FAQ | This is a LIVE service | Changelog

Update cloud platform permission and roles documentation

The Cloud Platform/Permissions and Roles page has become a bit out of date following recent changes to our permissions/roles model. In particular the statement/section regarding how access is granted to individuals. We need to update this page taking into account the following:

  • We no longer grant the Owner role to anyone, instead, we prefer a combination of the Editor role and our custom deployer permissions granted via the gcp-product-factory.
  • The page infers that individuals can only be in a single role when in fact the additional_editors, additional_deployers, and additional_viewers variables in the gcp-product-factory are not mutually exclusive and we often assign users to both the additional_editors and additional_deployers variables as both are required.
  • The section on the Cloud Run Deployer service account for CI is no longer relevant and should be removed. We now use our terraform-deploy service accounts exclusively for deployments via the terraform-pipeline.yml CI template.
Edited by Ryan Kowalewski