Skip to content

Commit

Permalink
Docs: GCP Project code missing from docs. (#29391)
Browse files Browse the repository at this point in the history
  • Loading branch information
aphorise authored Jan 28, 2025
1 parent 87d6876 commit 4fcc547
Showing 1 changed file with 4 additions and 8 deletions.
12 changes: 4 additions & 8 deletions website/content/docs/sync/gcpsm.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -294,20 +294,16 @@ beginning of secret names. To prevent Vault from modifying secrets that were not
created by a sync operation, you can use a role binding against the resource
name with the `startsWith` condition:

<CodeBlockConfig hideClipboard>

```
resource.name.startsWith("projects/<project_number>/secrets/vault")

</CodeBlockConfig>
```

To prevent out-of-band overwrites, simply add a negative condition with `!` on any
write-access role bindings not being used by Vault that contain Secret Manager permissions:

<CodeBlockConfig hideClipboard>

```
!(resource.name.startsWith("projects/<project_number>/secrets/vault"))

</CodeBlockConfig>
```

To add conditions to IAM principles in GCP, click "+ADD IAM CONDITION" on the **Assign Roles** screen.

Expand Down

0 comments on commit 4fcc547

Please sign in to comment.