Skip to content
This repository was archived by the owner on Aug 20, 2025. It is now read-only.

CIS 1.07 & 1.09: Separation of duties#240

Open
charliewolf wants to merge 3 commits intoGoogleCloudPlatform:mainfrom
charliewolf:feature/cis/1.07
Open

CIS 1.07 & 1.09: Separation of duties#240
charliewolf wants to merge 3 commits intoGoogleCloudPlatform:mainfrom
charliewolf:feature/cis/1.07

Conversation

@charliewolf
Copy link
Copy Markdown
Contributor

No description provided.

severity: high
parameters:
roles:
- - roles/cloudkms.admin
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is the extra dash needed here?

e.g.

    roles:
      - - roles/cloudkms.admin
        - roles/cloudkms.cryptoKeyDecrypter

instead of

    roles:
      - roles/cloudkms.admin
        roles/cloudkms.cryptoKeyDecrypter

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@joecheuk because it's a list of lists of roles, not a list of roles. each list is a set that the exclusion is calculated for.

@dekuhn
Copy link
Copy Markdown
Contributor

dekuhn commented Feb 24, 2020

@gkowalski-google can you please review and help Charlie get this merged. I think he has addressed Joe's questions/feedback.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants