Added IAM Additive and converted some outputs to static

modules/iam-service-account/iam.tf

@@ -17,6 +17,15 @@
 # tfdoc:file:description IAM bindings.
 
 locals {
+  _iam_additive_pairs = flatten([
+    for role, members in var.iam_additive : [
+      for member in members : { role = role, member = member }
+    ]
+  ])
+  iam_additive = {
+    for pair in local._iam_additive_pairs :
+    "${pair.role}-${pair.member}" => pair
+  }
   iam_billing_pairs = flatten([
     for entity, roles in var.iam_billing_roles : [
       for role in roles : [
@@ -61,6 +70,13 @@ locals {
   ])
 }
 
+resource "google_service_account_iam_member" "roles" {
+  for_each           = local.iam_additive
+  service_account_id = local.service_account.name
+  role               = each.value.role
+  member             = each.value.member
+}
+
 resource "google_service_account_iam_binding" "roles" {
   for_each           = var.iam
   service_account_id = local.service_account.name

modules/iam-service-account/main.tf

@@ -21,7 +21,7 @@ locals {
     ? google_service_account_key.key["1"]
     : map("", null)
   , {})
-  prefix                = var.prefix != null ? "${var.prefix}-" : ""
+  prefix                = var.prefix == null || var.prefix == "" ? "" : "${var.prefix}-"
   resource_email_static = "${local.prefix}${var.name}@${var.project_id}.iam.gserviceaccount.com"
   resource_iam_email = (
     local.service_account != null
@@ -29,6 +29,7 @@ locals {
     : local.resource_iam_email_static
   )
   resource_iam_email_static = "serviceAccount:${local.resource_email_static}"
+  service_account_id_static = "projects/${var.project_id}/serviceAccounts/${local.resource_email_static}"
   service_account = (
     var.service_account_create
     ? try(google_service_account.service_account.0, null)

modules/iam-service-account/outputs.tf

@@ -32,9 +32,10 @@ output "iam_email" {
 
 output "id" {
   description = "Service account id."
-  value       = local.service_account.id
+  value       = local.service_account_id_static
   depends_on = [
-    local.service_account
+    data.google_service_account.service_account,
+    google_service_account.service_account
   ]
 }
 
@@ -46,7 +47,11 @@ output "key" {
 
 output "name" {
   description = "Service account name."
-  value       = local.service_account.name
+  value       = local.service_account_id_static
+  depends_on = [
+    data.google_service_account.service_account,
+    google_service_account.service_account
+  ]
 }
 
 output "service_account" {

modules/iam-service-account/variables.tf

@@ -39,6 +39,13 @@ variable "iam" {
   nullable    = false
 }
 
+variable "iam_additive" {
+  description = "IAM additive bindings on the service account in {ROLE => [MEMBERS]} format."
+  type        = map(list(string))
+  default     = {}
+  nullable    = false
+}
+
 variable "iam_billing_roles" {
   description = "Billing account roles granted to this service account, by billing account id. Non-authoritative."
   type        = map(list(string))