Create a least‑privilege custom role with IAMConfiguration Terraform and assign it plus viewer to the operator account. Add KMS roles if using CMEK.
- Unzip the marketplace configuration ZIP and locate IAMConfiguration.
- Prepare a GCS bucket/prefix for the Terraform state.
- Configure backend.auto.tfvars.
bucket = "my-sdsc-tfstate-bucket"
prefix = "iam/role1"
- Set terraform.tfvars.
project = "my-project-id"
role_id = "sdsb.storage.cluster.role"
title = "SDSB Storage Cluster Role"
description = "Least-priv role for VSP One SDS Block deploy"
- Initialize and apply.
terraform init -backend-config="backend.auto.tfvars"
terraform plan
terraform apply -auto-approve
- Grant access.
Assign the custom role and viewer to the operator principal. Add required KMS permissions for CMEK.