diff --git a/modules/iam-service-account/README.md b/modules/iam-service-account/README.md
index fe3b65b0..3f87d9d8 100644
--- a/modules/iam-service-account/README.md
+++ b/modules/iam-service-account/README.md
@@ -24,26 +24,37 @@ module "myproject-default-service-accounts" {
}
# tftest modules=1 resources=5
```
+
+## Files
+
+| name | description | resources |
+|---|---|---|
+| [iam.tf](./iam.tf) | None | google_billing_account_iam_member
· google_folder_iam_member
· google_organization_iam_member
· google_project_iam_member
· google_service_account_iam_binding
· google_storage_bucket_iam_member
|
+| [main.tf](./main.tf) | Module-level locals and resources. | google_service_account
· google_service_account_key
|
+| [outputs.tf](./outputs.tf) | Module outputs. | |
+| [variables.tf](./variables.tf) | Module variables. | |
+| [versions.tf](./versions.tf) | Version pins. | |
+
## Variables
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
-| [name](variables.tf#L71) | Name of the service account to create. | string
| ✓ | |
-| [project_id](variables.tf#L82) | Project id where service account will be created. | string
| ✓ | |
+| [name](variables.tf#L77) | Name of the service account to create. | string
| ✓ | |
+| [project_id](variables.tf#L88) | Project id where service account will be created. | string
| ✓ | |
| [description](variables.tf#L17) | Optional description. | string
| | null
|
| [display_name](variables.tf#L23) | Display name of the service account to create. | string
| | "Terraform-managed."
|
| [generate_key](variables.tf#L29) | Generate a key for service account. | bool
| | false
|
| [iam](variables.tf#L35) | IAM bindings on the service account in {ROLE => [MEMBERS]} format. | map(list(string))
| | {}
|
-| [iam_billing_roles](variables.tf#L41) | Billing account roles granted to the service account, by billing account id. Non-authoritative. | map(list(string))
| | {}
|
-| [iam_folder_roles](variables.tf#L47) | Folder roles granted to the service account, by folder id. Non-authoritative. | map(list(string))
| | {}
|
-| [iam_organization_roles](variables.tf#L53) | Organization roles granted to the service account, by organization id. Non-authoritative. | map(list(string))
| | {}
|
-| [iam_project_roles](variables.tf#L59) | Project roles granted to the service account, by project id. | map(list(string))
| | {}
|
-| [iam_storage_roles](variables.tf#L65) | Storage roles granted to the service account, by bucket name. | map(list(string))
| | {}
|
-| [prefix](variables.tf#L76) | Prefix applied to service account names. | string
| | null
|
-| [public_keys_directory](variables.tf#L87) | Path to public keys data files to upload to the service account (should have `.pem` extension). | string
| | ""
|
-| [service_account_create](variables.tf#L93) | Create service account. When set to false, uses a data source to reference an existing service account. | bool
| | true
|
+| [iam_billing_roles](variables.tf#L42) | Billing account roles granted to the service account, by billing account id. Non-authoritative. | map(list(string))
| | {}
|
+| [iam_folder_roles](variables.tf#L49) | Folder roles granted to the service account, by folder id. Non-authoritative. | map(list(string))
| | {}
|
+| [iam_organization_roles](variables.tf#L56) | Organization roles granted to the service account, by organization id. Non-authoritative. | map(list(string))
| | {}
|
+| [iam_project_roles](variables.tf#L63) | Project roles granted to the service account, by project id. | map(list(string))
| | {}
|
+| [iam_storage_roles](variables.tf#L70) | Storage roles granted to the service account, by bucket name. | map(list(string))
| | {}
|
+| [prefix](variables.tf#L82) | Prefix applied to service account names. | string
| | null
|
+| [public_keys_directory](variables.tf#L93) | Path to public keys data files to upload to the service account (should have `.pem` extension). | string
| | ""
|
+| [service_account_create](variables.tf#L99) | Create service account. When set to false, uses a data source to reference an existing service account. | bool
| | true
|
## Outputs
diff --git a/modules/iam-service-account/iam.tf b/modules/iam-service-account/iam.tf
new file mode 100644
index 00000000..44678f0e
--- /dev/null
+++ b/modules/iam-service-account/iam.tf
@@ -0,0 +1,110 @@
+/**
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+ iam_billing_pairs = flatten([
+ for entity, roles in var.iam_billing_roles : [
+ for role in roles : [
+ { entity = entity, role = role }
+ ]
+ ]
+ ])
+ iam_folder_pairs = flatten([
+ for entity, roles in var.iam_folder_roles : [
+ for role in roles : [
+ { entity = entity, role = role }
+ ]
+ ]
+ ])
+ iam_organization_pairs = flatten([
+ for entity, roles in var.iam_organization_roles : [
+ for role in roles : [
+ { entity = entity, role = role }
+ ]
+ ]
+ ])
+ iam_project_pairs = flatten([
