Cloud Build decrypt roles (Photo Album on Google Cloud Run)

cloud_build_roles.sh

# set an env variable to make things more readable
CB_SVC_ACCOUNT=xxx...xxx@cloudbuild.gserviceaccount.com

# Grant Cloud Build the right to decrypt Rails master key
$ gcloud kms keys add-iam-policy-binding rails_master_key --location=us-central1 \
  --keyring=photo-album --member=serviceAccount:$CB_SVC_ACCOUNT \
  --role=roles/cloudkms.cryptoKeyDecrypter

# Grant Cloud Build the right to decrypt Rails the production database password
$ gcloud kms keys add-iam-policy-binding db_pwd_key --location=us-central1 \
  --keyring=photo-album --member=serviceAccount:$CB_SVC_ACCOUNT \
  --role=roles/cloudkms.cryptoKeyDecrypter

# Grant Cloud Build the right to decrypt the cloud runner service account credentials
$ gcloud kms keys add-iam-policy-binding photo_album_runner_key --location=us-central1 \
  --keyring=photo-album --member=serviceAccount:$CB_SVC_ACCOUNT \
  --role=roles/cloudkms.cryptoKeyDecrypter