Fix IAM permissions for Cloud Build SA

Author: alex-doudou

cicd-mcp-server/cloudbuild/cloudbuild.go

@@ -122,21 +122,42 @@ func addCreateTriggerTool(server *mcp.Server, cbClient cloudbuildclient.CloudBui
 	mcp.AddTool(server, &mcp.Tool{Name: "create_build_trigger", Description: "Creates a new Cloud Build trigger."}, createTriggerToolFunc)
 }
 
-// setPermissionsForSA resolves the SA and grants it a role.
+// setPermissionsForCloudBuildSA resolves the SA and grants it a role.
 func setPermissionsForCloudBuildSA(ctx context.Context, projectID, serviceAccount string, rmClient resourcemanagerclient.ResourcemanagerClient, iamClient iamclient.IAMClient) (string, error) {
 	resolvedSA := serviceAccount
 
 	// If the serviceAccount prefix is not there, add it.
 	if !strings.HasPrefix(resolvedSA, "serviceAccount:") {
 		resolvedSA = fmt.Sprintf("serviceAccount:%s", resolvedSA)
 	}
-	roles := []string{"roles/developerconnect.tokenAccessor"}
+	roles := []string{
+		"roles/logging.logWriter",
+		"roles/artifactregistry.writer",
+		"roles/developerconnect.tokenAccessor",
+		"roles/storage.admin",
+		"roles/secretmanager.admin",
+		"roles/run.admin",
+		"roles/iam.serviceAccountUser",
+		"roles/cloudbuild.builds.builder",
+	}
 	for _, r := range roles {
 		_, err := iamClient.AddIAMRoleBinding(ctx, fmt.Sprintf("projects/%s", projectID), r, resolvedSA)
 		if err != nil {
 			return "", fmt.Errorf("unable to add role %s to member %s on resource %s err: %w", r, resolvedSA, fmt.Sprintf("projects/%s", projectID), err)
 		}
 	}
+
+	// Grant Secret Manager Admin to Developer Connect Service Agent (P4SA)
+	projectNumber, err := rmClient.ToProjectNumber(ctx, projectID)
+	if err != nil {
+		return "", fmt.Errorf("unable to resolve project id to number: %w", err)
+	}
+	p4sa := fmt.Sprintf("serviceAccount:service-%d@gcp-sa-developerconnect.iam.gserviceaccount.com", projectNumber)
+	_, err = iamClient.AddIAMRoleBinding(ctx, fmt.Sprintf("projects/%s", projectID), "roles/secretmanager.admin", p4sa)
+	if err != nil {
+		return "", fmt.Errorf("unable to add secretmanager.admin role to Developer Connect P4SA %s: %w", p4sa, err)
+	}
+
 	return resolvedSA, nil
 }
 

cicd-mcp-server/cloudbuild/cloudbuild_test.go

@@ -38,16 +38,37 @@ func TestSetPermissionsForCloudBuildSA(t *testing.T) {
 	serviceAccount := "serviceAccount:test-sa@example.com"
 	serviceAccountWOPrefix := "test-sa@example.com"
 
+	roles := []string{
+		"roles/logging.logWriter",
+		"roles/artifactregistry.writer",
+		"roles/developerconnect.tokenAccessor",
+		"roles/storage.admin",
+		"roles/secretmanager.admin",
+		"roles/run.admin",
+		"roles/iam.serviceAccountUser",
+		"roles/cloudbuild.builds.builder",
+	}
+	projectNumber := int64(12345)
+	p4sa := fmt.Sprintf("serviceAccount:service-%d@gcp-sa-developerconnect.iam.gserviceaccount.com", projectNumber)
+
 	t.Run("with service account", func(t *testing.T) {
-		mockIAMClient.EXPECT().AddIAMRoleBinding(ctx, fmt.Sprintf("projects/%s", projectID), "roles/developerconnect.tokenAccessor", serviceAccount).Return(nil, nil)
+		for _, r := range roles {
+			mockIAMClient.EXPECT().AddIAMRoleBinding(ctx, fmt.Sprintf("projects/%s", projectID), r, serviceAccount).Return(nil, nil)
+		}
+		mockRMClient.EXPECT().ToProjectNumber(ctx, projectID).Return(projectNumber, nil)
+		mockIAMClient.EXPECT().AddIAMRoleBinding(ctx, fmt.Sprintf("projects/%s", projectID), "roles/secretmanager.admin", p4sa).Return(nil, nil)
 
 		resolvedSA, err := setPermissionsForCloudBuildSA(ctx, projectID, serviceAccount, mockRMClient, mockIAMClient)
 		assert.NoError(t, err)
 		assert.Equal(t, serviceAccount, resolvedSA)
 	})
 
 	t.Run("with service account, no prefix", func(t *testing.T) {
-		mockIAMClient.EXPECT().AddIAMRoleBinding(ctx, fmt.Sprintf("projects/%s", projectID), "roles/developerconnect.tokenAccessor", serviceAccount).Return(nil, nil)
+		for _, r := range roles {
+			mockIAMClient.EXPECT().AddIAMRoleBinding(ctx, fmt.Sprintf("projects/%s", projectID), r, serviceAccount).Return(nil, nil)
+		}
+		mockRMClient.EXPECT().ToProjectNumber(ctx, projectID).Return(projectNumber, nil)
+		mockIAMClient.EXPECT().AddIAMRoleBinding(ctx, fmt.Sprintf("projects/%s", projectID), "roles/secretmanager.admin", p4sa).Return(nil, nil)
 
 		resolvedSA, err := setPermissionsForCloudBuildSA(ctx, projectID, serviceAccountWOPrefix, mockRMClient, mockIAMClient)
 		assert.NoError(t, err)