Manage Admin Roles
Overview
At checkout the broker assigns a Google Workspace admin role to the requesting identity; at checkin it removes the assignment. Use this for time-bound administrative privileges rather than standing group membership. The service account key is stored in AWS Secrets Manager.
Before You Begin
- The Access Broker is deployed and connected
- The Admin SDK API enabled and a service account with domain-wide delegation
- The Admin SDK role ID for the role you want to assign
- The service account JSON key in AWS Secrets Manager; broker host able to read it
Environment Variables
| Variable | Notes |
|---|---|
GWS_SECRET_NAME | AWS secret holding the Google service account key |
GWS_IDENTITY | User email to assign/remove the role |
GWS_ROLE | Admin SDK role ID |
Checkout / Checkin
Full scripts: Google Workspace/permissions/roles
# checkout — assign role to user (Admin SDK roleAssignments.insert)
# checkin — remove the role assignmentConfigure in Britive
Create the permission
Resource Manager → Resource Type Permissions → New Permission. Language = Shell or Python. Paste the role checkout/checkin routines. Declare GWS_SECRET_NAME, GWS_ROLE (GWS_IDENTITY maps to the requesting user).
Create a profile and policy
Create a profile with a short expiration, set GWS_ROLE, add the permission, and add a policy that requires approval.
Verify
In the Google Admin console, open the user’s Admin roles and privileges — the role appears during checkout and is removed after checkin.
Troubleshoot
| Symptom | Cause | Fix |
|---|---|---|
403 assigning the role | Service account lacks delegation / role-management scope | Grant domain-wide delegation and the required scopes |
| Wrong role assigned | GWS_ROLE is not the Admin SDK role ID | Use the numeric Admin SDK role ID, not the display name |
AccessDenied reading secret | Broker IAM can’t read the secret | Grant secretsmanager:GetSecretValue on GWS_SECRET_NAME |