Reputation: 168
I am trying to create a service account that has permission to particular pubsub topic only.
I create a topic:
gcloud pubsub topics create mytopic
Then create a service account:
gcloud iam service-accounts create my-user \
--display-name "my-user"
Then trying to grant this service account permission:
gcloud alpha pubsub topics add-iam-policy-binding mytopic \
--member="serviceAccount:[email protected]" \
--role='roles/pubsub.editor'
Get the service account json file:
gcloud iam service-accounts keys create \
--iam-account "[email protected]" \
service-account.json
Using this service account json credentials I get denied creating a subscription to this topic.
If I give this user permissions to the entire project's pubsub, I am able to create a subscription to this topic but I dont want to give that much permission to this service account.
gcloud projects add-iam-policy-binding myproject \
--member="serviceAccount:[email protected]" \
--role='roles/pubsub.editor'
I am trying to use this and it doesnt seem to work: https://cloud.google.com/sdk/gcloud/reference/alpha/pubsub/topics/add-iam-policy-binding
Am I missing something here? I would have thought that the role binding for this user to the topic would be enough permission?
Upvotes: 5
Views: 17307
Reputation: 1899
for creating subscriptions, you need
pubsub.subscriptions.create on the containing Cloud project and pubsub.topics.attachSubscription on the requested topic
as pubsub.subscriptions.create
is only contained in roles/
pubsub.editor
(and ...admin
), you might want to create a custom role for not giving away delete
etc perms on topics and so on
on the requested topic, you can grant pubsub.subscriber
for granting attachSubscription
via https://cloud.google.com/pubsub/docs/access-control#tbl_perm
Upvotes: 0
Reputation: 168
It turns out there are permissions on the subscription itself also. You need to give permission to that for the service account to be able to attach to it.
With this command: https://cloud.google.com/sdk/gcloud/reference/alpha/pubsub/subscriptions/add-iam-policy-binding
Upvotes: 9