|
| 1 | +# Running preconditions script |
| 2 | +This module provides a helper script in order to check if the SEED (project where the GCP Service Account was created) met the requirements to satisfy a project creation needs. For example, check billing account permissions or if certain service API is enabled or not. |
| 3 | + |
| 4 | + |
| 5 | +# VirtualEnv (Optional) |
| 6 | +We recommend running the script inside of a [Python virtual environment](https://packaging.python.org/guides/installing-using-pip-and-virtual-environments/) to avoid installing extra packages in your Python default environment. |
| 7 | + |
| 8 | +After installing virtual env by following the link above, create a new Python environment by running: |
| 9 | +``` |
| 10 | +$ python3 -m venv /tmp/preconditions |
| 11 | +``` |
| 12 | +or |
| 13 | +``` |
| 14 | +$ python2 -m virtualenv /tmp/preconditions |
| 15 | +``` |
| 16 | + |
| 17 | +Finally, activate it: |
| 18 | +``` |
| 19 | +$ source /tmp/preconditions/bin/activate |
| 20 | +``` |
| 21 | + |
| 22 | +# How to |
| 23 | +Do the following steps in order to run preconditions script: |
| 24 | + |
| 25 | +1) Install Python dependencies |
| 26 | + ``` |
| 27 | + $ pip install -r helpers/preconditions/requirements.txt |
| 28 | + ``` |
| 29 | + <p><b>Note: If you are not running from virtualenv add the suffix --user on each command line</b></p> |
| 30 | +1) Execute script |
| 31 | + ``` |
| 32 | + $ GOOGLE_CLOUD_PROJECT=my-seed-project python helpers/preconditions/preconditions.py --billing_account [REDACTED] --org_id [REDACTED] --folder_id [REDACTED] |
| 33 | + [ |
| 34 | + { |
| 35 | + "type": "Required APIs on service account project", |
| 36 | + "name": "projects/my-seed-project", |
| 37 | + "satisfied": [ |
| 38 | + "iam.googleapis.com" |
| 39 | + ], |
| 40 | + "unsatisfied": [ |
| 41 | + "admin.googleapis.com", |
| 42 | + "cloudresourcemanager.googleapis.com", |
| 43 | + "cloudbilling.googleapis.com" |
| 44 | + ] |
| 45 | + }, |
| 46 | + { |
| 47 | + "type": "Service account permissions on billing account", |
| 48 | + "name": "billingAccounts/[REDACTED]", |
| 49 | + "satisfied": [ |
| 50 | + "billing.resourceAssociations.create" |
| 51 | + ], |
| 52 | + "unsatisfied": [] |
| 53 | + }, |
| 54 | + { |
| 55 | + "type": "Service account permissions on parent folder", |
| 56 | + "name": "folders/[REDACTED]", |
| 57 | + "satisfied": [ |
| 58 | + "resourcemanager.projects.create" |
| 59 | + ], |
| 60 | + "unsatisfied": [] |
| 61 | + }, |
| 62 | + { |
| 63 | + "type": "Service account permissions on organization", |
| 64 | + "name": "organizations/[REDACTED]", |
| 65 | + "satisfied": [], |
| 66 | + "unsatisfied": [] |
| 67 | + } |
| 68 | + ] |
| 69 | + ``` |
| 70 | + Check #1 (Required APIs on service account project) => It is missing to enable admin, cloudresourcemanager and cloudbilling services APIs in the <b>my-seed-project</b>. |
| 71 | +
|
| 72 | + Check #2 (Service account permissions on billing accoun) => The permission required to associate projects with billing accounts is okay. |
| 73 | +
|
| 74 | + Check #3 (Service account permissions on parent folder) => The permission to create new projects into the folder specified is granted. |
| 75 | +
|
| 76 | + Check #4 (Service account permissions on organization) => No permission required since we are creating the project under the folder instead of the organisation. If no folder is specified it would be step three and require projects.create permission. |
| 77 | +
|
| 78 | + You can add one last check by setting the `--shared-vpc` parameter. |
0 commit comments