Skip to content

Instantly share code, notes, and snippets.

@ljulliar

ljulliar/cloud_build_roles.sh

Last active March 27, 2020 11:10
Show Gist options
  • Save ljulliar/a9fb8f95f487e023d0de9c62d796de6a to your computer and use it in GitHub Desktop.
Save ljulliar/a9fb8f95f487e023d0de9c62d796de6a to your computer and use it in GitHub Desktop.
Download ZIP
Cloud Build decrypt roles (Photo Album on Google Cloud Run)
Raw
cloud_build_roles.sh
# set an env variable to make things more readable
CB_SVC_ACCOUNT=xxx...xxx@cloudbuild.gserviceaccount.com
# Grant Cloud Build the right to decrypt Rails master key
$ gcloud kms keys add-iam-policy-binding rails_master_key --location=us-central1 \
--keyring=photo-album --member=serviceAccount:$CB_SVC_ACCOUNT \
--role=roles/cloudkms.cryptoKeyDecrypter
# Grant Cloud Build the right to decrypt Rails the production database password
$ gcloud kms keys add-iam-policy-binding db_pwd_key --location=us-central1 \
--keyring=photo-album --member=serviceAccount:$CB_SVC_ACCOUNT \
--role=roles/cloudkms.cryptoKeyDecrypter
# Grant Cloud Build the right to decrypt the cloud runner service account credentials
$ gcloud kms keys add-iam-policy-binding photo_album_runner_key --location=us-central1 \
--keyring=photo-album --member=serviceAccount:$CB_SVC_ACCOUNT \
--role=roles/cloudkms.cryptoKeyDecrypter
@vishalvijay
Copy link

Hi

$ can be removed from L5 L10 L15

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment