Function createAirnodeBucket

packages/airnode-deployer/src/infrastructure/gcp.ts:50–106

(cloudProvider: GcpCloudProvider)

};

export const createAirnodeBucket = async (cloudProvider: GcpCloudProvider) => {
  const storage = initializeGcsService();
  const bucketName = generateBucketName();

  logger.debug(`Creating GCS bucket '${bucketName}' in ${cloudProvider.region}`);
  const goCreate = await go(() => storage.createBucket(bucketName, { location: cloudProvider.region }));
  if (!goCreate.success) {
    throw new Error(`Failed to create an GCS bucket: ${goCreate.error}`);
  }

  const [bucket] = goCreate.data;

  // Setting uniform bucket-level access
  // https://cloud.google.com/storage/docs/uniform-bucket-level-access
  logger.debug(`Setting uniform bucket-level access for GCS bucket '${bucketName}'`);
  const goMetadata = await go(() =>
    bucket.setMetadata({
      iamConfiguration: { uniformBucketLevelAccess: { enabled: true }, publicAccessPrevention: 'enforced' },
    })
  );
  if (!goMetadata.success) {
    throw new Error(`Failed to setup a uniform bucket-level access for bucket '${bucketName}': ${goMetadata.error}`);
  }

  // Adding roles that are by default added when adding bucket via GCP Console. Some are missing when creating bucket via SDK,
  // causing user not being able to see the bucket content in the GCP Console.
  const policy = {
    bindings: [
      {
        role: 'roles/storage.legacyBucketReader',
        members: [`projectViewer:${cloudProvider.projectId}`],
      },
      {
        role: 'roles/storage.legacyBucketOwner',
        members: [`projectEditor:${cloudProvider.projectId}`, `projectOwner:${cloudProvider.projectId}`],
      },
      {
        role: 'roles/storage.legacyObjectReader',
        members: [`projectViewer:${cloudProvider.projectId}`],
      },
      {
        role: 'roles/storage.legacyObjectOwner',
        members: [`projectEditor:${cloudProvider.projectId}`, `projectOwner:${cloudProvider.projectId}`],
      },
    ],
  };
  logger.debug(`Setting necessary IAM policy for GCS bucket '${bucketName}'`);
  const goPolicy = await go(() => bucket.iam.setPolicy(policy));
  if (!goPolicy.success) {
    throw new Error(`Failed to setup IAM policy for bucket '${bucketName}': ${goPolicy.error}`);
  }

  return {
    name: bucketName,
    region: cloudProvider.region,
  };
};