feat: grant builder-user IAM roles via Terraform

[johnyaku]

Problem

A team member hit a 403 running absconda ... --remote-builder / absconda publish:

ERROR: (gcloud.compute.instances.start) HTTPError 403: Required
'compute.instances.start' permission for
'projects/ctp-archive/zones/australia-southeast1-a/instances/absconda-builder'

The account was authenticated — it was not authorized. Absconda shells out to the gcloud CLI under the invoking user's identity to start/stop the VM and tunnel over IAP for the build (see src/absconda/remote.py). But the Terraform module only ever granted IAM to the builder VM's own service account — never to the humans driving the build. team-setup.md just said "check you have the necessary IAM roles" without listing or provisioning them, so anyone who wasn't already a project owner/editor hit this wall.

Change

Add a builder_users Terraform variable (default: group:g_cancer_tumour_progress_group@garvan.org.au) and grant each member the roles actually needed to drive the builder:

Role	Scope	Why
roles/compute.instanceAdmin.v1	project	start/stop/describe the VM (the missing compute.instances.start)
roles/iap.tunnelResourceAccessor	project	SSH/SCP through the IAP tunnel (VM has no external IP)
roles/compute.osAdminLogin	project	OS Login with sudo — build runs sudo docker build
roles/iam.serviceAccountUser	builder SA	starting an instance with an attached SA requires iam.serviceAccounts.actAs

Codifying this in Terraform (rather than one-off gcloud commands) keeps access reproducible. The variable is parameterized so other teams can grant their own group/users.

Also documents the explicit role list in docs/team-setup.md (new Required IAM Roles section) and terraform/gcp/README.md.

To apply

cd terraform/gcp
terraform plan    # confirm it adds the 4 bindings for the group
terraform apply

Once applied, members of g_cancer_tumour_progress_group@garvan.org.au can run absconda publish with no per-user IAM changes.

Notes / caveats

• terraform was not available in the dev environment, so the HCL was reviewed by hand but not run through terraform validate. Please run terraform plan before applying.
• No change to absconda's code — this is infra + docs only.

🤖 Generated with Claude Code