD_PROJECT" --quiet
 ```
 
-Check Domain Sharing (Should be `allowAll: true`):
-
-```bash
-gcloud org-policies describe "iam.allowedPolicyMemberDomains" --effective --project="$GOOGLE_CLOUD_PROJECT" --quiet
-```
-
 If these are restrictive, you may need to ask your Organization Admin to adjust them or use a project outside the organization. See [gcp/README.md](https://github.com/Cyclenerd/google-cloud-github-runner/blob/master/gcp/README.md) for policy details.
 
 ## Step 4: Deploy with Terraform
@@ -59,7 +53,7 @@ The Terraform version pre-installed in Google Cloud Shell is too old.
 Install a current Terraform version:
 
 ```bash
-curl "https://releases.hashicorp.com/terraform/1.14.3/terraform_1.14.3_linux_amd64.zip" -o "$HOME/terraform.zip"
+curl "https://releases.hashicorp.com/terraform/1.14.5/terraform_1.14.5_linux_amd64.zip" -o "$HOME/terraform.zip"
 unzip "$HOME/terraform.zip" terraform -d "$HOME"
 export PATH="$HOME:$PATH"
 ```

gcp/README.md

@@ -20,6 +20,7 @@ The **Owner role** (`roles/owner`) is the easiest option for deploying this proj
 | `roles/iam.roleViewer` | Role Viewer | Provides read access to all custom roles in the project. |
 | `roles/iam.serviceAccountAdmin` | Service Account Admin | Create and manage service accounts. |
 | `roles/iam.serviceAccountUser` | Service Account User | Run operations as the service account. |
+| `roles/logging.admin` | Logging Admin | Access to all logging permissions, and dependent permissions. |
 | `roles/monitoring.admin` | Monitoring Admin | All monitoring permissions. |
 | `roles/orgpolicy.policyViewer` | Organization Policy Viewer | View organization policies |
 | `roles/resourcemanager.projectIamAdmin` | Project IAM Admin | Access and administer a project IAM policies. |
@@ -53,9 +54,7 @@ gcloud auth application-default set-quota-project "$GOOGLE_CLOUD_PROJECT"
 
 ### 2. Organization Policy
 
-Make sure that the organization policy
-- "Allowed ingress settings (Cloud Run)" `run.allowedIngress` is configured and set to `all`, and
-- "Domain restricted sharing" `iam.allowedPolicyMemberDomains` is configured and set to `allowAll`.
+Make sure that the organization policy "Allowed ingress settings (Cloud Run)" `run.allowedIngress` is configured and set to `all`.
 
 ```yaml
 run.allowedIngress
@@ -64,11 +63,6 @@ spec:
   - values:
       allowedValues:
       - all
-
-iam.allowedPolicyMemberDomains
-spec:
-  rules:
-  - allowAll: true
 ```
 
 > That is the default setting.
@@ -77,7 +71,6 @@ spec:
 ```bash
 gcloud services enable "orgpolicy.googleapis.com" --project="$GOOGLE_CLOUD_PROJECT"
 gcloud org-policies describe "run.allowedIngress" --effective --project="$GOOGLE_CLOUD_PROJECT"
-gcloud org-policies describe "iam.allowedPolicyMemberDomains" --effective --project="$GOOGLE_CLOUD_PROJECT"
 ```
 
 If you are using the [Fabric FAST Project Factory](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric), add the following to your `your-project-id.yaml`:
@@ -89,9 +82,6 @@ org_policies:
       - allow:
           values:
             - all
-  iam.allowedPolicyMemberDomains:
-    rules:
-      - allow_all: true
 ```
 
 See <https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints> for more information.

gcp/cloud-run.tf

@@ -57,6 +57,10 @@ module "cloud_run_github_runners_manager" {
     }
   }
   service_config = {
+    # Disable IAM permission check
+    # There should be no requirement to pass the roles/run.invoker to the IAM block to enable public access.
+    # This allows for the org policy domain restricted sharing org policy remain enabled.
+    invoker_iam_disabled = true
     # Second generation Cloud Run for faster CPU.
     # The first generation with faster cold starts is still too slow for our webhook.
     gen2_execution_environment = true
@@ -69,9 +73,6 @@ module "cloud_run_github_runners_manager" {
     create = false
     email  = module.service-account-cloud-run-github-runners-manager.email
   }
-  iam = {
-    "roles/run.invoker" = ["allUsers"] # Public
-  }
   deletion_protection = false
   depends_on = [
     google_secret_manager_secret_version.secret-version-default,

tools/assign-iam-roles.sh

@@ -36,6 +36,7 @@ ROLES=(
 	"roles/iam.roleViewer"
 	"roles/iam.serviceAccountAdmin"
 	"roles/iam.serviceAccountUser"
+	"roles/logging.admin"
 	"roles/monitoring.admin"
 	"roles/orgpolicy.policyViewer"
 	"roles/resourcemanager.projectIamAdmin"