Gcp/iam
@hivemq/gcp/iamv2026.09.11.1789122862
01README
Bootstrap and maintain the GCP identities CI authenticates as: Workload Identity Federation pools and providers, the service accounts behind them, and the IAM bindings tying the two together. CI cannot create the identity it federates into, so an operator provisions it out of band with this model. Project IAM grants and revocations are condition-aware — including delegated role grants, which bound roles/resourcemanager.projectIamAdmin to a fixed set of roles — and policies are read and written at version 3 so conditional bindings survive a read-modify-write.
02Models
@hivemq/gcp/iamv2026.09.04.1gcp_iam.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| projectId | string | GCP project ID |
fn create_pool(displayName: string, description?: string)
Create a Workload Identity Federation pool (idempotent — skips if exists)
| Argument | Type | Description |
|---|---|---|
| displayName | string | Human-readable pool name |
| description? | string | Pool description |
fn create_github_provider(poolId: string, providerId: string)
Create a GitHub Actions OIDC provider on a WIF pool (idempotent)
| Argument | Type | Description |
|---|---|---|
| poolId | string | WIF pool ID to attach the provider to |
| providerId | string | Provider ID (e.g. github-provider) |
fn create_service_account(displayName: string, description?: string)
Create a GCP service account (idempotent)
| Argument | Type | Description |
|---|---|---|
| displayName | string | Human-readable SA name |
| description? | string | SA description |
fn bind_service_account_to_pool(serviceAccountEmail: string, poolId: string)
Grant roles/iam.workloadIdentityUser on a SA to a WIF pool principal scoped to a GitHub repository
| Argument | Type | Description |
|---|---|---|
| serviceAccountEmail | string | SA email to bind |
| poolId | string | WIF pool ID |
fn grant_external_project_role()
Grant an IAM role to a service account on a project other than this model's own projectId (idempotent)
fn grant_dns_zone_role()
Grant an IAM role to a service account on a specific Cloud DNS managed zone in another project (idempotent). Use this for least-privilege DNS record management scoped to one zone.
fn revoke_dns_zone_role()
Revoke an IAM role from a service account on a specific Cloud DNS managed zone (idempotent — no-op if not granted).
fn grant_project_role()
Grant an IAM role to a service account on the project. Pass a condition to create a conditional binding — e.g. a delegated role grant that limits which roles the grantee may itself grant or revoke.
fn grant_project_roles()
Grant several project IAM roles to service accounts in a single read-modify-write. The plural counterpart of revoke_project_roles, and the one to reach for when a teardown needs more than one role — N grants cost one etag round trip instead of N racing ones. Condition-aware and idempotent.
fn revoke_project_roles()
Revoke project IAM bindings from service accounts in a single read-modify-write. Condition-aware: a binding is matched on role AND condition, so revoking an unconditional role leaves conditional bindings for the same role untouched. Idempotent — bindings already absent are recorded as no-ops.
fn refresh_access_token()
Exchange the local ADC refresh token for a fresh GCP access token and store it in a swamp vault. Reads credentials from application_default_credentials.json — no gcloud binary required. Defaults to vault 'swamp', key 'GCP_ACCESS_TOKEN'.
fn sync()
Refresh stored pool, provider, and service account state from the GCP API
fn delete_pool(poolId: string)
Delete a Workload Identity Federation pool (also deletes its providers)
| Argument | Type | Description |
|---|---|---|
| poolId | string | Pool ID to delete |
fn delete_service_account(serviceAccountEmail: string)
Delete a GCP service account
| Argument | Type | Description |
|---|---|---|
| serviceAccountEmail | string | SA email to delete |
Resources
pool(infinite)— Workload Identity Federation pool
provider(infinite)— Workload Identity Federation OIDC provider
serviceAccount(infinite)— GCP service account
iamBinding(infinite)— IAM policy binding record
iamBindingRevocation(infinite)— Audit record of a project IAM binding revocation, including asserted no-ops
03Previous Versions
2026.09.04.1788530528
2026.09.02.1788364962
2026.07.10.1783669873
2026.04.27.34
2026.04.01.21
2026.04.01.20
Modified 1 models
2026.03.31.15
2026.03.31.1
Modified 1 models
04Stats
B
85 / 100
Downloads
29
Archive size
25.4 KB
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository0/2missing
Repository
https://github.com/hivemq/swamp05Platforms
06Labels