Simplify and separate read and write GCP permissions

sreagent-templates/identity-federation/gcp/README.md

@@ -1,7 +1,8 @@
 # SRE Agent GCP connector setup
 
 This package uses Terraform to configure the GCP Workload Identity pool,
-OIDC provider, `SREAgentRole` custom IAM role, and role assignment required by
+OIDC provider, `SREAgentReadOnlyAccess` and `SREAgentWriteAccess` custom IAM roles,
+and separate role assignments required by
 the SRE Agent GCP connector.
 
 Provide the user-assigned managed identity's ARM resource ID, not the SRE Agent
@@ -17,8 +18,8 @@ cd sre-agent\sreagent-templates\identity-federation\gcp
 ```
 
 On Linux or macOS, use `cd sre-agent/sreagent-templates/identity-federation/gcp`.
-Follow the steps below from that folder. Keep the setup scripts and all `.tf`
-files together.
+Follow the steps below from that folder. Keep the setup scripts, all `.tf`
+files, and both role JSON files together.
 
 ## Prerequisites
 
@@ -70,7 +71,7 @@ inaccessible project fails.
 
 ### 2. Run setup
 
-Keep `setup.ps1` and all `.tf` files together. Replace the example resource ID:
+Keep `setup.ps1`, all `.tf` files, and both role JSON files together. Replace the example resource ID:
 
