fix: grant ci permissions

abcxyz · Apr 1, 2023 · 2eb73f0 · 2eb73f0
1 parent 9ebd1c1
commit 2eb73f0
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/terraform/ci/variables.tf b/terraform/ci/variables.tf
@@ -30,11 +30,17 @@ variable "ci_iam_roles" {
   default = [
     # To deploy and invoke cloud run services.
     "roles/iam.serviceAccountUser",
-    "roles/run.developer",
+    "roles/run.admin",
 
     # To operate KMS.
     "roles/cloudkms.admin",
     "roles/cloudkms.cryptoOperator",
+
+    # To read and edit project service during CI.
+    "roles/serviceusage.serviceUsageAdmin",
+
+    # To set project IAM policies.
+    "roles/resourcemanager.projectIamAdmin",
   ]
   description = "List of IAM roles needed to run integration tests included in CI/CD."
 }