Allow CDN invalidator to read URL maps

Author: joecorall

README.md

@@ -97,7 +97,7 @@ make sync-aptly-gpg-key-id
 
 - The managed SSL certificate will stay in provisioning until the delegated package subdomain resolves to the created load balancer IP.
 - The bucket is public so `apt` and other package managers can fetch package metadata and artifacts without authentication.
-- This stack grants the GitHub service account bucket-level `roles/storage.objectAdmin` for syncing package repositories and a custom role with `compute.urlMaps.invalidateCache` for Cloud CDN invalidation.
+- This stack grants the GitHub service account bucket-level `roles/storage.objectAdmin` for syncing package repositories and a custom role with `compute.urlMaps.get` and `compute.urlMaps.invalidateCache` for Cloud CDN invalidation.
 - Cloud CDN uses origin cache headers. Package assets are uploaded as long-lived immutable objects, while mutable repository metadata is uploaded as `no-store`.
 - Terraform creates the Secret Manager secret containers, but it does not write the private key or passphrase into Terraform state.
 

main.tf

@@ -205,7 +205,10 @@ resource "google_project_iam_custom_role" "cdn_cache_invalidator" {
   role_id     = "cdnCacheInvalidator"
   title       = "Cloud CDN Cache Invalidator"
   description = "Allows package publishers to invalidate Cloud CDN cache entries."
-  permissions = ["compute.urlMaps.invalidateCache"]
+  permissions = [
+    "compute.urlMaps.get",
+    "compute.urlMaps.invalidateCache",
+  ]
 
   depends_on = [google_project_service.service]
 }