51 lines
2.1 KiB
Bash
51 lines
2.1 KiB
Bash
source ./env.sh
|
|
|
|
# Enable the Storage Transfer API
|
|
gcloud services enable storagetransfer.googleapis.com --project="${PROJECT_ID}"
|
|
|
|
# Create the Storage Transfer service agent on first use and show its email
|
|
curl -s \
|
|
-H "X-Goog-User-Project: ${PROJECT_ID}" \
|
|
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
|
|
"https://storagetransfer.googleapis.com/v1/googleServiceAccounts/${PROJECT_ID}"
|
|
|
|
# Allow the service agent to manage the Pub/Sub topics of the agent pools
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${STS_SERVICE_AGENT}" \
|
|
--role=roles/storagetransfer.serviceAgent
|
|
|
|
# Allow the service agent to read the bucket metadata, check the transferred objects and write transfer logs
|
|
gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
|
|
--member="serviceAccount:${STS_SERVICE_AGENT}" \
|
|
--role=roles/storage.legacyBucketReader
|
|
gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
|
|
--member="serviceAccount:${STS_SERVICE_AGENT}" \
|
|
--role=roles/storage.objectViewer
|
|
gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
|
|
--member="serviceAccount:${STS_SERVICE_AGENT}" \
|
|
--role=roles/storage.objectCreator
|
|
|
|
# Allow the service account to create and run transfer jobs
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${SA_EMAIL}" \
|
|
--role=roles/storagetransfer.user
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${SA_EMAIL}" \
|
|
--role=roles/iam.roleViewer
|
|
|
|
# Allow the service account to act as a transfer agent
|
|
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
|
|
--member="serviceAccount:${SA_EMAIL}" \
|
|
--role=roles/storagetransfer.transferAgent
|
|
|
|
# Allow the transfer agent to write objects, including multipart uploads, to the bucket
|
|
gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
|
|
--member="serviceAccount:${SA_EMAIL}" \
|
|
--role=roles/storage.objectAdmin
|
|
|
|
# Create the agent pool
|
|
gcloud transfer agent-pools create "${STS_AGENT_POOL}" \
|
|
--project="${PROJECT_ID}" \
|
|
--display-name="Dom Lab Agents" \
|
|
--no-async
|