 ```powershell
 .\setup.ps1 `
@@ -103,7 +104,7 @@ gcloud config get project
 
 ### 2. Run setup
 
-Keep `setup.sh` and all `.tf` files together. Replace the example resource ID:
+Keep `setup.sh`, all `.tf` files, and both role JSON files together. Replace the example resource ID:
 
 ```bash
 chmod +x setup.sh
@@ -120,15 +121,16 @@ The Bash parameters match the PowerShell parameters above. Omit
 
 - Resolves the tenant and principal/object IDs with `az identity show --ids`;
   resolves the project ID/number from `gcloud`.
-- Discovers the existing pool, provider, custom role, and role assignment for
+- Discovers the existing pool, provider, custom roles, and role assignments for
   the selected identity. Generates Terraform import blocks for these resources
   and enabled APIs; imports the role assignment only if it has no IAM condition.
   Pool/provider imports use the configured project ID to avoid replacement;
   discovery and federated principal names use the project number.
-- Extends compatible provider trust and unions existing role permissions with
-  the requested [permission catalogs](./main.tf).
+- Extends compatible provider trust and adds missing catalog permissions to
+  each role without removing its existing permissions.
 - Ensures IAM, Resource Manager, Service Account Credentials and STS APIs are
   enabled; applies an additive IAM member without replacing other bindings.
+- Removes the selected identity's `SREAgentWriteAccess` assignment when `read-only` is requested.
 - Runs `terraform init` and `apply` in a unique temporary CLI workspace, then
   deletes the workspace and local files without running `terraform destroy`.
 
@@ -138,7 +140,8 @@ The Bash parameters match the PowerShell parameters above. Omit
 | --- | --- | --- |
 | Workload Identity pool | `sre-agent-pool` | `SREAgentPool` |
 | OIDC provider | `sre-agent-provider` | `SREAgentProvider` |
-| Custom IAM role | `SREAgentRole` | `SREAgentRole` |
+| Read custom IAM role | `SREAgentReadOnlyAccess` | `SREAgentReadOnlyAccess` |
+| Write custom IAM role | `SREAgentWriteAccess` | `SREAgentWriteAccess` |
 
 | OIDC field | Value |
 | --- | --- |
@@ -160,9 +163,13 @@ Terraform can delete or replace the pool, provider and role during apply.
 With approval skipped, these changes run without confirmation; GCP soft-delete
 retention still applies.
 
-**Shared permissions:** `existing UNION read UNION write` (write only for
-`read-write`). All role assignees receive the union; `read-only` never downgrades
-existing write access. The catalogs are not administrator roles.
+Existing role permissions and metadata are preserved; only missing catalog
+permissions are added. Manual additions apply to all assignees, including
+write permissions added to `SREAgentReadOnlyAccess`.
+
+`read-only` assigns `SREAgentReadOnlyAccess` and removes the selected identity's `SREAgentWriteAccess`
+assignment; `read-write` assigns both. Conditional grants requiring removal
+block setup; other identities and unrelated or inherited access are unchanged.
 
 ## State and reruns
 
@@ -171,6 +178,8 @@ Workspace cleanup runs on success, cancellation and apply failure.
 retains the local directory/state and reports its path. Failed applies can leave
 partial cloud changes; rerun to rediscover/import them.
 
+Run setups sequentially; do not edit roles between discovery and apply.
+
 ## References
 
 - [Azure CLI identity lookup](https://learn.microsoft.com/cli/azure/identity#az-identity-show)

sreagent-templates/identity-federation/gcp/SREAgentReadOnlyAccess.json

@@ -0,0 +1,122 @@
+{
+  "title": "SREAgentReadOnlyAccess",
+  "description": "SRE Agent resource discovery, metadata, logs, and metrics access.",
+  "stage": "GA",
+  "includedPermissions": [
+    "resourcemanager.projects.get",
+    "resourcemanager.projects.getIamPolicy",
+    "iam.roles.list",
+    "storage.buckets.get",
+    "storage.buckets.list",
+    "storage.objects.get",
+    "storage.objects.list",
+    "run.services.get",
+    "run.services.list",
+    "run.revisions.get",
+    "run.revisions.list",
+    "run.jobs.get",
+    "run.jobs.list",
+    "compute.instances.get",
+    "compute.instances.list",
+    "compute.disks.get",
+    "compute.disks.list",
+    "container.clusters.get",
+    "container.clusters.list",
+    "container.operations.get",
+    "container.operations.list",
+    "cloudsql.instances.get",
+    "cloudsql.instances.list",
+    "cloudsql.databases.get",
+    "cloudsql.databases.list",
+    "pubsub.topics.get",
+    "pubsub.topics.list",
+    "pubsub.subscriptions.get",
+    "pubsub.subscriptions.list",
+    "bigquery.datasets.get",
+    "bigquery.datasets.getIamPolicy",
+    "bigquery.models.getMetadata",
+    "bigquery.models.list",
+    "bigquery.propertyGraphs.get",
+    "bigquery.propertyGraphs.list",
+    "bigquery.routines.get",
+    "bigquery.routines.list",
+    "bigquery.tables.get",
+    "bigquery.tables.getIamPolicy",
+    "bigquery.tables.list",
+    "dataplex.projects.search",
+    "cloudfunctions.functions.get",
+    "cloudfunctions.functions.list",
+    "cloudfunctions.locations.list",
+    "compute.networks.get",
+    "compute.networks.list",
+    "compute.firewalls.get",
+    "compute.firewalls.list",
+    "artifactregistry.repositories.get",
+    "artifactregistry.repositories.list",
+    "artifactregistry.locations.list",
+    "serviceusage.services.list",
+    "logging.logEntries.list",
+    "logging.logs.list",
+    "logging.logMetrics.get",
+    "logging.logMetrics.list",
