Update cloud platform permission and roles documentation
The Cloud Platform/Permissions and Roles page has become a bit out of date following recent changes to our permissions/roles model. In particular the statement/section regarding how access is granted to individuals. We need to update this page taking into account the following:
- We no longer grant the Owner role to anyone, instead, we prefer a combination of the Editor role and our custom deployer permissions granted via the gcp-product-factory.
- The page infers that individuals can only be in a single role when in fact the
additional_editors
,additional_deployers
, andadditional_viewers
variables in the gcp-product-factory are not mutually exclusive and we often assign users to both theadditional_editors
andadditional_deployers
variables as both are required. - The section on the Cloud Run Deployer service account for CI is no longer relevant and should be removed. We now use our
terraform-deploy
service accounts exclusively for deployments via theterraform-pipeline.yml
CI template.
Edited by Ryan Kowalewski