feat: Add token creator binding for service account (#37)

terraform-google-modules · Nov 12, 2020 · 112607c · 112607c
1 parent 4972a25
commit 112607c
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/main.tf b/main.tf
@@ -23,6 +23,15 @@ locals {
   pubsub_svc_account_email     = "service-${data.google_project.project.number}@gcp-sa-pubsub.iam.gserviceaccount.com"
 }
 
+resource "google_project_iam_member" "token_creator_binding" {
+  project = var.project_id
+  role    = "roles/iam.serviceAccountTokenCreator"
+  member  = "serviceAccount:${local.pubsub_svc_account_email}"
+  depends_on = [
+    google_pubsub_subscription.push_subscriptions,
+  ]
+}
+
 resource "google_pubsub_topic_iam_member" "push_topic_binding" {
   count   = var.create_topic ? length(var.push_subscriptions) : 0
   project = var.project_id

diff --git a/test/setup/iam.tf b/test/setup/iam.tf
@@ -17,7 +17,8 @@
 locals {
   int_required_roles = [
     "roles/cloudiot.admin",
-    "roles/pubsub.admin"
+    "roles/pubsub.admin",
+    "roles/resourcemanager.projectIamAdmin"
   ]
 }