zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Move `bq` robot service account into the robot service account project output (#262)

This commit is contained in:
lcaggio 2021-06-11 13:02:30 +02:00 committed by GitHub
parent d1b560c76d
commit efb52eeb6c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -3,7 +3,8 @@
All notable changes to this project will be documented in this file. All notable changes to this project will be documented in this file.
## [Unreleased] ## [Unreleased]
- Fix `message_retention_duration` variable type in `pubsub` module - Fix `message_retention_duration` variable type in `pubsub` module
- Move `bq` robot service account into the robot service account project output
## [4.9.0] - 2021-06-04 ## [4.9.0] - 2021-06-04

2
data-solutions/gcs-to-bq-with-dataflow/main.tf
View File

@ -134,7 +134,7 @@ module "kms" {
}, },
key-bq = { key-bq = {
"roles/cloudkms.cryptoKeyEncrypterDecrypter" = [ "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
"serviceAccount:${module.project-service.service_accounts.default.bq}", "serviceAccount:${module.project-service.service_accounts.robots.bq}",
#"serviceAccount:${data.google_bigquery_default_service_account.bq_sa.email}", #"serviceAccount:${data.google_bigquery_default_service_account.bq_sa.email}",
] ]
}, },

5
modules/project/service_accounts.tf
View File

@ -17,12 +17,11 @@
locals { locals {
service_account_cloud_services = "${local.project.number}@cloudservices.gserviceaccount.com" service_account_cloud_services = "${local.project.number}@cloudservices.gserviceaccount.com"
service_accounts_default = { service_accounts_default = {
# TODO: Find a better place to store BQ service account
bq = "bq-${local.project.number}@bigquery-encryption.iam.gserviceaccount.com"
compute = "${local.project.number}-compute@developer.gserviceaccount.com" compute = "${local.project.number}-compute@developer.gserviceaccount.com"
gae = "${local.project.project_id}@appspot.gserviceaccount.com" gae = "${local.project.project_id}@appspot.gserviceaccount.com"
} }
service_accounts_robot_services = { service_accounts_robot_services = {
bq = "bigquery-encryption"
cloudasset = "gcp-sa-cloudasset" cloudasset = "gcp-sa-cloudasset"
cloudbuild = "gcp-sa-cloudbuild" cloudbuild = "gcp-sa-cloudbuild"
compute = "compute-system" compute = "compute-system"
@ -37,6 +36,6 @@ locals {
} }
service_accounts_robots = { service_accounts_robots = {
for service, name in local.service_accounts_robot_services : for service, name in local.service_accounts_robot_services :
service => "service-${local.project.number}@${name}.iam.gserviceaccount.com" service => "${service == "bq" ? "bq" : "service"}-${local.project.number}@${name}.iam.gserviceaccount.com"
} }
} }