fixups

modules/gcp-sink-sa/README.md

@@ -21,4 +21,8 @@ module "gcp-sink-sa" {
     destination_name                = "<GCS BUCKET NAME OR PUBSUB TOPIC NAME>"
     temporal_service_account_emails = "<[...,...]>"
 }
-```
+```
+
+NOTES:
+
+- for a pubsub `destination_name` use the name and not the full URN.

modules/gcp-sink-sa/main.tf

@@ -1,6 +1,6 @@
 locals {
-  sa_email    = tolist(var.temporal_service_account_emails)[0]
-  is_export   = length(regexall("export-.*", local.sa_email)) > 0
+  sa_email  = tolist(var.temporal_service_account_emails)[0]
+  is_export = length(regexall("export-.*", local.sa_email)) > 0
 
 }
 
@@ -25,9 +25,10 @@ resource "google_storage_bucket_iam_member" "service_account_bucket_access" {
 }
 
 resource "google_pubsub_topic_iam_member" "service_account_pubsub_access" {
-  role   = "roles/pubsub.publisher"
-  topic  = var.destination_name
-  member = "serviceAccount:${google_service_account.gcp_sink_sa.email}"
+  project = var.gcp_project_id
+  role    = "roles/pubsub.publisher"
+  topic   = var.destination_name
+  member  = "serviceAccount:${google_service_account.gcp_sink_sa.email}"
 }
 
 resource "google_service_account_iam_member" "service_account_token_creator_role" {

modules/gcp-sink-sa/outputs.tf

@@ -0,0 +1,4 @@
+output "sink_service_account_email" {
+  description = "The Google service account used by temporalio cloud"
+  value       = google_service_account.gcp_sink_sa.email
+}

modules/gcp-sink-sa/versions.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = "~> 4.0"
+      version = "~> 6.24.0"
     }
   }
-}
+}