如何使用 Terraform 配置 GCP 发布/订阅死信

Question

我正在尝试使用 Terraform 设置一个非常常规的 Cloud Store -> Pub/Sub -> Cloud Run 流程。

// Service Account 
resource "google_service_account" "example_sa" {
  account_id   = "example-sa"
  display_name = "Cloud Run Pub/Sub Invoker"
}
resource "google_project_iam_binding" "project" {
  project = "example"
  role    = "roles/iam.serviceAccountTokenCreator"
  members = ["serviceAccount:${google_service_account.example_sa.email}"]
}

// Buckets
resource "google_storage_bucket" "example_drop_bucket" {
  name          = "example-drop"
  location      = "EU"
  force_destroy = true
  uniform_bucket_level_access = true
}

// Cloud Storage Topics
resource "google_pubsub_topic" "example_drop_topic" {
  name = "example-drop"
}
resource "google_pubsub_topic_iam_binding" "example_drop_topic_binding" {
  topic   = google_pubsub_topic.example_drop_topic.id
  role    = "roles/pubsub.publisher"
  members = ["serviceAccount:${google_service_account.example_sa.email}"]
}
resource "google_pubsub_topic" "example_parse_fail" {
  name = "example-parse-fail"
}
resource "google_pubsub_topic_iam_binding" "example_parse_fail_binding" {
  topic   = google_pubsub_topic.example_parse_fail.id
  role    = "roles/pubsub.publisher"
  members = ["serviceAccount:${google_service_account.example_sa.email}"]
}

// Cloud Storage Notification
resource "google_storage_notification" "notification" {
  bucket         = google_storage_bucket.example_drop_bucket.name
  payload_format = "JSON_API_V1"
  topic          = google_pubsub_topic.example_drop_topic.id
  event_types    = ["OBJECT_FINALIZE", "OBJECT_METADATA_UPDATE"]
}

// Set up the parser job
resource "google_cloud_run_service" "example_parser" {
  //...
}
resource "google_cloud_run_service_iam_binding" "binding" {
  //...
}

// Subscribe
resource "google_pubsub_subscription" "example_drop_bucket_subscription" {
  name  = "example-drop"
  topic = google_pubsub_topic.example_drop_topic.name

  dead_letter_policy {
    dead_letter_topic     = google_pubsub_topic.example_parse_fail.id
    max_delivery_attempts = 10
  }
}

但是，当我访问订阅的 GCP 控制台页面时，我看到：

如何获取“Cloud Pub/Sub Service Account”并分配发布者角色？ 或者这有关系吗？

Answer 1

尝试将这些角色赋予此服务帐户：service-{PROJECT-NUMBER}@gcp-sa-pubsub.iam.gserviceaccount.com