feat: Add iam-bindings to the default pub/sub service account

[anakovt]

This PR adds IAM bindings that will grant Pub/Sub permission to publish messages to the dead-letter topic (publisher role), and acknowledge forwarded messages from the subscription(subscriber role).

terraform DOCS ref:

The Cloud Pub/Sub service\naccount associated with the enclosing subscription's parent project (i.e., service-{project_number}@gcp-sa-pubsub.iam.gserviceaccount.com) must have permission to Publish() to this topic.

[anakovt]

@morgante Hello 👋 Can you please review this one as well? This is an addition to the previous PR that has been merged.

[morgante]

Unfortunately this change isn't applying. Please get tests passing.

Error:

       Error: Error retrieving IAM policy for pubsub topic "projects/ci-int-pubsub-4b41/topics/cft-ci-iot-registry-event-topic": googleapi: Error 404: Resource not found (resource=cft-ci-iot-registry-event-topic).
       
         on ../../../main.tf line 36, in resource "google_pubsub_topic_iam_binding" "pull_topic_binding":
         36: resource "google_pubsub_topic_iam_binding" "pull_topic_binding" {

[anakovt]

@morgante can you please take a look?

       module.example.module.pubsub.data.google_project.project: Refreshing state...
       module.example.module.pubsub.google_pubsub_topic.topic[0]: Creating...
       module.example.module.pubsub.google_pubsub_topic.topic[0]: Creation complete after 3s [id=projects/ci-int-pubsub-a2b8/topics/cft-tf-pubsub-topic]
       module.example.module.pubsub.google_pubsub_subscription.push_subscriptions[0]: Creating...
       module.example.module.pubsub.google_pubsub_topic_iam_binding.push_topic_binding[0]: Creating...
       module.example.module.pubsub.google_pubsub_subscription.pull_subscriptions[0]: Creating...
       module.example.module.pubsub.google_pubsub_topic_iam_binding.pull_topic_binding[0]: Creating...
       module.example.module.pubsub.google_pubsub_subscription.pull_subscriptions[0]: Creation complete after 6s [id=projects/ci-int-pubsub-a2b8/subscriptions/pull]
       module.example.module.pubsub.google_pubsub_subscription_iam_binding.pull_subscription_binding[0]: Creating...
       module.example.module.pubsub.google_pubsub_subscription.push_subscriptions[0]: Creation complete after 6s [id=projects/ci-int-pubsub-a2b8/subscriptions/push]
       module.example.module.pubsub.google_pubsub_subscription_iam_binding.push_subscription_binding[0]: Creating...
       module.example.module.pubsub.google_pubsub_topic_iam_binding.push_topic_binding[0]: Creation complete after 7s [id=projects/ci-int-pubsub-a2b8/topics/cft-tf-pubsub-topic/roles/pubsub.publisher]
       module.example.module.pubsub.google_pubsub_topic_iam_binding.pull_topic_binding[0]: Still creating... [10s elapsed]
       module.example.module.pubsub.google_pubsub_subscription_iam_binding.pull_subscription_binding[0]: Creation complete after 7s [id=projects/ci-int-pubsub-a2b8/subscriptions/pull/roles/pubsub.subscriber]
       module.example.module.pubsub.google_pubsub_topic_iam_binding.pull_topic_binding[0]: Creation complete after 14s [id=projects/ci-int-pubsub-a2b8/topics/cft-tf-pubsub-topic/roles/pubsub.publisher]
       module.example.module.pubsub.google_pubsub_subscription_iam_binding.push_subscription_binding[0]: Creation complete after 8s [id=projects/ci-int-pubsub-a2b8/subscriptions/push/roles/pubsub.subscriber]

       Apply complete! Resources: 7 added, 0 changed, 0 destroyed.

       Outputs:

       project_id = ci-int-pubsub-a2b8
       topic_labels = {
         "bar_label" = "bar_value"
         "foo_label" = "foo_value"
       }
       topic_name = cft-tf-pubsub-topic
       Finished converging <pubsub-local> (0m22.66s).

I ran your tests locally - it works. The only thing I changed manually in the console for project ci-int-pubsub-a2b8 - added Pub/Sub Admin role to the ci-int-test-22d6@ci-int-pubsub-a2b8.iam.gserviceaccount.com instead of Editor otherwise I was getting User not authorized to perform this action., forbidden

Only roles/pubsub.admin or roles/owner have needed permissions:

pubsub.subscriptions.getIamPolicy 
pubsub.subscriptions.setIamPolicy
pubsub.topics.getIamPolicy
pubsub.topics.setIamPolicy 

https://cloud.google.com/pubsub/docs/access-control#roles

[morgante]

@akovtun-extenda You can update the roles uses for tests here: https://github.com/terraform-google-modules/terraform-google-pubsub/blob/master/test/setup/iam.tf#L18

[anakovt]

@morgante Role is updated, could you please review again.