Skip to content

Commit a5f285c

Browse files
bschaatsbergenbschaatsbergen
committed
feat: manage Marmot access grants
1 parent 0d269db commit a5f285c

42 files changed

Lines changed: 1674 additions & 2 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎docs/data-sources/iam_policy.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "marmot_iam_policy Data Source - marmot"
4+
subcategory: ""
5+
description: |-
6+
Builds a policy document for the authoritative *_iam_policy resources. Purely local: it renders its blocks to JSON and contacts no server.
7+
---
8+
9+
# marmot_iam_policy (Data Source)
10+
11+
Builds a policy document for the authoritative `*_iam_policy` resources. Purely local: it renders its blocks to JSON and contacts no server.
12+
13+
## Example Usage
14+
15+
```terraform
16+
# Renders a policy document for the authoritative *_iam_policy resources. It
17+
# makes no API calls; it exists so a policy can be written as HCL rather than as
18+
# an inline JSON string.
19+
data "marmot_iam_policy" "catalog_readers" {
20+
binding {
21+
role = "catalog-reader"
22+
members = [
23+
"serviceAccount:${marmot_service_account.etl.id}",
24+
"group:${marmot_team.analysts.id}",
25+
]
26+
}
27+
28+
binding {
29+
role = "admin"
30+
members = ["user:${marmot_user.platform_lead.id}"]
31+
}
32+
}
33+
```
34+
35+
<!-- schema generated by tfplugindocs -->
36+
## Schema
37+
38+
### Optional
39+
40+
- `binding` (Block List) One role and the members that hold it. (see [below for nested schema](#nestedblock--binding))
41+
42+
### Read-Only
43+
44+
- `policy_data` (String) The rendered policy, for a resource's `policy_data`.
45+
46+
<a id="nestedblock--binding"></a>
47+
### Nested Schema for `binding`
48+
49+
Required:
50+
51+
- `members` (Set of String) Members holding the role: `user:{id}`, `group:{team id}`, `serviceAccount:{id}`, or `allAuthenticated`.
52+
- `role` (String) Marmot role name, for example `viewer`.

‎docs/resources/asset_iam_binding.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "marmot_asset_iam_binding Resource - marmot"
4+
subcategory: ""
5+
description: |-
6+
Authoritative for one role on an asset. Other roles are left alone, but any member of this role not in the configuration is removed.
7+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
8+
---
9+
10+
# marmot_asset_iam_binding (Resource)
11+
12+
Authoritative for one role on an asset. Other roles are left alone, but any member of this role not in the configuration is removed.
13+
14+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
15+
16+
## Example Usage
17+
18+
```terraform
19+
# Own one role on the asset. Members not listed here are removed from that role,
20+
# while other roles on the same asset are left alone.
21+
resource "marmot_asset_iam_binding" "orders_readers" {
22+
asset_id = marmot_asset.orders.id
23+
role = "catalog-reader"
24+
members = [
25+
"serviceAccount:${marmot_service_account.etl.id}",
26+
"group:${marmot_team.analysts.id}",
27+
]
28+
}
29+
```
30+
31+
<!-- schema generated by tfplugindocs -->
32+
## Schema
33+
34+
### Required
35+
36+
- `asset_id` (String) ID of the resource the grant applies to.
37+
- `members` (Set of String) Members holding the role: `user:{id}`, `group:{team id}`, `serviceAccount:{id}`, or `allAuthenticated`.
38+
- `role` (String) Marmot role name, for example `viewer`. A `roles/` prefix is accepted.
39+
40+
### Read-Only
41+
42+
- `etag` (String) Version of the policy as last read. Used to detect a concurrent change.
43+
- `id` (String) Terraform identifier for this grant.
44+
45+
## Import
46+
47+
Import is supported using the following syntax:
48+
49+
The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
50+
51+
```shell
52+
terraform import marmot_asset_iam_binding.orders_readers \
53+
"asset/1f0c6e9a-1f2b-4a1e-9b1a-2c3d4e5f6a7b/roles/catalog-reader"
54+
```

