FAST Stage 3 Implementation Issues: SA Impersonation & Missing Permissions Across Networking and SecOps

[Rajat-EVS]

While implementing FAST Stage 3 (3-data-platform, 3-gke, and 3-secops), I encountered several permission-related blockers that may require updates to either documentation or module logic. Here's a breakdown:
Impersonate SA Permissions

• In both 3-data-platform and 3-gke, the impersonate service account doesn’t have the 2 permissions (resourcemanager.projects.getIamPolicy, resourcemanager.projects.setIamPolicy) to the net-spoke project (which came from 2-networking-c-separate-envs). That’s blocking resource creation and access.
• For 3-gke, the SA also needs some Org-level permissions to work with Shared VPCs:
  compute.globalOperations.get
  compute.organizations.enableXpnResource
  compute.subnetworks.getIamPolicy
• 3-secops expects the API Keys API to be enabled in prod-iac-core-0. This isn’t called out anywhere, so it does not execute the stage successfully.

Let me know if others have faced similar issues or if there's a recommended workaround.

[ludoo]

Did you uncomment the relevant parts of the network stage YAML configuration in 1-resman/data? That is required for the IAM grants for stage 3

https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/blob/master/fast/stages/1-resman/data/stage-2/networking.yaml

[Rajat-EVS]

Yes, I uncommented the relevant parts of network stage and security stage too in all YAML configuration in 1-resman/data as mentioned in the FAST prerequisites in stage 3

[ludoo]

Let's tackle one item at a time.

For 3-gke, the SA also needs some Org-level permissions to work with Shared VPCs:
compute.globalOperations.get
compute.organizations.enableXpnResource
compute.subnetworks.getIamPolicy

No, the SA needs them at the net folder level not the org level. Those are in the service project net admin custom role

Since you're using separate envs, you might be missing a tag binding on the net folder.

[Rajat-EVS]

As per the netwroking.yaml file in 1-resman/data/stage-2, this custom role is only provided to data platform SA not to gke SA.


So, is binding of role should be done there or somewhere else?

[ludoo]

Yes, good catch. You also need the ones at the bottom of the file.

[Rajat-EVS]

I have done that too. But this configuration is for gcve and data-platform only not for gke only.

[ludoo]

just copy/paste and change the stage name?

[Rajat-EVS]

Hey, added the required roles by adding configurations in iam_bindings_additive in 1-resman/data/stage-2/networking.yaml file.


But I am not able to understand what this configuration is for?

Should I add the configuration for gke like this?