feat: add policyanalyzer.activityAnalysisViewer

This role permits gcp-cfg-collector to gather additional service account key context (specifically recent usage) PSP-2485
lacework · Jul 17, 2024 · a828b26 · a828b26
1 parent 2e52c0a
commit a828b26
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -21,6 +21,7 @@ e.g. `terraform state rm 'google_project_iam_binding.for_lacework_service_accoun
 roles/browser
 roles/iam.securityReviewer
 roles/cloudasset.viewer
+roles/policyanalyzer.activityAnalysisViewer
 ```
 
 The following custom role is required depending on the integration level.

diff --git a/main.tf b/main.tf
@@ -23,13 +23,15 @@ locals {
   default_project_roles = local.skip_iam_grants ? [] : [
     "roles/browser",
     "roles/iam.securityReviewer",
-    "roles/cloudasset.viewer"
+    "roles/cloudasset.viewer",
+    "roles/policyanalyzer.activityAnalysisViewer"
   ]
 
   default_organization_roles = local.skip_iam_grants ? [] : [
     "roles/browser",
     "roles/iam.securityReviewer",
-    "roles/cloudasset.viewer"
+    "roles/cloudasset.viewer",
+    "roles/policyanalyzer.activityAnalysisViewer"
   ]
 
   // if org_integration is false, project_roles = local.default_project_roles
@@ -54,6 +56,7 @@ locals {
         "roles/browser",
         "roles/iam.securityReviewer",
         "roles/cloudasset.viewer",
+        "roles/policyanalyzer.activityAnalysisViewer",
         google_organization_iam_custom_role.lacework_custom_organization_role.0.name
       ]
       ) : (