feat: Grant pull subscription permissions for external service account (

#68)

README.md

@@ -46,6 +46,7 @@ module "pubsub" {
       minimum_backoff         = "300s"                                               // optional
       filter                  = "attributes.domain = \"com\""                        // optional
       enable_message_ordering = true                                                 // optional
+      service_account         = "[email protected]"          // optional
     }
   ]
 }

main.tf

@@ -234,3 +234,27 @@ resource "google_pubsub_subscription" "pull_subscriptions" {
     google_pubsub_topic.topic,
   ]
 }
+
+resource "google_pubsub_subscription_iam_member" "pull_subscription_sa_binding_subscriber" {
+  for_each = var.create_topic ? { for i in var.pull_subscriptions : i.name => i if lookup(i, "service_account", null) != null } : {}
+
+  project      = var.project_id
+  subscription = each.value.name
+  role         = "roles/pubsub.subscriber"
+  member       = "serviceAccount:${each.value.service_account}"
+  depends_on = [
+    google_pubsub_subscription.pull_subscriptions,
+  ]
+}
+
+resource "google_pubsub_subscription_iam_member" "pull_subscription_sa_binding_viewer" {
+  for_each = var.create_topic ? { for i in var.pull_subscriptions : i.name => i if lookup(i, "service_account", null) != null } : {}
+
+  project      = var.project_id
+  subscription = each.value.name
+  role         = "roles/pubsub.viewer"
+  member       = "serviceAccount:${each.value.service_account}"
+  depends_on = [
+    google_pubsub_subscription.pull_subscriptions,
+  ]
+}