使用 terraform 将 IAM 策略分配给 Google 云中的现有 Cloud Build 服务帐户失败

Question

I am trying to assign a IAM policy document to an existing Cloud Build Service Account, but its failing for some reason. following is my iam policy

data "google_iam_policy" "vulznotepolicy" {
binding {
  role = "roles/containeranalysis.notes.occurrences.viewer"

  members = [
  "serviceaccount:<project_number>@cloudbuild.gserviceaccount.com"
  ]
 }
}

following is policy assignment to Service account

resource "google_service_account_iam_policy" "buildsa" {
service_account_id = "serviceaccount:<project_number>@cloudbuild.gserviceaccount.com"
policy_data        = data.google_iam_policy.vulznotepolicy.policy_data
}

service account id doesn't accept the format that i have provided. I have given just the <project_number> still it doesn't accept. Not sure what the issue is

Answer 1

As suggested rightly by John, i added the roles to the service account using the following

resource "google_project_iam_policy" "buildsa" {
project = var.project_id
policy_data        = data.google_iam_policy.vulznotepolicy.policy_data
}

Although this works but can cause serious problems as follows. Please proceed with caution

Since this is an authoritative operation, it will lock you out of your account if the operations are not carefully managed. This is from terraform "It's not recommended to use google_project_iam_policy with your provider project to avoid locking yourself out, and it should generally only be used with projects fully managed by Terraform. If you do use this resource, it is recommended to import the policy before applying the change."

Answer 2

I can see that you're trying to give the Cloud Build Service account some IAM permissions using Terraform.

I would start by reading this document about IAM Roles on Cloud Build [1], then you can check how the Cloud Build Service Account behaves [2], and then how to configure it [3].

Since you're using Terraform, I would also have a look here [4].

These can help you understand why you're running into this issue, as pointed out in a comment.

---

[1]https://cloud.google.com/cloud-build/docs/iam-roles-permissions

[2] https://cloud.google.com/cloud-build/docs/cloud-build-service-account

[3] https://cloud.google.com/cloud-build/docs/securing-builds/configure-access-for-cloud-build-service-account#before_you_begin

[4] https://www.terraform.io/docs/providers/google/r/google_service_account_iam.html