#398 Add IAM policy management (setIamPolicy/getIamPolicy) on cloudresourcemanager resources; add custom-role CRUD to @swamp/gcp/iam

Summary

The auto-generated @swamp/gcp/cloudresourcemanager and @swamp/gcp/iam extensions don't expose the IAM-policy management operations that the GCP APIs offer. This makes it impossible to manage IAM bindings or custom roles through swamp models / workflows — which is a blocker for any infrastructure-as-code workflow that follows the "no ad-hoc bindings, no ad-hoc gcloud writes" principle.

What's missing

1. setIamPolicy / getIamPolicy on @swamp/gcp/cloudresourcemanager/{organizations, folders, projects}

GCP's Cloud Resource Manager API exposes getIamPolicy and setIamPolicy on each of these resources (the standard IAM-policy-on-a-resource pattern). The current models only expose create, update, delete, move, undelete, search, get, sync — no IAM operations.

Repro:

swamp model type describe @swamp/gcp/cloudresourcemanager/folders --json | jq -r '.methods[].name'
# create, get, update, delete, sync, move, search, undelete

Result: no way to add/remove a role binding on a folder/project/org through a model method.

2. Custom-role CRUD on @swamp/gcp/iam

GCP's IAM Admin API exposes iam.organizations.roles.{create, get, update, delete, undelete, list} (and the same for project-scoped custom roles). @swamp/gcp/iam ships only a single policies model — which is the v2 Deny Policies API, not custom roles.

Repro:

swamp model type search "gcp/iam"
# only: @swamp/gcp/iam/policies
swamp model type describe @swamp/gcp/iam/policies --json | jq -r '.methods[].name'
# get, update, delete, sync, create_policy, list_policies   (← Deny Policies API)

Why this matters

Every infrastructure-as-code use case that creates resources also needs to grant scoped access to them. Without setIamPolicy and custom-role CRUD, the swamp models can only build "what" exists — not "who can do what with it." That forces users to drop out of swamp workflows into ad-hoc gcloud for IAM, which defeats the purpose of using swamp for governed infra changes.

Concrete use case I hit (May 2026): a multi-week project to bootstrap a new GCP org with a JIT-elevated identity model. Phase 0 needs to:

• Create a custom org role with a specific permission set (iam.organizations.roles.create)
• Bind a user to that role on the org (org.setIamPolicy)
• Later, unbind them (same API)

I'm building a local extension to plug the gap so I can keep going, but the underlying capability really belongs in @swamp/gcp/cloudresourcemanager + @swamp/gcp/iam since they auto-generate from the GCP discovery docs that already describe these methods.

Proposed fix

For @swamp/gcp/cloudresourcemanager/{organizations,folders,projects} (and probably any resource that exposes IAM policy):

• Add a get_iam_policy method that calls resource.getIamPolicy() and returns the bindings.
• Add a set_iam_policy method that calls resource.setIamPolicy(policy, etag) with read-modify-write retry.
• Optionally, add convenience methods: add_iam_binding(member, role) / remove_iam_binding(member, role) that do the read-modify-write internally — these would match the ergonomics of gcloud projects add-iam-policy-binding.

For @swamp/gcp/iam:

• Add a roles model type covering custom-role CRUD against iam.organizations.roles.* and iam.projects.roles.*. The discovery document already describes the full method set.

Environment

• swamp: 20260515.175436.0-sha.2f8e98af
• @swamp/gcp/cloudresourcemanager: 2026.05.19.2
• @swamp/gcp/iam: 2026.05.19.2
• Linux x86_64

Upstream repository: https://github.com/systeminit/swamp-extensions

Environment

• Extension: @swamp/gcp/[email protected]
• swamp: 20260520.150010.0-sha.47868db6
• OS: linux (x86_64)
• Deno: 2.7.14+19bd3d8
• Shell: /bin/bash