From 4e67fd50160519925c741a58835be95cdbf025bb Mon Sep 17 00:00:00 2001 From: Greg Lee Coleman Date: Mon, 7 Apr 2025 14:01:25 -0700 Subject: [PATCH 1/4] add outputs for service account email --- modules/gcp-sink-sa/outputs.tf | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 modules/gcp-sink-sa/outputs.tf diff --git a/modules/gcp-sink-sa/outputs.tf b/modules/gcp-sink-sa/outputs.tf new file mode 100644 index 0000000..82954b3 --- /dev/null +++ b/modules/gcp-sink-sa/outputs.tf @@ -0,0 +1,4 @@ +output "sink_service_account_email" { + description = "The Google service account used by temporalio cloud" + value = google_service_account.gcp_sink_sa.email +} From b2c19d7f3402ff46c1dd8116810dfd375748c960 Mon Sep 17 00:00:00 2001 From: Greg Lee Coleman Date: Mon, 7 Apr 2025 14:01:41 -0700 Subject: [PATCH 2/4] bump google provider version to latest --- modules/gcp-sink-sa/versions.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/gcp-sink-sa/versions.tf b/modules/gcp-sink-sa/versions.tf index 8a1d880..b1e5831 100644 --- a/modules/gcp-sink-sa/versions.tf +++ b/modules/gcp-sink-sa/versions.tf @@ -2,7 +2,7 @@ terraform { required_providers { google = { source = "hashicorp/google" - version = "~> 4.0" + version = "~> 6.24.0" } } -} \ No newline at end of file +} From b579d93cb8a50d3785a696d69c51fa33feb3c355 Mon Sep 17 00:00:00 2001 From: Greg Lee Coleman Date: Mon, 7 Apr 2025 14:02:12 -0700 Subject: [PATCH 3/4] add project to pubsub iam; lint --- modules/gcp-sink-sa/main.tf | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/gcp-sink-sa/main.tf b/modules/gcp-sink-sa/main.tf index ba7890a..4fe6546 100644 --- a/modules/gcp-sink-sa/main.tf +++ b/modules/gcp-sink-sa/main.tf @@ -1,6 +1,6 @@ locals { - sa_email = tolist(var.temporal_service_account_emails)[0] - is_export = length(regexall("export-.*", local.sa_email)) > 0 + sa_email = tolist(var.temporal_service_account_emails)[0] + is_export = length(regexall("export-.*", local.sa_email)) > 0 } @@ -25,9 +25,10 @@ resource "google_storage_bucket_iam_member" "service_account_bucket_access" { } resource "google_pubsub_topic_iam_member" "service_account_pubsub_access" { - role = "roles/pubsub.publisher" - topic = var.destination_name - member = "serviceAccount:${google_service_account.gcp_sink_sa.email}" + project = var.gcp_project_id + role = "roles/pubsub.publisher" + topic = var.destination_name + member = "serviceAccount:${google_service_account.gcp_sink_sa.email}" } resource "google_service_account_iam_member" "service_account_token_creator_role" { From 1bbe8e34b3dc6be2e0811d02adb677b5a10f2fdc Mon Sep 17 00:00:00 2001 From: Greg Lee Coleman Date: Mon, 7 Apr 2025 14:03:13 -0700 Subject: [PATCH 4/4] add note on pubsub var usage --- modules/gcp-sink-sa/README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/gcp-sink-sa/README.md b/modules/gcp-sink-sa/README.md index 007e87f..a9d6f09 100644 --- a/modules/gcp-sink-sa/README.md +++ b/modules/gcp-sink-sa/README.md @@ -21,4 +21,8 @@ module "gcp-sink-sa" { destination_name = "" temporal_service_account_emails = "<[...,...]>" } -``` \ No newline at end of file +``` + +NOTES: + +- for a pubsub `destination_name` use the name and not the full URN.