Needs to implement a new option for Limit role granting with conditional role bindings [258846970]

Assigned

Feature Request

Status Update

No update yet.

Description

ha...@google.com

created issue #1

Nov 11, 2022 09:59PM

This will create a feature request which anybody can view and comment on.

Please describe your requested enhancement. Good feature requests will solve common problems or enable new use cases.

What you would like to accomplish:

The Customer wants to restrict a principal (User/Service Account) having "Project IAM Admin" from assigning "Owner" role to other Principals (Users/Service Accounts/Groups). This can be done done by using the following command “api.getAttribute('

iam.googleapis.com/modifiedGrantsByRole', []).hasOnly(['roles/pubsub.editor', 'roles/pubsub.publisher'])” as per this Google documentation [1]. But using this option as listed will be complex because we have to define the desired roles in the “hasonly()” and that a lot of roles are defined.

How this might work:

If possible, implement an option to be used similar to "hasonly()" but we list the roles that need to be revoked from a principal.

Comments

ga...@google.com <ga...@google.com> #2Jan 4, 2023 06:26PM

Assigned to ia...@google.com.

Hello Team, this feature is very important for our strategic customer BT and not having this ability is impacting them at a great level.
Could we have an update on when this feature would be developed please.

da...@britepayments.com <da...@britepayments.com> #3Mar 8, 2023 02:46PM

Any update on this?

We're also limited by the lack of this functionality.

bo...@google.com <bo...@google.com> Apr 26, 2023 09:20AM

Reassigned to bo...@google.com.

bo...@google.com <bo...@google.com> #4Apr 26, 2023 10:47AM

Reassigned to gc...@google.com.

There is no meaningful update yet from the Product Team and please be acknowledged any further updates will be communicated here.

an...@nokia.com <an...@nokia.com> #5Oct 31, 2024 02:02PM

Hi Team,
Do we have any tentative implementation plan for this feature?
This is a much-needed feature for our use case.

on...@google.com <on...@google.com> Jan 29, 2025 05:33AM

Reassigned to on...@google.com.

on...@google.com <on...@google.com> #6Jan 29, 2025 12:31PM

Reassigned to gc...@google.com.

Hello,

According to the Public Issue Tracker Process, we wait for a bug to gain a handful of stars, and hopefully, comments from several users before the engineering team works on the issue. Though we can't provide an ETA on this issue nor guarantee their implementation, rest assured that your feedback is always taken very seriously.

To ensure a faster resolution and dedicated support for your issue, I kindly request you to file a support ticket by clicking here. Our support team will prioritize your request and provide you with the assistance you need.

Please note that the Issue Tracker is primarily meant for reporting bugs and requesting new features. For individual support issues, it is best to utilize the support ticketing system. If you have any additional issues or concerns, please don’t hesitate to create a new thread on the Issue Tracker. We appreciate your cooperation!

Thanks and Regards,
Onkar Mhetre
Google Cloud Support