Be able to know the Domain ID of the Google-managed service accounts [288018110]

Assigned

Feature Request

Status Update

No update yet.

Description

po...@google.com

created issue #1

Jun 20, 2023 01:32AM

What you would like to accomplish:

The organization policy Restricting identities by domain restricts to only the allowed Domains.

When it is necessary to create an exception were a Google Managed Service Account is involved, for example chat-api-push@system.gserviceaccount.com in the Following guide.

I'm not able to get the domain ID to be able to add it to the Organization Policy.

The only workaround is to force the account access according to the documentation.

How this might work:

I would like to be able to get the domain ID of this kind of Google Managed Service Accounts, to grant roles to these service accounts in at my organization without have to use the workaround

Comments

ba...@google.com <ba...@google.com> Jun 20, 2023 03:26AM

Reassigned to ba...@google.com.

ba...@google.com <ba...@google.com> #2Jun 20, 2023 05:49AM

Reassigned to gc...@google.com.

Hello,

Thanks for reaching out to us!

The Product Engineering Team has been made aware of your feature request, and will address it in due course. Though we can't provide an ETA on feature requests nor guarantee their implementation, rest assured that your feedback is always taken very seriously, as it allows us to improve our products. Thank you for your trust and continued support to improve Google Cloud Platform products.

In case you want to report a new issue, please do not hesitate to create a new Issue Tracker thread describing your issue. Once again, thank you for the suggestions.

Thanks & Regards,
Manish Bavireddy.
Google Cloud Support

ga...@glean.com <ga...@glean.com> #3Sep 5, 2023 07:03AM

+1 on this feature request. Alternatively, if there is no way to provide a domain ID for google-managed service accounts, Google should provide a different org constraint for granting those service accounts permissions.

It is very hard for a SaaS provider to coordinate relaxing the org constraint temporarily across a lot of orgs/projects.

ra...@zoominfo.com <ra...@zoominfo.com> #4Oct 26, 2023 03:41PM

Or if GCP will allow us to add the domain in the Org policy allowed list that would be great too.

For example, we can add the domain '*.

gserviceaccount.com', hence all SA including custom and Google managed will be allowed

dh...@google.com <dh...@google.com> Oct 31, 2023 06:39AM

Reassigned to gc...@google.com.

Issue 288018110