Skip to content
Sarj Sarj Sarj Standards

no-project-basic-privilege

Disallow proven project IAM Owner and Editor grants.

SARJ212 Rule source Tests Catalog JSON

Why

Project Owner and Editor grants confer broad mutable access across project services.

Fix

Grant the specific predefined or custom roles required by the principal.

Examples

Before — flagged Project Editor grants broad mutable access
main.tf
locals { grants = ["roles/editor", "roles/logging.logWriter"] }
resource "google_project_iam_member" "app" {
  for_each = toset(local.grants)
  role     = each.value
}
After — preferred A specific role stays scoped
main.tf
resource "google_project_iam_member" "app" { role = "roles/logging.logWriter" }