如何使用 Terraform 将多个角色分配给 GCP 中的多个服务帐户？

Question

我有一个将要创建的服务帐户列表，并为它们分配角色我正在使用Google 提供的模块，我的代码如下：

module "service-accounts" {
  source  = "terraform-google-modules/service-accounts/google"
  version = "4.1.1"

  project_id = var.project
  names = var.sa_list
  project_roles = [
    "${var.project}=>roles/appengine.appAdmin",
    "${var.project}=>roles/artifactregistry.reader",
    "${var.project}=>roles/cloudbuild.builds.builder",
    "${var.project}=>roles/cloudsql.client",
    "${var.project}=>roles/cloudsql.instanceUser"
  ]

  display_name = "Google App Engine SA - Managed by Terraform"
} 

这很好用。 但我不想让project_roles中的角色明确化，所以我尝试使用for_each元参数”

变量.tf ：

variable "rolesList" {
  type =list(string)
  default = ["roles/appengine.appAdmin","roles/artifactregistry.reader", "roles/cloudbuild.builds.builder", "roles/cloudsql.client", "roles/cloudsql.instanceUser"]
}

主.tf ：

module "service-accounts" {
  source  = "terraform-google-modules/service-accounts/google"
  version = "4.1.1"

  project_id = var.project
  names = var.sa_list

  for_each = (toset[var.rolesList])
  project_roles = ["${var.project}=>${each.key}"]

  display_name = "Google App Engine SA - Managed by Terraform"
} 

这种方式行不通，因为 Terraform 将创建多个具有相同 ID 的帐户。 如何从project_roles中删除硬代码？ 有没有办法将角色存储在其他地方然后调用它们？ 或者我需要单独分配角色？

Answer 1

所以，我设法通过改变来修复问题

variable "rolesList" {
  type =list(string)
  default = ["roles/appengine.appAdmin","roles/artifactregistry.reader", 
             "roles/cloudbuild.builds.builder", "roles/cloudsql.client", 
             "roles/cloudsql.instanceUser"]
     }

到

 variable "rolesList" {
      type =setstring)
      default = ["roles/appengine.appAdmin","roles/artifactregistry.reader", 
                 "roles/cloudbuild.builds.builder", "roles/cloudsql.client", 
                 "roles/cloudsql.instanceUser"]
         }

并删除for_each以支持

module "service-accounts" {
  source  = "terraform-google-modules/service-accounts/google"
  version = "4.1.1"

  project_id = var.project
  names = var.sa_list
  project_roles = [ for role in var.rolesList : "${var.project}=>${role}" ]

  display_name = "Google App Engine SA - Managed by Terraform"
} 

Answer 2

如果您想为多个服务帐户赋予多个角色，您可以尝试使用 Google 官方提供商提供的资源：

• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account
• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam

首先，将您要创建的服务帐户放入配置文件中，例如 JSON 文件，以便在修改时更加灵活。 您将更改配置文件，而不是 Terraform 代码：

{
  "servicesAccount": {
    "first-service-account": {
      "account_id": "first-service-account",
      "display_name": "First SA managed by Terraform",
  "roles": [
        "roles/appengine.appAdmin",
        "roles/artifactregistry.reader",
        "roles/cloudbuild.builds.builder",
        "roles/cloudsql.client",
        "roles/cloudsql.instanceUser"
      ]
    },
    "second-service-account": {
      "account_id": "second-service-account",
      "display_name": "Second SA managed by Terraform",
  "roles": [
        "roles/appengine.appAdmin",
        "roles/artifactregistry.reader",
        "roles/cloudbuild.builds.builder",
        "roles/cloudsql.client",
        "roles/cloudsql.instanceUser"
      ]
    }
  }
}

然后你可以解析这个 JSON 文件并放入一个局部变量：

locals {
  services_account = jsondecode(file("${path.module}/path/to/your/file.json"))["servicesAccount"]
  sa_flattened = flatten([
    for sa in local.services_account : [
      for role in sa["roles"] : {
        account_id   = sa["account_id"]
        display_name = sa["display_name"]
        role         = role
      }
    ]
  ])
}

最后，您可以创建 SA，然后给他们相关的角色：

resource "google_service_account" "sa_names" {
  project      = var.project
  for_each     = local.services_account
  account_id   = each.value["account_id"]
  display_name = each.value["display_name"]
}

resource "google_project_iam_member" "sa_roles" {
  depends_on = [google_service_account.sa_names]
  for_each   = {for idx, sa in local.sa_flattened: "${sa["account_id"]}_${sa["role"]}" => sa}
  project    = var.project
  role       = each.value["role"]
  member     = "serviceAccount:${each.value["account_id"]}@${var.project}.iam.gserviceaccount.com"
}