From 3d7a65f98d999a098ae32a742fd9180f6b3f20c2 Mon Sep 17 00:00:00 2001 From: Aloys Jehwin Date: Wed, 2 Sep 2026 23:50:51 +0530 Subject: [PATCH] fix(discovery-engine): grant Discovery Engine service agent objectViewer on corpus bucket Without roles/storage.objectViewer on the GCS corpus buckets, the Discovery Engine service agent cannot read documents during import, causing every `gem4gov datastore import` to fail with PERMISSION_DENIED and zero documents indexed. Fixes #145 Signed-off-by: Aloys Jehwin --- .../gemini-stage-0/discovery-engine.tf | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/discovery-engine.tf b/blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/discovery-engine.tf index 860201eca..2180fb2a4 100644 --- a/blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/discovery-engine.tf +++ b/blueprints/fedramp-high/gemini-enterprise/gemini-stage-0/discovery-engine.tf @@ -91,6 +91,19 @@ resource "google_storage_bucket" "gemini_enterprise_gcs_bucket" { ] } +# Grant Discovery Engine service agent read access to GCS corpus buckets +resource "google_storage_bucket_iam_member" "corpus_bucket_discovery_engine" { + for_each = var.create_data_stores ? { for k, v in var.gcs_data_store_configs : k => v if v.create_bucket } : {} + + bucket = google_storage_bucket.gemini_enterprise_gcs_bucket[each.key].name + role = "roles/storage.objectViewer" + member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-discoveryengine.iam.gserviceaccount.com" + + depends_on = [ + google_storage_bucket.gemini_enterprise_gcs_bucket + ] +} + # Random suffix for GCS Data Store IDs resource "random_string" "gcs_suffix" { for_each = var.create_data_stores ? var.gcs_data_store_configs : {}