@@ -22,18 +22,47 @@ data "google_project" "service_project" {
22
22
locals {
23
23
service_project_number = var. lookup_project_numbers ? data. google_project . service_project [0 ]. number : var. service_project_number
24
24
apis = {
25
- " container.googleapis.com" : format (" service-%s@container-engine-robot.iam.gserviceaccount.com" , local. service_project_number ),
26
- " dataproc.googleapis.com" : format (" service-%s@dataproc-accounts.iam.gserviceaccount.com" , local. service_project_number ),
27
- " dataflow.googleapis.com" : format (" service-%s@dataflow-service-producer-prod.iam.gserviceaccount.com" , local. service_project_number ),
28
- " composer.googleapis.com" : format (" service-%s@cloudcomposer-accounts.iam.gserviceaccount.com" , local. service_project_number )
29
- " vpcaccess.googleapis.com" : format (" service-%s@gcp-sa-vpcaccess.iam.gserviceaccount.com" , local. service_project_number )
30
- " datastream.googleapis.com" : format (" service-%s@gcp-sa-datastream.iam.gserviceaccount.com" , local. service_project_number )
31
- " notebooks.googleapis.com" : format (" service-%s@gcp-sa-notebooks.iam.gserviceaccount.com" , local. service_project_number )
32
- " networkconnectivity.googleapis.com" : format (" service-%s@gcp-sa-networkconnectivity.iam.gserviceaccount.com" , local. service_project_number )
25
+ " container.googleapis.com" : {
26
+ service_account = format (" service-%s@container-engine-robot.iam.gserviceaccount.com" , local. service_project_number )
27
+ role = " roles/compute.networkUser"
28
+ }
29
+ " dataproc.googleapis.com" : {
30
+ service_account = format (" service-%s@dataproc-accounts.iam.gserviceaccount.com" , local. service_project_number )
31
+ role = " roles/compute.networkUser"
32
+ },
33
+ " dataflow.googleapis.com" : {
34
+ service_account = format (" service-%s@dataflow-service-producer-prod.iam.gserviceaccount.com" , local. service_project_number )
35
+ role = " roles/compute.networkUser"
36
+ },
37
+ " datafusion.googleapis.com" : {
38
+ service_account = format (" service-%s@gcp-sa-datafusion.iam.gserviceaccount.com" , local. service_project_number )
39
+ role = " roles/compute.networkViewer"
40
+ },
41
+ " composer.googleapis.com" : {
42
+ service_account = format (" service-%s@cloudcomposer-accounts.iam.gserviceaccount.com" , local. service_project_number )
43
+ role = " roles/compute.networkUser"
44
+ }
45
+ " vpcaccess.googleapis.com" : {
46
+ service_account = format (" service-%s@gcp-sa-vpcaccess.iam.gserviceaccount.com" , local. service_project_number )
47
+ role = " roles/compute.networkUser"
48
+ }
49
+ " datastream.googleapis.com" : {
50
+ service_account = format (" service-%s@gcp-sa-datastream.iam.gserviceaccount.com" , local. service_project_number )
51
+ role = " roles/compute.networkUser"
52
+ }
53
+ " notebooks.googleapis.com" : {
54
+ service_account = format (" service-%s@gcp-sa-notebooks.iam.gserviceaccount.com" , local. service_project_number )
55
+ role = " roles/compute.networkUser"
56
+ }
57
+ " networkconnectivity.googleapis.com" : {
58
+ service_account = format (" service-%s@gcp-sa-networkconnectivity.iam.gserviceaccount.com" , local. service_project_number )
59
+ role = " roles/compute.networkUser"
60
+ }
33
61
}
34
62
gke_shared_vpc_enabled = contains (var. active_apis , " container.googleapis.com" )
35
63
composer_shared_vpc_enabled = contains (var. active_apis , " composer.googleapis.com" )
36
64
datastream_shared_vpc_enabled = contains (var. active_apis , " datastream.googleapis.com" )
65
+ datafusion_shared_vpc_enabled = contains (var. active_apis , " datafusion.googleapis.com" )
37
66
active_apis = [for api in keys (local. apis ) : api if contains (var. active_apis , api)]
38
67
# Can't use setproduct due to https://github.com/terraform-google-modules/terraform-google-project-factory/issues/635
39
68
subnetwork_api = length (var. shared_vpc_subnets ) != 0 ? flatten ([
@@ -44,7 +73,8 @@ locals {
44
73
/* *****************************************
45
74
if "container.googleapis.com" compute.networkUser role granted to GKE service account for GKE on shared VPC subnets
46
75
if "dataproc.googleapis.com" compute.networkUser role granted to dataproc service account for dataproc on shared VPC subnets
47
- if "dataflow.googleapis.com" compute.networkUser role granted to dataflow service account for Dataflow on shared VPC subnets
76
+ if "dataflow.googleapis.com" compute.networkUser role granted to dataflow service account for Dataflow on shared VPC subnets
77
+ if "datafusion.googleapis.com" compute.networkViewer role granted to datafusion service account for Data Fusion on shared VPC subnets
48
78
if "composer.googleapis.com" compute.networkUser role granted to composer service account for Composer on shared VPC subnets
49
79
if "notebooks.googleapis.com" compute.networkUser role granted to notebooks service account for Notebooks on shared VPC Project
50
80
if "networkconnectivity.googleapis.com" compute.networkUser role granted to notebooks service account for Network Connectivity on shared VPC Project
@@ -65,13 +95,13 @@ resource "google_compute_subnetwork_iam_member" "service_shared_vpc_subnet_users
65
95
" subnetworks" ,
66
96
) + 1 ,
67
97
)
68
- role = " roles/compute.networkUser "
98
+ role = local . apis [ split ( " , " , local . subnetwork_api [ count . index ])[ 0 ]] . role
69
99
region = element (
