Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
github-actions
Bot
added
the
Priority: Deadline
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| Copy the **Sentry Service Account email** from the Sentry integration setup modal, and apply it as the principal. Assign the **Service Account Token Creator** role (`roles/iam.serviceAccountTokenCreator`) and click **Save**. | ||
|
|
||
| **Grant this role on your service account itself.** This limits the impersonation grant to the account you created for the integration. |
There was a problem hiding this comment.
Could just be me / the fact that I don't have GCP open but I'm a bit confused about the "your service account itself" wording. Does this mean: make sure you grant this role to the created service account? From what I see in the docs it seems like you first have to select the created service account anyway to grant the role to the Sentry service account. If yes, I think this last paragraph could be taken out
There was a problem hiding this comment.
@shashjar - what do you think? I wasn't quite sure, as I didn't run through a GCP setup (don't have an account). I assumed what we were trying to say was that the role needs to be on the service account vs in a project. But I do agree that we could get clarification here and either nix the sentence or better word it.
There was a problem hiding this comment.
Yeah agreed this is a bit confusing since there's 2 service accounts to keep straight. I think using the phrase "service account you created" makes it clearer that we're referring to the customer-side service account, not the service account we generated for them and manage on our side.
How about something like this?
7. Authorize the **Sentry Service Account** to impersonate **your service account**.
In the Google Cloud console:
1. Open **IAM & Admin > Service Accounts** and select the project containing the service account you created for this integration.
2. Open **Permissions** for that service account, find **Principals with access to this service account**, and click **Grant access**.
3. Enter the **Sentry Service Account email** shown in the Sentry integration setup modal as the principal.
4. Select **Service Account Token Creator** (roles/iam.serviceAccountTokenCreator) and click **Save**.
I think the most succinct way to say it is: Grant the **Sentry service account** the **Service Account Token Creator** (roles/iam.serviceAccountTokenCreator) role on the service account you created for this integration. This allows Sentry to impersonate that account in order to query your GCP data.. I think most GCP admins should understand the role they need to grant, and the principals involved. Open to thoughts on how much hand-holding/detail is really necessary.
There was a problem hiding this comment.
Yep, I like that. Reads much better. Updated!
This branch was successfully deployed
3 participants
DESCRIBE YOUR PR
Updated docs to include GCP for Seer integration.
IS YOUR CHANGE URGENT?
Help us prioritize incoming PRs by letting us know when the change needs to go live.
Select exactly one option. For deadlines, replace
YYYY-MM-DDwith the due date. You can update this information later by editing the PR description.SLA
Thanks in advance for your help!
PRE-MERGE CHECKLIST
Make sure you've checked the following before merging your changes: