-
Notifications
You must be signed in to change notification settings - Fork 5
63 lines (47 loc) · 1.88 KB
/
gcloud-iam.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
# more details this workflow and other at https://github.com/didier-durand/gcloud-tests
name: List IAM roles
on:
workflow_dispatch:
inputs:
push:
#protection to avoid triggering when other workflow is modified
paths:
- '!.github/workflows/**'
- '.github/workflows/gcloud-iam.yml'
schedule:
- cron: '0 3 * * MON'
env:
GCP_VERBOSITY: warning
GCP_SA: gcp-showcase-sa@${{ secrets.GCP_PROJECT }}.iam.gserviceaccount.com
jobs:
list-roles-with-Google-IAM:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v2.3.4
- name: Setup gcloud CLI
uses: google-github-actions/setup-gcloud@master
with:
project_id: ${{ secrets.GCP_PROJECT }}
service_account_key: ${{ secrets.GCP_SA_KEY }}
- name: Get gcloud version & info
run: |-
echo '--- gcloud version ---'
gcloud version
echo '--- gcloud info ---'
gcloud info --anonymize
- name: List IAM roles
run: |-
gcloud iam roles list --verbosity=$GCP_VERBOSITY --project=${{ secrets.GCP_PROJECT }} --quiet
- name: List IAM service accounts
run: |-
gcloud iam service-accounts list --verbosity=$GCP_VERBOSITY --project=${{ secrets.GCP_PROJECT }} --quiet
- name: Describe IAM service account
run: |-
gcloud iam service-accounts describe $GCP_SA --verbosity=$GCP_VERBOSITY --project=${{ secrets.GCP_PROJECT }} --quiet
- name: Describe IAM policy for service account
run: |-
gcloud iam service-accounts get-iam-policy $GCP_SA --verbosity=$GCP_VERBOSITY --project=${{ secrets.GCP_PROJECT }} --quiet
- name: List IAM keys for service account
run: |-
gcloud iam service-accounts keys list --iam-account=$GCP_SA --verbosity=$GCP_VERBOSITY --project=${{ secrets.GCP_PROJECT }} --quiet