Added Google Storage Transfer Agent configuration and tests.

make_sts.sh

@@ -0,0 +1,49 @@
+source ./env.sh
+
+# Enable the Storage Transfer API
+gcloud services enable storagetransfer.googleapis.com --project="${PROJECT_ID}"
+
+# Create the Storage Transfer service agent on first use and show its email
+curl -s \
+    -H "Authorization: Bearer $(gcloud auth print-access-token)" \
+    "https://storagetransfer.googleapis.com/v1/googleServiceAccounts/${PROJECT_ID}"
+
+# Allow the service agent to manage the Pub/Sub topics of the agent pools
+gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+    --member="serviceAccount:${STS_SERVICE_AGENT}" \
+    --role=roles/storagetransfer.serviceAgent
+
+# Allow the service agent to read the bucket metadata, check the transferred objects and write transfer logs
+gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
+    --member="serviceAccount:${STS_SERVICE_AGENT}" \
+    --role=roles/storage.legacyBucketReader
+gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
+    --member="serviceAccount:${STS_SERVICE_AGENT}" \
+    --role=roles/storage.objectViewer
+gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
+    --member="serviceAccount:${STS_SERVICE_AGENT}" \
+    --role=roles/storage.objectCreator
+
+# Allow the service account to create and run transfer jobs
+gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role=roles/storagetransfer.user
+gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role=roles/iam.roleViewer
+
+# Allow the service account to act as a transfer agent
+gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role=roles/storagetransfer.transferAgent
+
+# Allow the transfer agent to write objects, including multipart uploads, to the bucket
+gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role=roles/storage.objectAdmin
+
+# Create the agent pool
+gcloud transfer agent-pools create "${STS_AGENT_POOL}" \
+    --project="${PROJECT_ID}" \
+    --display-name="Dom Lab Agents" \
+    --no-async