New resource: google_cloud_build_default_service_account

[akkornel]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

The Google Cloud Terraform provider has resources that allow someone to programmatically look up the default service account information for App Engine, BigQuery, and Compute Engine. I am requesting the same for Cloud Build.

New or Affected Resource(s)

• google_cloud_build_default_service_account

Potential Terraform Configuration

In this example, I have a service account used to run Packer. The Packer service account has a number of fine-grained IAM policy bindings, giving it access to roles/compute.instanceAdmin.v1 with conditions, so that it can only touch the VMs it creates.

Today, I use this service account by downloading a key (as a JSON file), and giving that to Packer (using the GOOGLE_APPLICATION_CREDENTIALS environment variable).

I would like to migrate to Cloud Build. Instead of duplicating all of the IAM policy bindings on to the Cloud Build default service account, I would instead like to have Cloud Build act as the Packer service account. To do that, I need to know the email address of the Cloud Build default service account.

# `provider "google" {…}` has already been configured elsewhere.

data "google_project" "project" {
}

data "google_compute_default_service_account" "default" {
}

data "google_cloud_build_default_service_account" "default" {
}

# Create a service account for Packer
resource "google_service_account" "packer" {
  account_id = "packer"
  display_name = "Packer service account"
  description = "Used for Packer to build Globus images."
}

# Grant fine-grained access to Compute Engine 
resource "google_project_iam_member" "packer-compute-instanceadmin" {
  project = data.google_project.project.project_id
  role = "roles/compute.instanceAdmin.v1"
  member = "serviceAccount:${google_service_account.packer.email}"
  condition {
    title = "Packer may manage instances prefixed with packer"
    description = "Packer needs to create & destroy instances in order to build new images."
    expression = <<EOT
resource.name.startsWith("projects/${data.google_project.project.project_id}/zones/${var.zone}/instances/packer")
EOT
  }
}

… more fine-grained rules go here …

# Allow Cloud Build to use the Packer service account
resource "google_service_account_iam_member" "cloudbuild-packer-access" {
  service_account_id = google_service_account.packer.name
  role = "roles/iam.serviceAccountUser"
  member = "serviceAccount:${data.google_cloud_build_default_service_account.default.email}"
}

[upodroid]

Hi

Have a look at https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_service_identity.

Cloud Build supports Service Identities.

[rileykarson]

The service identity resource @upodroid pointed out is the correct way to retrieve this account.

[akkornel]

That's awesome, thanks both! That looks good; I'll keep a watch on it, and push it into production as soon as it leaves beta.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.