feat: add iam.automaticIamGrantsForDefaultServiceAccounts org policy …

…constraint (#386)
terraform-google-modules · Mar 31, 2021 · f6b0387 · f6b0387
1 parent 39b8da3
commit f6b0387
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/1-org/envs/shared/org_policy.tf b/1-org/envs/shared/org_policy.tf
@@ -142,6 +142,17 @@ module "org_disable_sa_key_creation" {
   constraint      = "constraints/iam.disableServiceAccountKeyCreation"
 }
 
+module "org_disable_automatic_iam_grants_on_default_service_accounts" {
+  source          = "terraform-google-modules/org-policy/google"
+  version         = "~> 3.0"
+  organization_id = local.organization_id
+  folder_id       = local.folder_id
+  policy_for      = local.policy_for
+  policy_type     = "boolean"
+  enforce         = "true"
+  constraint      = "constraints/iam.automaticIamGrantsForDefaultServiceAccounts"
+}
+
 /******************************************
   Storage
 *******************************************/

diff --git a/test/integration/org/controls/gcloud_policy.rb b/test/integration/org/controls/gcloud_policy.rb
@@ -25,7 +25,8 @@
   'constraints/compute.restrictXpnProjectLienRemoval',
   'constraints/sql.restrictPublicIp',
   'constraints/iam.disableServiceAccountKeyCreation',
-  'constraints/storage.uniformBucketLevelAccess'
+  'constraints/storage.uniformBucketLevelAccess',
+  'constraints/iam.automaticIamGrantsForDefaultServiceAccounts'
 ]
 
 control 'gcloud_policy' do