+    "logging.sinks.get",
+    "logging.sinks.list",
+    "monitoring.timeSeries.list",
+    "monitoring.metricDescriptors.get",
+    "monitoring.metricDescriptors.list",
+    "monitoring.dashboards.get",
+    "monitoring.dashboards.list",
+    "monitoring.alertPolicies.get",
+    "monitoring.alertPolicies.list",
+    "compute.forwardingRules.get",
+    "compute.forwardingRules.list",
+    "compute.globalForwardingRules.get",
+    "compute.globalForwardingRules.list",
+    "compute.backendServices.get",
+    "compute.backendServices.list",
+    "compute.regionBackendServices.get",
+    "compute.regionBackendServices.list",
+    "compute.backendBuckets.get",
+    "compute.backendBuckets.list",
+    "compute.healthChecks.get",
+    "compute.healthChecks.list",
+    "compute.httpHealthChecks.get",
+    "compute.httpHealthChecks.list",
+    "compute.httpsHealthChecks.get",
+    "compute.httpsHealthChecks.list",
+    "compute.urlMaps.get",
+    "compute.urlMaps.list",
+    "compute.regionUrlMaps.get",
+    "compute.regionUrlMaps.list",
+    "compute.targetHttpProxies.get",
+    "compute.targetHttpProxies.list",
+    "compute.targetHttpsProxies.get",
+    "compute.targetHttpsProxies.list",
+    "compute.targetTcpProxies.get",
+    "compute.targetTcpProxies.list",
+    "compute.targetSslProxies.get",
+    "compute.targetSslProxies.list",
+    "compute.addresses.get",
+    "compute.addresses.list",
+    "compute.globalAddresses.get",
+    "compute.globalAddresses.list",
+    "compute.routers.get",
+    "compute.routers.list",
+    "compute.routes.get",
+    "compute.routes.list",
+    "compute.subnetworks.get",
+    "compute.subnetworks.list",
+    "dns.managedZones.get",
+    "dns.managedZones.list",
+    "dns.resourceRecordSets.get",
+    "dns.resourceRecordSets.list",
+    "dns.changes.get",
+    "dns.changes.list",
+    "redis.instances.get",
+    "redis.instances.list",
+    "memcache.instances.get",
+    "memcache.instances.list",
+    "file.instances.get",
+    "file.instances.list"
+  ]
+}

sreagent-templates/identity-federation/gcp/SREAgentWriteAccess.json

@@ -0,0 +1,98 @@
+{
+  "title": "SREAgentWriteAccess",
+  "description": "SRE Agent workload changes; assign together with SREAgentReadOnlyAccess.",
+  "stage": "GA",
+  "includedPermissions": [
+    "storage.buckets.create",
+    "storage.buckets.update",
+    "storage.objects.create",
+    "storage.objects.update",
+    "run.services.create",
+    "run.services.update",
+    "run.jobs.create",
+    "run.jobs.update",
+    "compute.instances.create",
+    "compute.instances.update",
+    "compute.instances.start",
+    "compute.instances.stop",
+    "compute.zoneOperations.get",
+    "compute.regionOperations.get",
+    "compute.globalOperations.get",
+    "compute.disks.create",
+    "compute.disks.update",
+    "container.clusters.create",
+    "container.clusters.update",
+    "cloudsql.instances.create",
+    "cloudsql.instances.update",
+    "pubsub.topics.create",
+    "pubsub.topics.update",
+    "pubsub.topics.attachSubscription",
+    "pubsub.subscriptions.create",
+    "pubsub.subscriptions.update",
+    "bigquery.tables.create",
+    "bigquery.tables.update",
+    "cloudfunctions.functions.create",
+    "cloudfunctions.functions.update",
+    "compute.networks.create",
+    "compute.networks.update",
+    "compute.firewalls.create",
+    "compute.firewalls.update",
+    "artifactregistry.repositories.create",
+    "artifactregistry.repositories.update",
+    "logging.logMetrics.create",
+    "logging.logMetrics.update",
+    "logging.sinks.create",
+    "logging.sinks.update",
+    "monitoring.dashboards.create",
+    "monitoring.dashboards.update",
+    "monitoring.alertPolicies.create",
+    "monitoring.alertPolicies.update",
+    "compute.forwardingRules.create",
+    "compute.forwardingRules.update",
+    "compute.globalForwardingRules.create",
+    "compute.globalForwardingRules.update",
+    "compute.backendServices.create",
+    "compute.backendServices.update",
+    "compute.regionBackendServices.create",
+    "compute.regionBackendServices.update",
+    "compute.backendBuckets.create",
+    "compute.backendBuckets.update",
+    "compute.healthChecks.create",
+    "compute.healthChecks.update",
+    "compute.httpHealthChecks.create",
+    "compute.httpHealthChecks.update",
+    "compute.httpsHealthChecks.create",
+    "compute.httpsHealthChecks.update",
+    "compute.urlMaps.create",
+    "compute.urlMaps.update",
+    "compute.regionUrlMaps.create",
+    "compute.regionUrlMaps.update",
+    "compute.targetHttpProxies.create",
+    "compute.targetHttpProxies.update",
+    "compute.targetHttpsProxies.create",
+    "compute.targetHttpsProxies.update",
+    "compute.targetTcpProxies.create",
+    "compute.targetTcpProxies.update",
+    "compute.targetSslProxies.create",
+    "compute.targetSslProxies.update",
+    "compute.addresses.create",
+    "compute.globalAddresses.create",
+    "compute.routers.create",
+    "compute.routers.update",
+    "compute.routes.create",
+    "compute.subnetworks.create",
+    "compute.subnetworks.update",
+    "compute.subnetworks.use",
+    "dns.managedZones.create",
+    "dns.managedZones.update",
+    "dns.resourceRecordSets.create",
+    "dns.resourceRecordSets.update",
+    "dns.changes.create",
+    "redis.instances.create",
+    "redis.instances.update",
+    "memcache.instances.create",
+    "memcache.instances.update",
+    "file.instances.create",
+    "file.instances.update"
+  ]
+}