Repository: ansible/ansible-modules-core

Issue:
Create gce instance with permissions / service account scopes
##### Issue Type:

Feature Idea
##### Ansible Version:

ansible 1.4.3
##### Environment:

N/A
##### Summary:

Want to use gce module to create an instance with any permissions to access any other Google cloud resources like storage.  Apparently I need to pass in the [service_account_scopes flag](https://developers.google.com/compute/docs/instances)  [as is seen done in the unit test](https://github.com/ansible/ansible/blob/devel/test/gce_tests.py#L208) when calling `gcutil` directly.  How can I pass this flag using the module?
##### Steps To Reproduce:

N/A
##### Expected Results:

N/A
##### Actual Results:

N/A

cc @erjohnso

Many thanks!

NOTE: this issue was ported over from the old ansible repo where it was https://github.com/ansible/ansible/issues/6003



Discussion:
@jplehmann - sorry I missed this before it was moved over to the new modules repo.  I'll see if I can get a PR out for this soon.

@erjohnso Did you get any progress with this?

I agree, this would be very nice to have. :+1: 

I needed write access to cloud storage, so I made this quick patch for https://github.com/ansible/ansible-modules-core/blob/devel/cloud/google/gce.py#L349:

```
--- gce.py.orig 2015-02-09 22:08:23.356574248 +0000
+++ gce.py  2015-02-09 22:22:51.736554665 +0000
@@ -317,9 +317,10 @@
                 pd = gce.ex_get_volume("%s" % name, lc_zone)
         inst = None
         try:
+            ex_sa = [{'scopes': ['storage-rw']}]
             inst = gce.create_node(name, lc_machine_type, lc_image,
                     location=lc_zone, ex_network=network, ex_tags=tags,
-                    ex_metadata=metadata, ex_boot_disk=pd)
+                    ex_metadata=metadata, ex_boot_disk=pd, ex_service_accounts=ex_sa)
             changed = True
         except ResourceExistsError:
             inst = gce.ex_get_node(name, lc_zone)
```


Resolving patch:
diff --git a/cloud/google/gce.py b/cloud/google/gce.py
--- a/cloud/google/gce.py
+++ b/cloud/google/gce.py
@@ -58,6 +58,13 @@
     required: false
     default: null
     aliases: []
+  service_account_permissions:
+    version_added: 1.5.1
+    description:
+      - service account permissions (see U(https://cloud.google.com/sdk/gcloud/reference/compute/instances/create), --scopes section for detailed information)
+    required: false
+    default: null
+    aliases: []
   pem_file:
     version_added: 1.5.1
     description:
@@ -287,6 +294,8 @@ def create_instances(module, gce, instance_names):
     ip_forward = module.params.get('ip_forward')
     external_ip = module.params.get('external_ip')
     disk_auto_delete = module.params.get('disk_auto_delete')
+    service_account_permissions = module.params.get('service_account_permissions')
+    service_account_email = module.params.get('service_account_email')
 
     if external_ip == "none":
         external_ip = None
@@ -330,6 +339,20 @@ def create_instances(module, gce, instance_names):
             items.append({"key": k,"value": v})
         metadata = {'items': items}
 
+    ex_sa_perms = []
+    bad_perms = []
+    if service_account_permissions:
+        for perm in service_account_permissions:
+            if not perm in gce.SA_SCOPES_MAP.keys():
+                bad_perms.append(perm)
+        if len(bad_perms) > 0:
+            module.fail_json(msg='bad permissions: %s' % str(bad_perms))
+        if service_account_email:
+            ex_sa_perms.append({'email': service_account_email})
+        else:
+            ex_sa_perms.append({'email': "default"})
+        ex_sa_perms[0]['scopes'] = service_account_permissions
+
     # These variables all have default values but check just in case
     if not lc_image or not lc_network or not lc_machine_type or not lc_zone:
         module.fail_json(msg='Missing required create instance variable',
@@ -349,7 +372,7 @@ def create_instances(module, gce, instance_names):
             inst = gce.create_node(name, lc_machine_type, lc_image,
                     location=lc_zone, ex_network=network, ex_tags=tags,
                     ex_metadata=metadata, ex_boot_disk=pd, ex_can_ip_forward=ip_forward,
-                    external_ip=external_ip, ex_disk_auto_delete=disk_auto_delete)
+                    external_ip=external_ip, ex_disk_auto_delete=disk_auto_delete, ex_service_accounts=ex_sa_perms)
             changed = True
         except ResourceExistsError:
             inst = gce.ex_get_node(name, lc_zone)
@@ -437,6 +460,7 @@ def main():
             tags = dict(type='list'),
             zone = dict(default='us-central1-a'),
             service_account_email = dict(),
+            service_account_permissions = dict(type='list'),
             pem_file = dict(),
             project_id = dict(),
             ip_forward = dict(type='bool', default=False),


Test patch: