Version 1

LICENSE

@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE.

README.md

@@ -0,0 +1,54 @@
+# GCP Terraform Superuser role module
+**!!! WARNING !!!!**
+This module should be used with extreme caution.
+* Use at your own risk.
+* Never use in a production environment
+* Never use in a way that could lead to data leaks, abuse, harm, etc.
+* This is in NO way endorsed, warranted, recommended, or recognized by Google.
+
+# What is this module?
+Balancing security and convenience is always delicate. I try for principle of least privledge whenever possible. I created this module because there are occasionally valid reasons for not adhering to that principle. When I can't adhere to least privledge I try to mitigate the impact of that decision.
+
+This module enables the controlled and scoped provisionment of GCP administrator roles en masse. It takes a binding scope and a member and grants a series of admin roles to the member.
+
+# Usage
+| Input    | Description |
+| -------- | ------- |
+| admin_type | One of ADMIN or SUPERADMIN. Admin is a paired down list that covers most practical use-cases while reducing the number of roles that need to be applied.    |
+| binding_level    | One of PROJECT, FOLDER, or ORGANIZATION   |
+| resource_manager_id | ID of the binding level. A project name for projects or a number for folders and organizations     |
+| member    | One of user:<user_email>, group:<group_email>, or serviceAccount:<service_account_email>   |
+
+# Usage Examples
+
+~~~
+module "super-admin" {
+  source              = "github.com/mike-callahan/gcp-super-admin.git"
+  admin_type          = "SUPERADMIN"
+  binding_level       = "PROJECT"
+  resource_manager_id = "my-project"
+  member              = "user:[email protected]"
+}
+
+module "super-admin" {
+  source              = "github.com/mike-callahan/gcp-super-admin.git"
+  admin_type          = "ADMIN"
+  binding_level       = "FOLDER"
+  resource_manager_id = "123456789"
+  member              = "group:[email protected]"
+}
+
+module "super-admin" {
+  source              = "github.com/mike-callahan/gcp-super-admin.git"
+  admin_type          = "SUPERADMIN"
+  binding_level       = "ORGANIZATION"
+  resource_manager_id = "123456789"
+  member              = "serviceAccount:myaccount@<project>.iam.gserviceaccount.com"
+}
+~~~
+
+# Notes
+* Roles were chosen based on regex keyword of 'admin' or 'Admin'. A few others were manually added such as `resourcemanager.projectDeleter`.
+* This is slow, it takes around 10-15 minutes to apply all the roles of SUPERADMIN.
+* I would keep this in a seperate terraform state file for pipeline speed and blast radius reasons.
+* Roles up-to-date as of 12/15/2023. Includes GA and Beta roles.