Verify required permission for Leo SA

[vkumra-broad]

Bernick pinged the #dsp-infosec-champions room in slack asking that we look into the service specific Service Accounts to verify what permissions they actually need.

[davidbernick]

This is not new -- I asked about this in November. Do we have an official answer?

[rtitle]

The ask here is what permissions the Leo SA needs in broad-dsde-prod, correct? I believe we need storage admin, because we create buckets in broad-dsde-prod. Other operations are all done in users' billing projects, so are probably not needed in broad-dsde-prod.

We may be able to test this:

1. Create a SA in broad-dsde-dev
2. Deploy Leo to a fiab. Change leonardo.conf to point to the above SA
3. Play with IAM roles in broad-dsde-dev for the above SA until we find the minimal set that works

[davidbernick]

you probably also need SQLProxy rights (i think it's called SQLClient in IAM).

[vkumra-broad]

Tested in dev: Storage Admin and CloudSQL Client are the only permissions that leo service account needs.

[vkumra-broad]

Also needs Dataproc Viewer permission.