Clean up IAM roles: 5-projects stage needs KMS permissions to create …

…a keyring in environment-wide org projects. Also remove some leftover references to KMS in cai-monitoring

0-bootstrap/main.tf

@@ -60,7 +60,6 @@ module "seed_bootstrap" {
   project_prefix                 = var.project_prefix
   encrypt_gcs_bucket_tfstate     = true
   key_rotation_period            = "7776000s"
-  kms_prevent_destroy            = !var.bucket_tfstate_kms_force_destroy
 
   project_labels = {
     environment       = "bootstrap"

0-bootstrap/sa.tf

@@ -62,6 +62,7 @@ locals {
       "roles/accesscontextmanager.policyAdmin",
       "roles/resourcemanager.organizationAdmin",
       "roles/serviceusage.serviceUsageConsumer",
+      "roles/cloudkms.admin",
     ], local.common_roles)),
   }
 

1-org/modules/cai-monitoring/iam.tf

@@ -46,15 +46,6 @@ data "google_storage_project_service_account" "gcs_sa" {
   project = var.project_id
 }
 
-// Encrypter/Decrypter role
-resource "google_kms_crypto_key_iam_member" "encrypter_decrypter" {
-  for_each = var.enable_cmek ? local.identities : {}
-
-  crypto_key_id = var.encryption_key
-  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
-  member        = each.value
-}
-
 // Cloud Function SA
 resource "google_service_account" "cloudfunction" {
   account_id                   = "cai-monitoring"
@@ -80,7 +71,6 @@ resource "google_project_iam_member" "cloudfunction_iam" {
 resource "time_sleep" "wait_kms_iam" {
   create_duration = "60s"
   depends_on = [
-    google_kms_crypto_key_iam_member.encrypter_decrypter,
     google_organization_iam_member.cloudfunction_findings_editor,
     google_project_iam_member.cloudfunction_iam
   ]