+ for entity, roles in var.iam_project_roles : [
+ for role in roles : [
+ { entity = entity, role = role }
+ ]
+ ]
+ ])
+ iam_storage_pairs = flatten([
+ for entity, roles in var.iam_storage_roles : [
+ for role in roles : [
+ { entity = entity, role = role }
+ ]
+ ]
+ ])
+}
+
+resource "google_service_account_iam_binding" "roles" {
+ for_each = var.iam
+ service_account_id = local.service_account.name
+ role = each.key
+ members = each.value
+}
+
+resource "google_billing_account_iam_member" "billing-roles" {
+ for_each = {
+ for pair in local.iam_billing_pairs :
+ "${pair.entity}-${pair.role}" => pair
+ }
+ billing_account_id = each.value.entity
+ role = each.value.role
+ member = local.resource_iam_email
+}
+
+resource "google_folder_iam_member" "folder-roles" {
+ for_each = {
+ for pair in local.iam_folder_pairs :
+ "${pair.entity}-${pair.role}" => pair
+ }
+ folder = each.value.entity
+ role = each.value.role
+ member = local.resource_iam_email
+}
+
+resource "google_organization_iam_member" "organization-roles" {
+ for_each = {
+ for pair in local.iam_organization_pairs :
+ "${pair.entity}-${pair.role}" => pair
+ }
+ org_id = each.value.entity
+ role = each.value.role
+ member = local.resource_iam_email
+}
+
+resource "google_project_iam_member" "project-roles" {
+ for_each = {
+ for pair in local.iam_project_pairs :
+ "${pair.entity}-${pair.role}" => pair
+ }
+ project = each.value.entity
+ role = each.value.role
+ member = local.resource_iam_email
+}
+
+resource "google_storage_bucket_iam_member" "bucket-roles" {
+ for_each = {
+ for pair in local.iam_storage_pairs :
+ "${pair.entity}-${pair.role}" => pair
+ }
+ bucket = each.value.entity
+ role = each.value.role
+ member = local.resource_iam_email
+}
diff --git a/modules/iam-service-account/main.tf b/modules/iam-service-account/main.tf
index f4d6952f..329d676e 100644
--- a/modules/iam-service-account/main.tf
+++ b/modules/iam-service-account/main.tf
@@ -15,41 +15,6 @@
*/
locals {
- iam_billing_pairs = flatten([
- for entity, roles in var.iam_billing_roles : [
- for role in roles : [
- { entity = entity, role = role }
- ]
- ]
- ])
- iam_folder_pairs = flatten([
- for entity, roles in var.iam_folder_roles : [
- for role in roles : [
- { entity = entity, role = role }
- ]
- ]
- ])
- iam_organization_pairs = flatten([
- for entity, roles in var.iam_organization_roles : [
- for role in roles : [
- { entity = entity, role = role }
- ]
- ]
- ])
- iam_project_pairs = flatten([
- for entity, roles in var.iam_project_roles : [
- for role in roles : [
- { entity = entity, role = role }
- ]
- ]
- ])
- iam_storage_pairs = flatten([
- for entity, roles in var.iam_storage_roles : [
- for role in roles : [
- { entity = entity, role = role }
- ]
- ]
- ])
# https://github.com/hashicorp/terraform/issues/22405#issuecomment-591917758
key = try(
var.generate_key
@@ -115,60 +80,3 @@ resource "google_service_account_key" "upload_key" {
service_account_id = local.service_account.email
public_key_data = each.value
}
-
-resource "google_service_account_iam_binding" "roles" {
- for_each = var.iam
- service_account_id = local.service_account.name
- role = each.key
- members = each.value
-}
-
-resource "google_billing_account_iam_member" "billing-roles" {
- for_each = {
- for pair in local.iam_billing_pairs :
- "${pair.entity}-${pair.role}" => pair
- }
- billing_account_id = each.value.entity
- role = each.value.role
- member = local.resource_iam_email
-}
-
-resource "google_folder_iam_member" "folder-roles" {
- for_each = {
- for pair in local.iam_folder_pairs :
- "${pair.entity}-${pair.role}" => pair
- }
- folder = each.value.entity
- role = each.value.role
- member = local.resource_iam_email
-}
-
-resource "google_organization_iam_member" "organization-roles" {
- for_each = {
- for pair in local.iam_organization_pairs :
- "${pair.entity}-${pair.role}" => pair
- }
- org_id = each.value.entity
- role = each.value.role
- member = local.resource_iam_email
-}
-
-resource "google_project_iam_member" "project-roles" {
- for_each = {
- for pair in local.iam_project_pairs :
- "${pair.entity}-${pair.role}" => pair
- }
- project = each.value.entity
- role = each.value.role
- member = local.resource_iam_email
-}
-
-resource "google_storage_bucket_iam_member" "bucket-roles" {
- for_each = {
- for pair in local.iam_storage_pairs :
- "${pair.entity}-${pair.role}" => pair
- }
- bucket = each.value.entity
- role = each.value.role
- member = local.resource_iam_email
-}
diff --git a/modules/iam-service-account/versions.tf b/modules/iam-service-account/versions.tf
index 29041268..e72a7800 100644
--- a/modules/iam-service-account/versions.tf
+++ b/modules/iam-service-account/versions.tf
@@ -13,7 +13,7 @@
# limitations under the License.
terraform {
- required_version = ">= 1.0.0"
+ required_version = ">= 1.1.0"
required_providers {
google = {
source = "hashicorp/google"