Merge pull request #178 from sosimon/bug_fix/permissions_check

remove permission check for resourcemanager.organization.get
terraform-google-modules · Apr 2, 2019 · 1c03238 · 1c03238
2 parents aaae9e1 + 8170a3c
commit 1c03238
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 15 deletions.
diff --git a/modules/core_project_factory/scripts/preconditions/preconditions.py b/modules/core_project_factory/scripts/preconditions/preconditions.py
@@ -71,10 +71,7 @@ def asdict(self):
 
 class OrgPermissions:
     # Permissions that the service account must have for any organization
-    ALL_PERMISSIONS = [
-        # Typically granted with `roles/resourcemanager.organizationViewer`
-        "resourcemanager.organizations.get",
-    ]
+    ALL_PERMISSIONS = []
 
     # Permissions required when the service account is attaching a new project
     # to a shared VPC
@@ -115,14 +112,23 @@ def __init__(self, org_id, shared_vpc=False, parent=False):
             self.permissions += self.PARENT_PERMISSIONS
 
     def validate(self, credentials):
+        body = {"permissions": self.permissions}
+        resource = "organizations/" + self.org_id
+
+        # no permissions to validate
+        if len(self.permissions) == 0:
+            return {
+                "type": "Service account permissions on organization",
+                "name": resource,
+                "satisfied": [],
+                "unsatisfied": []
+            }
+
         service = discovery.build(
             'cloudresourcemanager', 'v1',
             credentials=credentials
         )
 
-        body = {"permissions": self.permissions}
-        resource = "organizations/" + self.org_id
-
         request = service.organizations().testIamPermissions(
             resource=resource,
             body=body)

diff --git a/test/scripts/preconditions/test_preconditions.py b/test/scripts/preconditions/test_preconditions.py
@@ -109,19 +109,13 @@ def test_empty_required(self):
 class TestOrgPermissions(unittest.TestCase):
     def test_base_permissions(self):
         org_perms = preconditions.OrgPermissions("1234567890")
-        self.assertEqual(
-            org_perms.permissions,
-            [
-                "resourcemanager.organizations.get",
-            ]
-        )
+        self.assertEqual(org_perms.permissions, [])
 
     def test_shared_vpc_permissions(self):
         org_perms = preconditions.OrgPermissions("1234567890", shared_vpc=True)
         self.assertEqual(
             org_perms.permissions,
             [
-                "resourcemanager.organizations.get",
                 "compute.subnetworks.setIamPolicy",
                 "compute.organizations.enableXpnResource",
             ]
@@ -132,7 +126,6 @@ def test_parent_permissions(self):
         self.assertEqual(
             org_perms.permissions,
             [
-                "resourcemanager.organizations.get",
                 "resourcemanager.projects.create"
             ]
         )