FAST Tenant, resman and project factory tag issue.

[occitarn]

Hi everyone,

I'm working from tag 34.1.0, i have set up my bootstrap then the resman at org level with a top level folder used to store tenants envs which i generate by using tenant factory stage.

Then i log in as a tenant, and i run the resman inside my tenant space to generate a top level folder called Project in which i want to run the project factory.

However when i reach the PF stage i've an error claiming that the tenant SA can not bind tags to each project folder because of role issue.

Error: Error creating TagBinding: googleapi: Error 403: The caller does not have permission
with module.projects.module.hierarchy-folder-lvl-2["team-b/dev"].google_tags_tag_binding.binding["environment"],
on ../../../modules/folder/tags.tf line 17, in resource "google_tags_tag_binding" "binding":
17: resource "google_tags_tag_binding" "binding" {

I had to update manually the role of prefix-tenant-resman-pf-0 to add tags user role but i guess that is not expected behavior.
Did i miss something ?

Thanks a lot !

[ludoo]

Tenants use their own set of tags rooted in their IaC project, instead of the org-level tag set. It may be that the project factory is missing the Tag User role. Are you using the tenant pf, or the org-level pf?

PS - multitenant support is rarely used, so it's possible some things are broken there from time to time...

[occitarn]

First thank you for your answer.
I use the tenant pf, i run the stage 2-project-factory as a tenant. Is there a specific variable to enable to get Tag user role on pf SA?
I tried to change my tenant resman stage to enable automation on project folder however, the issue remains.
Thanks,

[ludoo]

You need the tag user role for the tenant pf service account on both the tag value and the resource where you set the tag binging (folder or project). On the folder/project it's easy, do it on the top-level folder and you're good for anything in its hierarchy. For the tag value there are several ways of doing this:

• assign the role on the tag values via the var.tags in the tenant resource management stage tfvars, we then combine internally whatever comes in via tfvars
• assign the role on the tenant IaC project itself (never tried it but it should work as tags are defined there)

The first approach will be something like this in your tenant resman tfvars

tags = {
  environment = {
    values = {
      development = {
        iam = {} # role assignments here in usual role => [principals] format
      }
    }
  }
}

[occitarn]

Hello, finally i modified the code in file branch-project-factory.tf from the resman stage in order to add role TagUser to SA resman-pf-0. I don't know if it's the right way "philosophically" to do it, but it works for my tests.

module "branch-pf-sa" {
  source       = "../../../modules/iam-service-account"
  project_id   = var.automation.project_id
  name         = "resman-pf-0"
  display_name = "Terraform project factory main service account."
  prefix       = var.prefix
  iam = {
    "roles/iam.serviceAccountTokenCreator" = compact([
      try(module.branch-pf-sa-cicd[0].iam_email, null)
    ])
  }
  iam_project_roles = {
    (var.automation.project_id) = ["roles/serviceusage.serviceUsageConsumer","roles/resourcemanager.tagUser"]
  }
  iam_storage_roles = {
    (var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
  }
}

[ludoo]

it certainly works, I don't think we're exposing the IaC project IAM bindings via variables. Maybe we should...