IssueTracker

You know you can configure the log bucket it uses and work around this right? The main gap I have is that the terraform provider doesn't allow you to configure this param on the triggers, but according to the API it is possible. Cloud Build doesn't seem like it's getting enough attention so I switched to a better service. Just FYI in case you are struggling.

+1

+1

Same here. Would be very common for us to have devs only be able to view Cloud Build builds and their logs, nothing else. The "workaround" we have to use now is that every time any of them need to view the build log they have to ping a dev that has the Project Viewer role (now called Basic Viewer I believe).

We really try hard to give a minimal set of permissions to each individual.

There's a workaround now I think. Create a separate logs bucket and peel the cloud build logs from whatever pipelines you want the devs to see. Then grant the devs group Logs Viewer but have an IAM condition that ensures they only get the grant for the bucket you made for them. Obviously not the best user experience but it's better than the alternatives.

We've found a workaround, which is to create a new custom role, and add

cloudbuild.builds.get
cloudbuild.builds.list
cloudconfig.configs.get
remotebuildexecution.blobs.get
resourcemanager.projects.get

The difference between the standard role Cloud Build Viewer and the custom role would be that the custom role would include the permission resourcemanager.projects.list that Cloud Build Viewer does not contain and Cloud Build viewer has the extra permission cloudconfig.configs.get.

What's the official recommendation for how to deal with this?

It would be just fine if the Logs Viewer role was enough to make the log-related functions of the Cloud Build UI work as expected.

As an end user, I don't actually care about the Logs Viewer role somehow granting access to the cloud storage bucket because don't care whether the logs go into cloud storage or something else. It would be fine if they go into only Google Cloud Logging, or into something else entirely, as long as I'm able to access them via some reasonable way. (Granting a project-level Cloud Storage role is not reasonable.)

What I actually need/want is that as someone with Logs Viewer but without any Cloud Storage roles, all of the following work:

• See streaming logs in the CLI from a gcloud builds submit...
• See streaming logs in the Cloud Build UI
• See task-specific logs in the Cloud Build UI
• Download the logs for a build from the Cloud Build UI

Hi,

We received update from team,

It is allowed to store Build Logs in Cloud Logging where it would be visible to users with Logs Viewer permissions according to document. For storing logs and viewing with roles there is a workaround available as mentioned in the documentation1. Which recommends users storing Build Logs in a Cloud Storage bucket in their own project which would grant access without giving Project Viewer role to users.

Any further updates on this will be communicated here.

Thank you for your trust and continued support to improve Google Cloud Platform.