Added IAM Additive and converted some outputs to static
This commit is contained in:
parent
0d55de6ca9
commit
31bb4476d1
|
@ -17,6 +17,15 @@
|
||||||
# tfdoc:file:description IAM bindings.
|
# tfdoc:file:description IAM bindings.
|
||||||
|
|
||||||
locals {
|
locals {
|
||||||
|
_iam_additive_pairs = flatten([
|
||||||
|
for role, members in var.iam_additive : [
|
||||||
|
for member in members : { role = role, member = member }
|
||||||
|
]
|
||||||
|
])
|
||||||
|
iam_additive = {
|
||||||
|
for pair in local._iam_additive_pairs :
|
||||||
|
"${pair.role}-${pair.member}" => pair
|
||||||
|
}
|
||||||
iam_billing_pairs = flatten([
|
iam_billing_pairs = flatten([
|
||||||
for entity, roles in var.iam_billing_roles : [
|
for entity, roles in var.iam_billing_roles : [
|
||||||
for role in roles : [
|
for role in roles : [
|
||||||
|
@ -61,6 +70,13 @@ locals {
|
||||||
])
|
])
|
||||||
}
|
}
|
||||||
|
|
||||||
|
resource "google_service_account_iam_member" "roles" {
|
||||||
|
for_each = local.iam_additive
|
||||||
|
service_account_id = local.service_account.name
|
||||||
|
role = each.value.role
|
||||||
|
member = each.value.member
|
||||||
|
}
|
||||||
|
|
||||||
resource "google_service_account_iam_binding" "roles" {
|
resource "google_service_account_iam_binding" "roles" {
|
||||||
for_each = var.iam
|
for_each = var.iam
|
||||||
service_account_id = local.service_account.name
|
service_account_id = local.service_account.name
|
||||||
|
|
|
@ -21,7 +21,7 @@ locals {
|
||||||
? google_service_account_key.key["1"]
|
? google_service_account_key.key["1"]
|
||||||
: map("", null)
|
: map("", null)
|
||||||
, {})
|
, {})
|
||||||
prefix = var.prefix != null ? "${var.prefix}-" : ""
|
prefix = var.prefix == null || var.prefix == "" ? "" : "${var.prefix}-"
|
||||||
resource_email_static = "${local.prefix}${var.name}@${var.project_id}.iam.gserviceaccount.com"
|
resource_email_static = "${local.prefix}${var.name}@${var.project_id}.iam.gserviceaccount.com"
|
||||||
resource_iam_email = (
|
resource_iam_email = (
|
||||||
local.service_account != null
|
local.service_account != null
|
||||||
|
@ -29,6 +29,7 @@ locals {
|
||||||
: local.resource_iam_email_static
|
: local.resource_iam_email_static
|
||||||
)
|
)
|
||||||
resource_iam_email_static = "serviceAccount:${local.resource_email_static}"
|
resource_iam_email_static = "serviceAccount:${local.resource_email_static}"
|
||||||
|
service_account_id_static = "projects/${var.project_id}/serviceAccounts/${local.resource_email_static}"
|
||||||
service_account = (
|
service_account = (
|
||||||
var.service_account_create
|
var.service_account_create
|
||||||
? try(google_service_account.service_account.0, null)
|
? try(google_service_account.service_account.0, null)
|
||||||
|
|
|
@ -32,9 +32,10 @@ output "iam_email" {
|
||||||
|
|
||||||
output "id" {
|
output "id" {
|
||||||
description = "Service account id."
|
description = "Service account id."
|
||||||
value = local.service_account.id
|
value = local.service_account_id_static
|
||||||
depends_on = [
|
depends_on = [
|
||||||
local.service_account
|
data.google_service_account.service_account,
|
||||||
|
google_service_account.service_account
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -46,7 +47,11 @@ output "key" {
|
||||||
|
|
||||||
output "name" {
|
output "name" {
|
||||||
description = "Service account name."
|
description = "Service account name."
|
||||||
value = local.service_account.name
|
value = local.service_account_id_static
|
||||||
|
depends_on = [
|
||||||
|
data.google_service_account.service_account,
|
||||||
|
google_service_account.service_account
|
||||||
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
output "service_account" {
|
output "service_account" {
|
||||||
|
|
|
@ -39,6 +39,13 @@ variable "iam" {
|
||||||
nullable = false
|
nullable = false
|
||||||
}
|
}
|
||||||
|
|
||||||
|
variable "iam_additive" {
|
||||||
|
description = "IAM additive bindings on the service account in {ROLE => [MEMBERS]} format."
|
||||||
|
type = map(list(string))
|
||||||
|
default = {}
|
||||||
|
nullable = false
|
||||||
|
}
|
||||||
|
|
||||||
variable "iam_billing_roles" {
|
variable "iam_billing_roles" {
|
||||||
description = "Billing account roles granted to this service account, by billing account id. Non-authoritative."
|
description = "Billing account roles granted to this service account, by billing account id. Non-authoritative."
|
||||||
type = map(list(string))
|
type = map(list(string))
|
||||||
|
|
Loading…
Reference in New Issue