‎docs/resources/asset_iam_member.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "marmot_asset_iam_member Resource - marmot"
4+
subcategory: ""
5+
description: |-
6+
Non-authoritative. Grants one member one role on an asset, leaving every other member and role untouched.
7+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
8+
---
9+
10+
# marmot_asset_iam_member (Resource)
11+
12+
Non-authoritative. Grants one member one role on an asset, leaving every other member and role untouched.
13+
14+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
15+
16+
## Example Usage
17+
18+
```terraform
19+
# Grant one service account read access to one asset, without touching any
20+
# other grant on it. Use this when several configurations manage access to the
21+
# same asset.
22+
resource "marmot_asset_iam_member" "etl_reads_orders" {
23+
asset_id = marmot_asset.orders.id
24+
role = "catalog-reader"
25+
member = "serviceAccount:${marmot_service_account.etl.id}"
26+
}
27+
```
28+
29+
<!-- schema generated by tfplugindocs -->
30+
## Schema
31+
32+
### Required
33+
34+
- `asset_id` (String) ID of the resource the grant applies to.
35+
- `member` (String) Member to grant the role to: `user:{id}`, `group:{team id}`, `serviceAccount:{id}`, or `allAuthenticated`.
36+
- `role` (String) Marmot role name, for example `viewer`. A `roles/` prefix is accepted.
37+
38+
### Read-Only
39+
40+
- `etag` (String) Version of the policy as last read. Used to detect a concurrent change.
41+
- `id` (String) Terraform identifier for this grant.
42+
43+
## Import
44+
45+
Import is supported using the following syntax:
46+
47+
The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
48+
49+
```shell
50+
terraform import marmot_asset_iam_member.etl_reads_orders \
51+
"asset/1f0c6e9a-1f2b-4a1e-9b1a-2c3d4e5f6a7b/roles/catalog-reader/serviceAccount:8c2f0d11-3a4b-4c5d-8e9f-0a1b2c3d4e5f"
52+
```

‎docs/resources/asset_iam_policy.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "marmot_asset_iam_policy Resource - marmot"
4+
subcategory: ""
5+
description: |-
6+
Authoritative. Sets the complete access policy on an asset, removing any binding not present in the configuration. Do not use alongside _iam_binding or _iam_member for the same resource: they will fight.
7+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
8+
---
9+
10+
# marmot_asset_iam_policy (Resource)
11+
12+
Authoritative. Sets the complete access policy on an asset, removing any binding not present in the configuration. Do not use alongside `_iam_binding` or `_iam_member` for the same resource: they will fight.
13+
14+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
15+
16+
## Example Usage
17+
18+
```terraform
19+
# Own the asset's entire policy. Any binding not described here is removed, so
20+
# do not combine this with marmot_asset_iam_binding or marmot_asset_iam_member
21+
# on the same asset — they will overwrite each other on every apply.
22+
data "marmot_iam_policy" "orders" {
23+
binding {
24+
role = "catalog-reader"
25+
members = ["serviceAccount:${marmot_service_account.etl.id}"]
26+
}
27+
}
28+
29+
resource "marmot_asset_iam_policy" "orders" {
30+
asset_id = marmot_asset.orders.id
31+
policy_data = data.marmot_iam_policy.orders.policy_data
32+
}
33+
```
34+
35+
<!-- schema generated by tfplugindocs -->
36+
## Schema
37+
38+
### Required
39+
40+
- `asset_id` (String) ID of the resource the grant applies to.
41+
- `policy_data` (String) Policy JSON, normally taken from the `marmot_iam_policy` data source.
42+
43+
### Read-Only
44+
45+
- `etag` (String) Version of the policy as last read. Used to detect a concurrent change.
46+
- `id` (String) Terraform identifier for this grant.
47+
48+
## Import
49+
50+
Import is supported using the following syntax:
51+
52+
The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
53+
54+
```shell
55+
terraform import marmot_asset_iam_policy.orders \
56+
"asset/1f0c6e9a-1f2b-4a1e-9b1a-2c3d4e5f6a7b"
57+
```

‎docs/resources/data_product_iam_binding.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "marmot_data_product_iam_binding Resource - marmot"
4+
subcategory: ""
5+
description: |-
6+
Authoritative for one role on a data product and every asset it resolves. Other roles are left alone, but any member of this role not in the configuration is removed.
7+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
8+
---
9+
10+
# marmot_data_product_iam_binding (Resource)
11+
12+
Authoritative for one role on a data product and every asset it resolves. Other roles are left alone, but any member of this role not in the configuration is removed.
13+
14+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
15+
16+
## Example Usage
17+
18+
```terraform
19+
resource "marmot_data_product_iam_binding" "finance_readers" {
20+
data_product_id = marmot_data_product.finance.id
21+
role = "catalog-reader"
22+
members = ["group:${marmot_team.finance_analysts.id}"]
23+
}
24+
```
25+
26+
<!-- schema generated by tfplugindocs -->
27+
## Schema
28+
29+
### Required
30+
31+
- `data_product_id` (String) ID of the resource the grant applies to.
32+
- `members` (Set of String) Members holding the role: `user:{id}`, `group:{team id}`, `serviceAccount:{id}`, or `allAuthenticated`.
33+
- `role` (String) Marmot role name, for example `viewer`. A `roles/` prefix is accepted.
34+
35+
### Read-Only
36+
37+
- `etag` (String) Version of the policy as last read. Used to detect a concurrent change.
38+
- `id` (String) Terraform identifier for this grant.
39+
40+
## Import
41+
42+
Import is supported using the following syntax:
43+
44+
The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
45+
46+
```shell
47+
terraform import marmot_data_product_iam_binding.finance_readers \
48+
"data_product/3b7e2f10-9c8d-4e5f-a1b2-c3d4e5f60718/roles/catalog-reader"
49+
```

