Merge pull request #953 from muresan/feature/iam-service-account-static-id-and-iam-additive

Added IAM Additive and converted some outputs to static

modules/iam-service-account/README.md

@@ -43,21 +43,22 @@ module "myproject-default-service-accounts" {
 
 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
-| [name](variables.tf#L84) | Name of the service account to create. | <code>string</code> | ✓ |  |
-| [project_id](variables.tf#L95) | Project id where service account will be created. | <code>string</code> | ✓ |  |
+| [name](variables.tf#L91) | Name of the service account to create. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L102) | Project id where service account will be created. | <code>string</code> | ✓ |  |
 | [description](variables.tf#L17) | Optional description. | <code>string</code> |  | <code>null</code> |
 | [display_name](variables.tf#L23) | Display name of the service account to create. | <code>string</code> |  | <code>&#34;Terraform-managed.&#34;</code> |
 | [generate_key](variables.tf#L29) | Generate a key for service account. | <code>bool</code> |  | <code>false</code> |
 | [iam](variables.tf#L35) | IAM bindings on the service account in {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [iam_billing_roles](variables.tf#L42) | Billing account roles granted to this service account, by billing account id. Non-authoritative. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [iam_folder_roles](variables.tf#L49) | Folder roles granted to this service account, by folder id. Non-authoritative. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [iam_organization_roles](variables.tf#L56) | Organization roles granted to this service account, by organization id. Non-authoritative. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [iam_project_roles](variables.tf#L63) | Project roles granted to this service account, by project id. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [iam_sa_roles](variables.tf#L70) | Service account roles granted to this service account, by service account name. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [iam_storage_roles](variables.tf#L77) | Storage roles granted to this service account, by bucket name. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [prefix](variables.tf#L89) | Prefix applied to service account names. | <code>string</code> |  | <code>null</code> |
-| [public_keys_directory](variables.tf#L100) | Path to public keys data files to upload to the service account (should have `.pem` extension). | <code>string</code> |  | <code>&#34;&#34;</code> |
-| [service_account_create](variables.tf#L106) | Create service account. When set to false, uses a data source to reference an existing service account. | <code>bool</code> |  | <code>true</code> |
+| [iam_additive](variables.tf#L42) | IAM additive bindings on the service account in {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [iam_billing_roles](variables.tf#L49) | Billing account roles granted to this service account, by billing account id. Non-authoritative. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [iam_folder_roles](variables.tf#L56) | Folder roles granted to this service account, by folder id. Non-authoritative. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [iam_organization_roles](variables.tf#L63) | Organization roles granted to this service account, by organization id. Non-authoritative. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [iam_project_roles](variables.tf#L70) | Project roles granted to this service account, by project id. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [iam_sa_roles](variables.tf#L77) | Service account roles granted to this service account, by service account name. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [iam_storage_roles](variables.tf#L84) | Storage roles granted to this service account, by bucket name. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [prefix](variables.tf#L96) | Prefix applied to service account names. | <code>string</code> |  | <code>null</code> |
+| [public_keys_directory](variables.tf#L107) | Path to public keys data files to upload to the service account (should have `.pem` extension). | <code>string</code> |  | <code>&#34;&#34;</code> |
+| [service_account_create](variables.tf#L113) | Create service account. When set to false, uses a data source to reference an existing service account. | <code>bool</code> |  | <code>true</code> |
 
 ## Outputs
 
@@ -66,9 +67,9 @@ module "myproject-default-service-accounts" {
 | [email](outputs.tf#L17) | Service account email. |  |
 | [iam_email](outputs.tf#L25) | IAM-format service account email. |  |
 | [id](outputs.tf#L33) | Service account id. |  |
-| [key](outputs.tf#L41) | Service account key. | ✓ |
-| [name](outputs.tf#L47) | Service account name. |  |
-| [service_account](outputs.tf#L52) | Service account resource. |  |
-| [service_account_credentials](outputs.tf#L57) | Service account json credential templates for uploaded public keys data. |  |
+| [key](outputs.tf#L42) | Service account key. | ✓ |
+| [name](outputs.tf#L48) | Service account name. |  |
+| [service_account](outputs.tf#L57) | Service account resource. |  |
+| [service_account_credentials](outputs.tf#L62) | Service account json credential templates for uploaded public keys data. |  |
 
 <!-- END TFDOC -->

modules/iam-service-account/iam.tf

@@ -17,6 +17,15 @@
 # tfdoc:file:description IAM bindings.
 
 locals {
+  _iam_additive_pairs = flatten([
+    for role, members in var.iam_additive : [
+      for member in members : { role = role, member = member }
+    ]
+  ])
+  iam_additive = {
+    for pair in local._iam_additive_pairs :
+    "${pair.role}-${pair.member}" => pair
+  }
   iam_billing_pairs = flatten([
     for entity, roles in var.iam_billing_roles : [
       for role in roles : [
@@ -61,6 +70,13 @@ locals {
   ])
 }
 
+resource "google_service_account_iam_member" "roles" {
+  for_each           = local.iam_additive
+  service_account_id = local.service_account.name
+  role               = each.value.role
+  member             = each.value.member
+}
+
 resource "google_service_account_iam_binding" "roles" {
   for_each           = var.iam
   service_account_id = local.service_account.name

modules/iam-service-account/main.tf

@@ -21,7 +21,7 @@ locals {
     ? google_service_account_key.key["1"]
     : map("", null)
   , {})
-  prefix                = var.prefix != null ? "${var.prefix}-" : ""
+  prefix                = var.prefix == null || var.prefix == "" ? "" : "${var.prefix}-"
   resource_email_static = "${local.prefix}${var.name}@${var.project_id}.iam.gserviceaccount.com"
   resource_iam_email = (
     local.service_account != null
@@ -29,6 +29,7 @@ locals {
     : local.resource_iam_email_static
   )
   resource_iam_email_static = "serviceAccount:${local.resource_email_static}"
+  service_account_id_static = "projects/${var.project_id}/serviceAccounts/${local.resource_email_static}"
   service_account = (
     var.service_account_create
     ? try(google_service_account.service_account.0, null)

modules/iam-service-account/outputs.tf

@@ -32,9 +32,10 @@ output "iam_email" {
 
 output "id" {
   description = "Service account id."
-  value       = local.service_account.id
+  value       = local.service_account_id_static
   depends_on = [
-    local.service_account
+    data.google_service_account.service_account,
+    google_service_account.service_account
   ]
 }
 
@@ -46,7 +47,11 @@ output "key" {
 
 output "name" {
   description = "Service account name."
-  value       = local.service_account.name
+  value       = local.service_account_id_static
+  depends_on = [
+    data.google_service_account.service_account,
+    google_service_account.service_account
+  ]
 }
 
 output "service_account" {

modules/iam-service-account/variables.tf

@@ -39,6 +39,13 @@ variable "iam" {
   nullable    = false
 }
 
+variable "iam_additive" {
+  description = "IAM additive bindings on the service account in {ROLE => [MEMBERS]} format."
+  type        = map(list(string))
+  default     = {}
+  nullable    = false
+}
+
 variable "iam_billing_roles" {
   description = "Billing account roles granted to this service account, by billing account id. Non-authoritative."
   type        = map(list(string))