Limited Permissions Service Account

Open Beginner friendly
#323 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
1-3 hours
Newbie friendliness
74/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Quiet
Tech stack
google-cloud
Domain
documentation

Research direction

Start in the README and review the linked Google Workspace service-account documentation and selective-access references. Explain how to create a custom admin role with only user API and directory API read access, assign it to the service account, and clarify that domain-wide delegation and impersonation are not required. Done means the README points to the relevant setup guidance and describes the limited-permission configuration.

Written by the indexing model from the issue text.

Description

enhancement

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
Drawing on @bburky 's feedback to the above PR.

Because the Google docs aren't too clear on this, it's probably worth adding a note to the README to point specifically to the "Assign a role to a service account" docs section and explain how to set up the service account:
https://developers.google.com/workspace/guides/create-credentials#assign_a_role_to_a_service_account

I would suggest to create a custom admin role limited to only user API read and directory API read. Grant the admin role to the service account with "Assign a role to a service account". The service account's maximum permissions are those of the Admin role (the service account will not be restricted to specific OAuth roles like with domain-wide delegation).
The "Optional: Set up domain-wide delegation for a service account" steps can be skipped entirely. This method does not use domain-wide delegation at all or impersonation.

Additionally refer to:

Dominant language
Go
Stars
666
Forks
213
Avg merge
2d 1h
Merged PRs (30d)
3

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from awslabs/ssosync

All issues in awslabs/ssosync

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.