simonw/datasette

feature request: document minimum permissions for service account for cloudrun

Open

#1,415 opened on Aug 3, 2021

View on GitHub
 (4 comments) (1 reaction) (0 assignees)Python (8,637 stars) (625 forks)batch import
datasette-publishdocumentationhelp wanted

Description

Thanks again for such a powerful project.

For deploying to cloudrun from github actions, I'd like to create a service account with minimal permissions.

It would be great to document what those minimum permission that need to be set in the IAM.

Contributor guide

Tech stack
pythongithub actionsgcp
Domain
documentationdevops
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
GCP basicsCloud RunGitHub Actions
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70
Research direction
Investigate the current deployment documentation in the repository (e.g., docs/deploying.md). Review Google Cloud IAM roles for Cloud Run and GitHub Actions OIDC. Compile a list of minimal permissions based on official Google Cloud guides. Optionally test the permissions to verify.