pubsub_subscriber_role applied to subscription (vs topic) about terraform-google-log-export HOT 9 CLOSED

Upon further review, I think it actually should be corrected to this:

resource "google_pubsub_topic_iam_member" "pubsub_viewer_role" {
  count         = var.create_subscriber ? 1 : 0
  role          = "roles/pubsub.viewer"
  project       = var.project_id
  subscription  = local.pubsub_subscription
  member        = "serviceAccount:${google_service_account.pubsub_subscriber[0].email}"
}

My apologies for overlooking the local subscription reference.

from terraform-google-log-export.

In my testing before, permissions have been inherited so I'm unsure why that changed. Are you using a push or pull subscription?

from terraform-google-log-export.

I'm using a Pull subscription.

Even when I do it manually in the UI, I do not see that users given the subscriber role to a topic have any permissions on the associated subscription.

from terraform-google-log-export.

Here's the output from projects.topics.getIamPolicy:

{
"version": 1,
"etag": "BwXBLs1ROoM=",
"bindings": [
{
"role": "roles/pubsub.subscriber",
"members": [
"user:[email protected]"
]
}
]
}

And the output from the API call of associated subscription (projects.subscriptions.getIamPolicy):

{
"etag": "ACAB"
}

from terraform-google-log-export.

Right, they wouldn't show up on the subscription necessarily.

I'm curious about the actual behavior—are you not able to pull from the subscription?

from terraform-google-log-export.

We're pulling it via the Splunk Add-on for GCP - I've published multiple test messages and Splunk is NOT able to pull them when a service account has Subscriber on the Topic

The moment that I give the service account the Subscriber role on the Subscription, Splunk can then pull them (immediately).

from terraform-google-log-export.

Odd, do you mind opening a pull request to fix it?

from terraform-google-log-export.

I actually have the code fixed locally, but don't know how to do the testing

from terraform-google-log-export.

@huron25 If you open a pull request, our CI will run the tests.

You can also learn more in our codelab: https://codelabs.developers.google.com/codelabs/cft-onboarding/#0

from terraform-google-log-export.