mirror of
https://github.com/digital-asset/daml.git
synced 2024-09-20 09:17:43 +03:00
b9acc09a77
We've been saving data there but not doing anything with it. Ideally this data would be used by some sort of automated process, but in the meantime (or while developing said processes), having at least some people with read access can help. This is a Standard Change requested by @cocreature. CHANGELOG_BEGIN CHANGELOG_END
53 lines
1.7 KiB
HCL
53 lines
1.7 KiB
HCL
# Copyright (c) 2020 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
resource "google_storage_bucket" "data" {
|
|
project = "${local.project}"
|
|
name = "daml-data"
|
|
labels = "${local.labels}"
|
|
|
|
# SLA is enough for a cache and is cheaper than MULTI_REGIONAL
|
|
# see https://cloud.google.com/storage/docs/storage-classes
|
|
storage_class = "REGIONAL"
|
|
|
|
# Use a normal region since the storage_class is regional
|
|
location = "${local.region}"
|
|
}
|
|
|
|
resource "google_storage_bucket_acl" "data" {
|
|
bucket = "${google_storage_bucket.data.name}"
|
|
|
|
role_entity = [
|
|
"OWNER:project-owners-${data.google_project.current.number}",
|
|
"OWNER:project-editors-${data.google_project.current.number}",
|
|
"READER:project-viewers-${data.google_project.current.number}",
|
|
]
|
|
}
|
|
|
|
// allow rw access for CI writer (see writer.tf)
|
|
resource "google_storage_bucket_iam_member" "data" {
|
|
bucket = "${google_storage_bucket.data.name}"
|
|
|
|
# https://cloud.google.com/storage/docs/access-control/iam-roles
|
|
role = "roles/storage.objectAdmin"
|
|
member = "serviceAccount:${google_service_account.writer.email}"
|
|
}
|
|
|
|
// allow read access for appr team, as requested by Moritz
|
|
variable "appr" {
|
|
description = "Application Runtime team members"
|
|
default = [
|
|
"user:andreas.herrmann@digitalasset.com",
|
|
"user:gary.verhaegen@digitalasset.com",
|
|
"user:leonid.shlyapnikov@digitalasset.com",
|
|
"user:moritz.kiefer@digitalasset.com",
|
|
"user:stephen.compall@digitalasset.com",
|
|
]
|
|
}
|
|
resource "google_storage_bucket_iam_member" "appr" {
|
|
count = "${length(var.appr)}"
|
|
bucket = "${google_storage_bucket.data.name}"
|
|
role = "roles/storage.objectViewer"
|
|
member = "${var.appr[count.index]}"
|
|
}
|