70
100
split (" /" , split (" ," , local. subnetwork_api [count . index ])[1 ]),
71
101
index (split (" /" , split (" ," , local. subnetwork_api [count . index ])[1 ]), " regions" ) + 1 ,
72
102
)
73
103
project = var. host_project_id
74
- member = format (" serviceAccount:%s" , local. apis [split (" ," , local. subnetwork_api [count . index ])[0 ]])
104
+ member = format (" serviceAccount:%s" , local. apis [split (" ," , local. subnetwork_api [count . index ])[0 ]]. service_account )
75
105
}
76
106
77
107
/* *****************************************
@@ -101,15 +131,16 @@ resource "google_compute_subnetwork_iam_member" "cloudservices_shared_vpc_subnet
101
131
if "container.googleapis.com" compute.networkUser role granted to GKE service account for GKE on shared VPC Project if no subnets defined
102
132
if "dataproc.googleapis.com" compute.networkUser role granted to dataproc service account for Dataproc on shared VPC Project if no subnets defined
103
133
if "dataflow.googleapis.com" compute.networkUser role granted to dataflow service account for Dataflow on shared VPC Project if no subnets defined
134
+ if "datafusion.googleapis.com" compute.networkViewer role granted to data fusion service account for Data Fusion on shared VPC Project if no subnets defined
104
135
if "composer.googleapis.com" compute.networkUser role granted to composer service account for Composer on shared VPC Project if no subnets defined
105
136
if "notebooks.googleapis.com" compute.networkUser role granted to notebooks service account for Notebooks on shared VPC Project if no subnets defined
106
137
if "networkconnectivity.googleapis.com" compute.networkUser role granted to notebooks service account for Notebooks on shared VPC Project if no subnets defined
107
138
*****************************************/
108
139
resource "google_project_iam_member" "service_shared_vpc_user" {
109
140
for_each = (length (var. shared_vpc_subnets ) == 0 ) && var. enable_shared_vpc_service_project && var. grant_network_role ? toset (local. active_apis ) : []
110
141
project = var. host_project_id
111
- role = " roles/compute.networkUser "
112
- member = format (" serviceAccount:%s" , local. apis [each . value ])
142
+ role = local . apis [ each . value ] . role
143
+ member = format (" serviceAccount:%s" , local. apis [each . value ]. service_account )
113
144
}
114
145
115
146
/* *****************************************
@@ -120,7 +151,7 @@ resource "google_project_iam_member" "composer_host_agent" {
120
151
count = local. composer_shared_vpc_enabled && var. enable_shared_vpc_service_project && var. grant_network_role ? 1 : 0
121
152
project = var. host_project_id
122
153
role = " roles/composer.sharedVpcAgent"
123
- member = format (" serviceAccount:%s" , local. apis [" composer.googleapis.com" ])
154
+ member = format (" serviceAccount:%s" , local. apis [" composer.googleapis.com" ]. service_account )
124
155
}
125
156
126
157
/* *****************************************
@@ -131,7 +162,7 @@ resource "google_project_iam_member" "gke_host_agent" {
131
162
count = local. gke_shared_vpc_enabled && var. enable_shared_vpc_service_project && var. grant_network_role ? 1 : 0
132
163
project = var. host_project_id
133
164
role = " roles/container.hostServiceAgentUser"
134
- member = format (" serviceAccount:%s" , local. apis [" container.googleapis.com" ])
165
+ member = format (" serviceAccount:%s" , local. apis [" container.googleapis.com" ]. service_account )
135
166
}
136
167
137
168
/* *****************************************
@@ -143,7 +174,7 @@ resource "google_project_iam_member" "gke_security_admin" {
143
174
count = local. gke_shared_vpc_enabled && var. enable_shared_vpc_service_project && var. grant_services_security_admin_role ? 1 : 0
144
175
project = var. host_project_id
145
176
role = " roles/compute.securityAdmin"
146
- member = format (" serviceAccount:%s" , local. apis [" container.googleapis.com" ])
177
+ member = format (" serviceAccount:%s" , local. apis [" container.googleapis.com" ]. service_account )
147
178
}
148
179
149
180
/* *****************************************
@@ -155,5 +186,16 @@ resource "google_project_iam_member" "datastream_network_admin" {
155
186
count = local. datastream_shared_vpc_enabled && var. enable_shared_vpc_service_project && var. grant_services_network_admin_role ? 1 : 0
156
187
project = var. host_project_id
157
188
role = " roles/compute.networkAdmin"
158
- member = format (" serviceAccount:%s" , local. apis [" datastream.googleapis.com" ])
189
+ member = format (" serviceAccount:%s" , local. apis [" datastream.googleapis.com" ]. service_account )
190
+ }
191
+
192
+ /* *****************************************
193
+ roles/compute.networkViewer role granted to Data Fusion's service account on shared VPC host project
194
+ Service Account: service-[project_number]@gcp-sa-datafusion.iam.gserviceaccount.com
195
+ *****************************************/
196
+ resource "google_project_iam_member" "datasfusion_network_viewer" {
197
+ count = local. datafusion_shared_vpc_enabled && var. enable_shared_vpc_service_project && var. grant_network_role ? 1 : 0
198
+ project = var. host_project_id
199
+ role = " roles/compute.networkViewer"
200
+ member = format (" serviceAccount:%s" , local. apis [" datafusion.googleapis.com" ]. service_account )
159
201
}
0 commit comments