[AN-181] Give default compute SA the secretAccessor role

[lucymcnatt]

https://broadworkbench.atlassian.net/browse/AN-181

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[davidangb]

+1 for code syntax.

I assume you've run this through appsec and everyone agrees this is a Good Idea?

[lucymcnatt]

I assume you've run this through appsec and everyone agrees this is a Good Idea?

We've submitted a 1-pager about these changes and gotten preliminary approval, but will hold off on merging until there's a final decision
https://broadinstitute.slack.com/archives/CADU7L0SZ/p1730223296197239

[marctalbott]

This will only give the SA the secretAccessor role in new Google projects that RBS creates. To make sure all new workspaces get this change, you'll need to set up new project pools

EDIT: Other than that this looks good!

[lucymcnatt]

After discussing with the team, we've decided to go ahead and merge this without creating new project pool;

• this change will be propagated to prod with some other Batch changes next week
• this role is only necessary for accessing private dockerhub images with the new batch backend so not something we need urgently in the lower environments.