Implement the member_type on the users.yml

[ksobrenat32]

This pull request introduces support for specifying the member type (user, serviceAccount, or group) for IAM users across the infrastructure codebase. The changes ensure that member type is consistently captured, exported, and used for IAM policy management and compliance checks. This now makes it posible to work with the groups.

Also updated users.yml to the actual state.

[ksobrenat32]

R: @pabloem

[gemini-code-assist]

Summary of Changes

Hello @ksobrenat32, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the IAM management system by integrating an explicit member_type field into user definitions. This change allows for precise classification of IAM members, improving the accuracy and flexibility of IAM policy enforcement and compliance checks. The update involves modifications to the Python enforcement script, Terraform configurations, and a thorough update of the users.yml file to align with the new schema and current IAM state.

Highlights

• Explicit Member Type Support: Introduced a new member_type field to explicitly define IAM members as user, serviceAccount, or group across the infrastructure codebase.
• IAM Policy Enforcement: Updated the IAM enforcement logic to capture and export the new member_type and to include it in compliance checks, ensuring consistency between GCP and policy files.
• Terraform Integration: Modified Terraform configurations to utilize the explicit member_type when creating google_project_iam_member resources, replacing the previous inference logic based on email patterns.
• users.yml Update: The users.yml file has been comprehensively updated to include the member_type for all existing entries and to reflect the current state of IAM users, service accounts, and groups.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control. If you'd like to restart, comment assign set of reviewers

[pabloem]

lgtm. I'll wait for CI to run

[github-actions]

Terraform Plan for User Roles Changes

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # google_project_iam_member.project_members["apache-beam-testing-looker-admins@google.com-roles/looker.admin"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:apache-beam-testing-looker-admins@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/looker.admin"
    }

  # google_project_iam_member.project_members["apache-beam-testing-looker-users@google.com-roles/looker.instanceUser"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:apache-beam-testing-looker-users@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/looker.instanceUser"
    }

  # google_project_iam_member.project_members["beam-github-actions@apache-beam-testing.iam.gserviceaccount.com-roles/iam.roleAdmin"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:beam-github-actions@apache-beam-testing.iam.gserviceaccount.com"
      + project = "apache-beam-testing"
      + role    = "roles/iam.roleAdmin"
    }

  # google_project_iam_member.project_members["beam-github-actions@apache-beam-testing.iam.gserviceaccount.com-roles/resourcemanager.projectIamAdmin"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:beam-github-actions@apache-beam-testing.iam.gserviceaccount.com"
      + project = "apache-beam-testing"
      + role    = "roles/resourcemanager.projectIamAdmin"
    }

  # google_project_iam_member.project_members["beam-interns@google.com-roles/bigquery.jobUser"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:beam-interns@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/bigquery.jobUser"
    }

  # google_project_iam_member.project_members["beam-interns@google.com-roles/dataflow.developer"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:beam-interns@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/dataflow.developer"
    }

  # google_project_iam_member.project_members["beam-interns@google.com-roles/iam.serviceAccountUser"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:beam-interns@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/iam.serviceAccountUser"
    }

  # google_project_iam_member.project_members["beam-interns@google.com-roles/serviceusage.serviceUsageConsumer"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:beam-interns@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/serviceusage.serviceUsageConsumer"
    }

  # google_project_iam_member.project_members["cloud-dataflow-templates-team@twosync.google.com-roles/managedkafka.admin"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:cloud-dataflow-templates-team@twosync.google.com"
      + project = "apache-beam-testing"
      + role    = "roles/managedkafka.admin"
    }

  # google_project_iam_member.project_members["cloud-dataflow-templates-team@twosync.google.com-roles/viewer"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:cloud-dataflow-templates-team@twosync.google.com"
      + project = "apache-beam-testing"
      + role    = "roles/viewer"
    }

  # google_project_iam_member.project_members["datapls-plat-team@google.com-roles/looker.instanceUser"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:datapls-plat-team@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/looker.instanceUser"
    }

  # google_project_iam_member.project_members["datapls-plat-team@google.com-roles/viewer"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:datapls-plat-team@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/viewer"
    }

  # google_project_iam_member.project_members["datapls-team@google.com-roles/looker.instanceUser"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:datapls-team@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/looker.instanceUser"
    }

  # google_project_iam_member.project_members["datapls-unified-worker@google.com-roles/looker.instanceUser"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:datapls-unified-worker@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/looker.instanceUser"
    }

  # google_project_iam_member.project_members["wdg-team@google.com-roles/looker.instanceUser"] will be created
  + resource "google_project_iam_member" "project_members" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "group:wdg-team@google.com"
      + project = "apache-beam-testing"
      + role    = "roles/looker.instanceUser"
    }

Plan: 15 to add, 0 to change, 0 to destroy.