skills.rest
marin-community
marin-communityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

review-grant

Decrypt, confirm, and apply IAM grant pull requests on the marin Pulumi stack.

3.2k|266|Updated Mar 22, 2024
Search Tags:#GCP#iam#pulumi#gitHub#KMS#Code review#access grants
One-click install
npx skills add https://github.com/marin-community/marin --skill review-grant
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: review-grant
Source: https://github.com/marin-community/marin/tree/main/.agents/skills/review-grant
Command: npx skills add https://github.com/marin-community/marin --skill review-grant

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Grant pull requests in the marin repository use opaque human-NNN references whose emails are KMS ciphertext in iam_data.yaml, so reviewers cannot see who actually receives access. This Skill decrypts the changed principals, enforces an explicit human confirmation of the real identities and roles, then merges and applies the grant with pulumi up.

Core Features & Use Cases

  • Decrypt grant diffs: Runs iam_principal.py decrypt --diff against the PR diff to reveal the real user:<email> principals behind opaque references.
  • Human-in-the-loop confirmation: Presents a plain-language summary of each added or revoked grant and refuses to approve or merge without explicit user approval.
  • Safe apply workflow: Approves and squash-merges the PR, then runs pulumi preview and pulumi up on the affected stack, stopping on any unexpected drift such as NodePool replacements.
  • Use Case: A teammate opens PR #1234 adding a storage viewer grant. Use this Skill to check out the PR, decrypt that it grants [email protected] roles/storage.objectViewer, confirm with the requester, merge, apply the marin stack, and comment on the PR that the grant is live.

Quick Start

Review grant PR 1234 in marin-community/marin, decrypt its principals, and after my confirmation merge it and apply the marin Pulumi stack.

Frequently Asked Questions about review-grant

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review an IAM grant pull request with encrypted principals?▼

Check out the PR with gh, then run the iam_principal.py decrypt --diff command over the git diff to reveal the real user emails behind opaque human-NNN references. Present the decrypted grants to a human for explicit confirmation before approving or merging.

How do I apply a merged IAM grant with Pulumi?▼

After merging, pull main, select the affected stack with pulumi stack select, run pulumi preview to confirm only the intended IAMMember change appears, then run pulumi up. CI never applies changes, so the grant is not live until pulumi up succeeds.

What permissions are needed to decrypt grant principals in marin-iac?▼

You need the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the KMS key used for iam_data.yaml, plus permission to update the marin Pulumi stack. These prerequisites are documented in infra/pulumi/README.md.

When should I stop instead of applying a grant PR?▼

Stop if the diff touches anything beyond grant surfaces like iam_data.yaml or deploy-target IAM modules, if the user does not clearly approve the decrypted grant, or if pulumi preview shows unexpected changes such as NodePool replacements or other drift.

Why does a merged grant PR not take effect immediately?▼

CI never runs pulumi up, so merging only updates the desired state in the repository. The grant becomes live only after someone manually runs pulumi up on the affected stack against the merged main branch.

Related Skills

Explore More Software Engineering Skills→
d-padmanabhand-padmanabhan
15

aws-iam

Diagnose AWS IAM AccessDenied errors across policy layers.

Community
Advanced
googlegoogle
19.1k

iam-helper-for-policy-simulator

Simulates Google Cloud IAM v1 policy changes against access logs before applying them.

Official
Advanced
Cogni-AI-OUCogni-AI-OU
3

pulumi-cli

Automate Pulumi stack preview, deployment, and destruction with JSON output.

Official
Intermediate
jamestexasjamestexas
2

break-glass

Grant temporary IAM permissions for on-call debugging on GCP projects.

Community
Advanced