document required scopes and where to set them about berglas

[josharian]

It is still relevant, in that if I needed these docs, probably someone else does too.

I can't help move it forward, as I noted in my last comment.

[sethvargo]

Hi @josharian

Scopes are not the same as permissions. Berglas requires the cloud-platform scope. For permissions, access needs roles/cloudkms.cryptoKeyDecrypter on the Crypto Key. It also needs the roles/storage.legacyObjectReader and roles/storage.objectViewer permissions. Let me know if that helps.

[josharian]

Yes, thanks!

For others who may encounter this issue, I set the various permissions via the console. I couldn't find a way to add the required scope in the console, but following https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes I ran:

gcloud compute instances set-service-account INSTANCE --service-account SERVICE_ACCOUNT --scopes cloud-platform

And that did it.

I think it'd be good to document the required scopes and permissions, but I'm not sure exactly how or where (or else I'd send a docs PR).