GCP.IAM reference

Policy

Source: src/GCP/IAM/Policy.ts

An IAM v2 deny policy attached to a project, folder, or organization.

This is not GCP.OrgPolicy.Policy (organization policy constraints). Deny policies use annotations for Alchemy ownership. Create, update, and delete are long-running operations.

Policy: Creating a Deny Policy

const policy = yield* GCP.IAM.Policy("Probe", {
  displayName: "alchemy-probe",
  rules: [{
    denyRule: {
      deniedPermissions: ["iam.googleapis.com/roles.list"],
      deniedPrincipals: [
        "principal://goog/subject/alchemy-deny-probe@example.invalid",
      ],
    },
  }],
});

ServiceAccount

Source: src/GCP/IAM/ServiceAccount.ts

A user-managed Google Cloud IAM service account.

Grant it roles with GCP.IAM.Member (kind: "project" for project-wide roles), and pass its email to resources that run as an identity, such as GKE node pools or Compute instances.

ServiceAccount: Creating a Service Account

Service account with a generated id

const account = yield* GCP.IAM.ServiceAccount("Worker", {
  displayName: "Background worker",
});

Service account with an explicit id

const account = yield* GCP.IAM.ServiceAccount("GkeNodes", {
  accountId: "prod-gke-nodes",
  displayName: "Production GKE nodes",
});

ServiceAccount: Granting Roles

const account = yield* GCP.IAM.ServiceAccount("Worker", {});
yield* GCP.IAM.Member("WorkerLogs", {
  kind: "project",
  name: account.project,
  role: "roles/logging.logWriter",
  member: Output.interpolate`serviceAccount:${account.email}`,
});