‎docs/resources/data_product_iam_member.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "marmot_data_product_iam_member Resource - marmot"
4+
subcategory: ""
5+
description: |-
6+
Non-authoritative. Grants one member one role on a data product and every asset it resolves, leaving every other member and role untouched.
7+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
8+
---
9+
10+
# marmot_data_product_iam_member (Resource)
11+
12+
Non-authoritative. Grants one member one role on a data product and every asset it resolves, leaving every other member and role untouched.
13+
14+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
15+
16+
## Example Usage
17+
18+
```terraform
19+
# A grant on a data product reaches every asset the product resolves, through
20+
# its rules and its manual members alike. This is how you grant access to a
21+
# whole domain without listing its assets — and how that access keeps up as the
22+
# domain grows.
23+
resource "marmot_data_product_iam_member" "finance_reader" {
24+
data_product_id = marmot_data_product.finance.id
25+
role = "catalog-reader"
26+
member = "group:${marmot_team.finance_analysts.id}"
27+
}
28+
```
29+
30+
<!-- schema generated by tfplugindocs -->
31+
## Schema
32+
33+
### Required
34+
35+
- `data_product_id` (String) ID of the resource the grant applies to.
36+
- `member` (String) Member to grant the role to: `user:{id}`, `group:{team id}`, `serviceAccount:{id}`, or `allAuthenticated`.
37+
- `role` (String) Marmot role name, for example `viewer`. A `roles/` prefix is accepted.
38+
39+
### Read-Only
40+
41+
- `etag` (String) Version of the policy as last read. Used to detect a concurrent change.
42+
- `id` (String) Terraform identifier for this grant.
43+
44+
## Import
45+
46+
Import is supported using the following syntax:
47+
48+
The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
49+
50+
```shell
51+
terraform import marmot_data_product_iam_member.finance_reader \
52+
"data_product/3b7e2f10-9c8d-4e5f-a1b2-c3d4e5f60718/roles/catalog-reader/group:5f6a7b8c-9d0e-4f10-a2b3-c4d5e6f70819"
53+
```

‎docs/resources/data_product_iam_policy.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "marmot_data_product_iam_policy Resource - marmot"
4+
subcategory: ""
5+
description: |-
6+
Authoritative. Sets the complete access policy on a data product and every asset it resolves, removing any binding not present in the configuration. Do not use alongside _iam_binding or _iam_member for the same resource: they will fight.
7+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
8+
---
9+
10+
# marmot_data_product_iam_policy (Resource)
11+
12+
Authoritative. Sets the complete access policy on a data product and every asset it resolves, removing any binding not present in the configuration. Do not use alongside `_iam_binding` or `_iam_member` for the same resource: they will fight.
13+
14+
Grants are additive and there are no denies, so a member also holding the permission over the whole catalog keeps it here. Restricting a principal means giving it a role that does not carry the permission at the organization level, then granting it on specific resources.
15+
16+
## Example Usage
17+
18+
```terraform
19+
data "marmot_iam_policy" "finance" {
20+
binding {
21+
role = "catalog-reader"
22+
members = ["group:${marmot_team.finance_analysts.id}"]
23+
}
24+
}
25+
26+
resource "marmot_data_product_iam_policy" "finance" {
27+
data_product_id = marmot_data_product.finance.id
28+
policy_data = data.marmot_iam_policy.finance.policy_data
29+
}
30+
```
31+
32+
<!-- schema generated by tfplugindocs -->
33+
## Schema
34+
35+
### Required
36+
37+
- `data_product_id` (String) ID of the resource the grant applies to.
38+
- `policy_data` (String) Policy JSON, normally taken from the `marmot_iam_policy` data source.
39+
40+
### Read-Only
41+
42+
- `etag` (String) Version of the policy as last read. Used to detect a concurrent change.
43+
- `id` (String) Terraform identifier for this grant.
44+
45+
## Import
46+
47+
Import is supported using the following syntax:
48+
49+
The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
50+
51+
```shell
52+
terraform import marmot_data_product_iam_policy.finance \
53+
"data_product/3b7e2f10-9c8d-4e5f-a1b2-c3d4e5f60718"
54+
```

0 commit comments

Comments
 (0)