Sometimes we want to connect accounts in read-only mode and provision additional access over it. Such example is automation workflow to start/stop virtual machines. For this case we can utilize GCP custom roles.

Create a custom role

Save following content in role.yaml file:

title: "VM Start Stop"
description: "Start and stop Compute Engine instances"
stage: "GA"
includedPermissions:
  - compute.instances.start
  - compute.instances.stop

If connection planned to have organization scope, replace ORG_ID with your GCP organization ID and run following command:

gcloud iam roles create vmStartStop --organization=ORG_ID --file=role.yaml

If connection planned to have project scope, replace PROJECT_ID with your GCP project ID and run following command:

gcloud iam roles create vmStartStop --project=PROJECT_ID --file=role.yaml

Connect the GCP

Follow the GCP Setup guide and connect the organization or project to Cloudchipr. In this step we have 2 options:

1. Connect in Read/Write mode, but instead of Editor role assign Viewer to provided service account
2. Connect in Read Only mode and later manually switch projects to Read/Write where custom role permissions will be used. Once account connect is done, select the project from Live Resources section in Cloudchipr and click on Switch to Read/Write. It will prompt to assign another role to service account, ignore it and click Done.

During the connection setup copy the Cloudchipr provided service account email to use in further steps.

Attach newly created role to service account

Project scope

gcloud organizations add-iam-policy-binding ORG_ID \
  --member="serviceAccount:C8R_SERVICE_PRINCIPAL" \
  --role="projects/PROJECT_ID/roles/vmStartStop"

Organization scope

gcloud organizations add-iam-policy-binding ORG_ID \
  --member="serviceAccount:C8R_SERVICE_PRINCIPAL" \
  --role="organizations/ORG_ID/roles/vmStartStop"