[Anwesh-Mahapatra]

Summary

Two small fixes to check_sufficient_permissions_on_service_account in google_threat_intelligence/gti_client.py.

1. Roles granted with an IAM condition are never matched

get_iam_policy is called without requested_policy_version. With the default version 1, IAM returns conditional bindings under a modified role name, e.g. roles/storage.admin_withcond_<hash> (docs). The check compares binding.role == role against PERMISSION_DETAILS, so a correctly granted conditional role (for example Storage Admin scoped to the GTI bucket only) is reported as missing and the function stops.

Fix: request policy version 3, so conditional bindings come back under their real role name.

2. The "insufficient permissions" log is malformed

utils.cloud_logging(
    "Service account - %s does not have sufficient permissions.",
    service_account_email
)

cloud_logging(message, severity) does not format %s, so the service account email was passed as the severity. In Cloud Logging this shows as a literal Service account - %s does not have sufficient permissions. with an empty severity, and the missing roles are never named.

Fix: build the message with an f-string, include the missing role names, and log at ERROR.

How this was found

Deploying the GTI ingestion function into a test project with a dedicated service account. Granting Storage Admin with an IAM condition limited to the checkpoint bucket kept failing the permission check, and the error log did not say which role was missing.

Testing

Ran gti_client_test.py and main_test.py locally (Python 3, requirements.txt + pytest + mock):

• With this change: 111 passed, 1 failed (test__get_last_checkpoint_not_found_exception)
• On main without this change: the same test fails the same way, so it is unrelated to this PR.

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.