Before I go ahead and do a bunch of work I wanted feedback on a proposed implementation
Since IAM is a meta-api, we can be sure that all One Platform resource types will implement a common interface for IAM, there is smoothing that can be done client side for this common interface. Namely, properly executing the flow of getIAMPolicy -> edit policy -> setIAMPolicy with etag is non-trivial, and common between all resources.
To implement the IAM Mixin a resource would simply provide _get_iam_policy and _set_iam_policy methods, that the mixin would use to implement _edit_iam_policy an idempotent policy update, which would then serve as the basis for add_role(self, member, role) and remove_role(self, member or regex, role), the external surface provided by the mixin.
I am using something like this in an internal project and it would hopefully be fast to implement. But wanted to gather as much feedback as possible on this.
Other things that I haven't implemented but could potentially be provided are query_grantable_rolls and test_iam_permissions. Not sure what the use of these would be but they are included in the IAM API. One possibility would be a @requires_rolls decorator for resource functions that would call test_iam_permissions before making API calls to prevent 403s but I'm not sure how useful that would be.
Before I go ahead and do a bunch of work I wanted feedback on a proposed implementation
Since IAM is a meta-api, we can be sure that all One Platform resource types will implement a common interface for IAM, there is smoothing that can be done client side for this common interface. Namely, properly executing the flow of
getIAMPolicy-> edit policy ->setIAMPolicywith etag is non-trivial, and common between all resources.To implement the IAM Mixin a resource would simply provide
_get_iam_policyand_set_iam_policymethods, that the mixin would use to implement_edit_iam_policyan idempotent policy update, which would then serve as the basis foradd_role(self, member, role)andremove_role(self, member or regex, role), the external surface provided by the mixin.I am using something like this in an internal project and it would hopefully be fast to implement. But wanted to gather as much feedback as possible on this.
Other things that I haven't implemented but could potentially be provided are
query_grantable_rollsandtest_iam_permissions. Not sure what the use of these would be but they are included in the IAM API. One possibility would be a@requires_rollsdecorator for resource functions that would calltest_iam_permissionsbefore making API calls to prevent 403s but I'm not sure how useful that would be.