|
1 | 1 | # You need to start with a service account called "terraform" which has both the 'editor' and 'owner' basic permissions. |
2 | 2 | # This allows it to assign permissions to resources per https://cloud.google.com/iam/docs/understanding-roles |
3 | | -# |
4 | | -# Start by assigning the permissions that it needs itself |
5 | | - |
6 | | -# Allows django-gcp.tasks to create periodic tasks for you using google cloud scheduler |
7 | | -# resource "google_project_iam_binding" "terraform_serviceaccount_bindings" { |
8 | | -# count = length(var.terraform_serviceaccount_roles) |
9 | | -# project = var.project |
10 | | -# role = var.terraform_serviceaccount_roles[count.index] |
11 | | -# members = [ |
12 | | -# "serviceAccount:[email protected]", |
13 | | -# ] |
14 | | -# } |
| 3 | + |
15 | 4 |
|
16 | 5 | resource "google_service_account" "dev_thclark" { |
17 | 6 | account_id = "dev-thclark" |
18 | 7 | display_name = "dev-thclark" |
19 | | - project = "octue-django-gcp" |
| 8 | + project = var.project |
| 9 | +} |
| 10 | + |
| 11 | + |
| 12 | +resource "google_service_account" "dev_lukasvinclav" { |
| 13 | + account_id = "dev-lukasvinclav" |
| 14 | + display_name = "dev-lukasvinclav" |
| 15 | + project = var.project |
| 16 | +} |
| 17 | + |
| 18 | + |
| 19 | +# For iam bindings to storage buckets see terraform/storage.tf |
| 20 | + |
| 21 | + |
| 22 | +resource "google_project_iam_binding" "errorreporting_writer" { |
| 23 | + project = var.project |
| 24 | + role = "roles/errorreporting.writer" |
| 25 | + members = [ |
| 26 | + "serviceAccount:${google_service_account.dev_thclark.email}", |
| 27 | + "serviceAccount:${google_service_account.dev_lukasvinclav.email}", |
| 28 | + ] |
20 | 29 | } |
21 | 30 |
|
22 | 31 |
|
23 | | -# Allows django-gcp.tasks to create periodic tasks for you using google cloud scheduler |
24 | | -# resource "google_project_iam_binding" "cloudscheduler_jobs_update" { |
25 | | -# project = var.project |
26 | | -# role = "roles/CloudSchedulerAdmin" |
| 32 | +# Allow django-gcp.tasks to create and update task queues |
| 33 | +resource "google_project_iam_binding" "cloudtasks_admin" { |
| 34 | + project = var.project |
| 35 | + role = "roles/cloudtasks.admin" |
| 36 | + members = [ |
| 37 | + "serviceAccount:${google_service_account.dev_thclark.email}", |
| 38 | + "serviceAccount:${google_service_account.dev_lukasvinclav.email}", |
| 39 | + ] |
| 40 | +} |
| 41 | + |
27 | 42 |
|
28 | | -# members = [ |
29 | | -# "serviceAccount:${google_service_account.dev_thclark.email}", |
30 | | -# ] |
31 | | -# } |
| 43 | +# Allow django-gcp.tasks to create periodic tasks in google cloud scheduler |
| 44 | +resource "google_project_iam_binding" "cloudscheduler_admin" { |
| 45 | + project = var.project |
| 46 | + role = "roles/cloudscheduler.admin" |
| 47 | + members = [ |
| 48 | + "serviceAccount:${google_service_account.dev_thclark.email}", |
| 49 | + "serviceAccount:${google_service_account.dev_lukasvinclav.email}", |
| 50 | + ] |
| 51 | +} |
0 commit comments