Added IAM Additive and converted some outputs to static
This commit is contained in:
parent
0d55de6ca9
commit
31bb4476d1
|
@ -17,6 +17,15 @@
|
|||
# tfdoc:file:description IAM bindings.
|
||||
|
||||
locals {
|
||||
_iam_additive_pairs = flatten([
|
||||
for role, members in var.iam_additive : [
|
||||
for member in members : { role = role, member = member }
|
||||
]
|
||||
])
|
||||
iam_additive = {
|
||||
for pair in local._iam_additive_pairs :
|
||||
"${pair.role}-${pair.member}" => pair
|
||||
}
|
||||
iam_billing_pairs = flatten([
|
||||
for entity, roles in var.iam_billing_roles : [
|
||||
for role in roles : [
|
||||
|
@ -61,6 +70,13 @@ locals {
|
|||
])
|
||||
}
|
||||
|
||||
resource "google_service_account_iam_member" "roles" {
|
||||
for_each = local.iam_additive
|
||||
service_account_id = local.service_account.name
|
||||
role = each.value.role
|
||||
member = each.value.member
|
||||
}
|
||||
|
||||
resource "google_service_account_iam_binding" "roles" {
|
||||
for_each = var.iam
|
||||
service_account_id = local.service_account.name
|
||||
|
|
|
@ -21,7 +21,7 @@ locals {
|
|||
? google_service_account_key.key["1"]
|
||||
: map("", null)
|
||||
, {})
|
||||
prefix = var.prefix != null ? "${var.prefix}-" : ""
|
||||
prefix = var.prefix == null || var.prefix == "" ? "" : "${var.prefix}-"
|
||||
resource_email_static = "${local.prefix}${var.name}@${var.project_id}.iam.gserviceaccount.com"
|
||||
resource_iam_email = (
|
||||
local.service_account != null
|
||||
|
@ -29,6 +29,7 @@ locals {
|
|||
: local.resource_iam_email_static
|
||||
)
|
||||
resource_iam_email_static = "serviceAccount:${local.resource_email_static}"
|
||||
service_account_id_static = "projects/${var.project_id}/serviceAccounts/${local.resource_email_static}"
|
||||
service_account = (
|
||||
var.service_account_create
|
||||
? try(google_service_account.service_account.0, null)
|
||||
|
|
|
@ -32,9 +32,10 @@ output "iam_email" {
|
|||
|
||||
output "id" {
|
||||
description = "Service account id."
|
||||
value = local.service_account.id
|
||||
value = local.service_account_id_static
|
||||
depends_on = [
|
||||
local.service_account
|
||||
data.google_service_account.service_account,
|
||||
google_service_account.service_account
|
||||
]
|
||||
}
|
||||
|
||||
|
@ -46,7 +47,11 @@ output "key" {
|
|||
|
||||
output "name" {
|
||||
description = "Service account name."
|
||||
value = local.service_account.name
|
||||
value = local.service_account_id_static
|
||||
depends_on = [
|
||||
data.google_service_account.service_account,
|
||||
google_service_account.service_account
|
||||
]
|
||||
}
|
||||
|
||||
output "service_account" {
|
||||
|
|
|
@ -39,6 +39,13 @@ variable "iam" {
|
|||
nullable = false
|
||||
}
|
||||
|
||||
variable "iam_additive" {
|
||||
description = "IAM additive bindings on the service account in {ROLE => [MEMBERS]} format."
|
||||
type = map(list(string))
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "iam_billing_roles" {
|
||||
description = "Billing account roles granted to this service account, by billing account id. Non-authoritative."
|
||||
type = map(list(string))
|
||||
|
|
Loading…
Reference in New Issue