feat: Grant pull subscription permissions for external service account (

#68)
terraform-google-modules · Apr 7, 2021 · 6cd0fc4 · 6cd0fc4
1 parent b07ab12
commit 6cd0fc4
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -46,6 +46,7 @@ module "pubsub" {
       minimum_backoff         = "300s"                                               // optional
       filter                  = "attributes.domain = \"com\""                        // optional
       enable_message_ordering = true                                                 // optional
+      service_account         = "service2@project2.iam.gserviceaccount.com"          // optional
     }
   ]
 }

diff --git a/main.tf b/main.tf
@@ -234,3 +234,27 @@ resource "google_pubsub_subscription" "pull_subscriptions" {
     google_pubsub_topic.topic,
   ]
 }
+
+resource "google_pubsub_subscription_iam_member" "pull_subscription_sa_binding_subscriber" {
+  for_each = var.create_topic ? { for i in var.pull_subscriptions : i.name => i if lookup(i, "service_account", null) != null } : {}
+
+  project      = var.project_id
+  subscription = each.value.name
+  role         = "roles/pubsub.subscriber"
+  member       = "serviceAccount:${each.value.service_account}"
+  depends_on = [
+    google_pubsub_subscription.pull_subscriptions,
+  ]
+}
+
+resource "google_pubsub_subscription_iam_member" "pull_subscription_sa_binding_viewer" {
+  for_each = var.create_topic ? { for i in var.pull_subscriptions : i.name => i if lookup(i, "service_account", null) != null } : {}
+
+  project      = var.project_id
+  subscription = each.value.name
+  role         = "roles/pubsub.viewer"
+  member       = "serviceAccount:${each.value.service_account}"
+  depends_on = [
+    google_pubsub_subscription.pull_subscriptions,
+  ]
+}