# Google Service Accounts Module
This module allows simplified creation and management of one or more service accounts and their IAM bindings. Keys can optionally be generated and will be stored in Terraform state. To use them create a sensitive output in your root modules referencing the `keys` or `key` outputs, then extract the private key from the JSON formatted outputs.
## Example
```hcl
module "myproject-default-service-accounts" {
source = "./modules/iam-service-accounts"
project_id = "myproject"
names = ["vm-default", "gke-node-default"]
generate_keys = true
# authoritative roles granted *on* the service accounts to other identities
iam_roles = ["roles/iam.serviceAccountUser"]
iam_members = {
"roles/iam.serviceAccountUser" => ["user:foo@example.com"]
}
# non-authoritative roles granted *to* the service accounts on other resources
iam_project_roles = {
"myproject" = [
"roles/logging.logWriter",
"roles/monitoring.metricWriter",
]
}
}
```
## Variables
| name | description | type | required | default |
|---|---|:---: |:---:|:---:|
| project_id | Project id where service account will be created. | string | ✓ | |
| *generate_keys* | Generate keys for service accounts. | bool | | false |
| *iam_billing_roles* | Project roles granted to all service accounts, by billing account id. | map(list(string)) | | {} |
| *iam_folder_roles* | Project roles granted to all service accounts, by folder id. | map(list(string)) | | {} |
| *iam_members* | Map of member lists which are granted authoritative roles on the service accounts, keyed by role. | map(list(string)) | | {} |
| *iam_organization_roles* | Project roles granted to all service accounts, by organization id. | map(list(string)) | | {} |
| *iam_project_roles* | Project roles granted to all service accounts, by project id. | map(list(string)) | | {} |
| *iam_roles* | List of authoritative roles granted on the service accounts. | list(string) | | [] |
| *iam_storage_roles* | Storage roles granted to all service accounts, by bucket name. | map(list(string)) | | {} |
| *names* | Names of the service accounts to create. | list(string) | | [] |
| *prefix* | Prefix applied to service account names. | string | |