TokenCreator not User

SchmidtDSE · Dec 31, 2023 · 32d3e37 · 32d3e37
1 parent 7ae0032
commit 32d3e37
Show file tree

Hide file tree

Showing 3 changed files with 33 additions and 9 deletions.
diff --git a/main.tf b/main.tf
@@ -115,7 +115,7 @@ resource "google_project_iam_member" "cloudbuild_builder" {
 
 resource "google_project_iam_member" "SA_get_access_token" {
   project  = "dse-nps"
-  role    = "roles/iam.serviceAccountUser"
+  role    = "roles/iam.serviceAccountTokenCreator"
   member   = "serviceAccount:${google_service_account.default.email}"
 }
 

diff --git a/terraform.tfstate b/terraform.tfstate
@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "1.6.0",
-  "serial": 64,
+  "serial": 67,
   "lineage": "44075ebe-b91a-1e72-3b17-affdfb63c0f1",
   "outputs": {},
   "resources": [
@@ -316,18 +316,18 @@
     {
       "mode": "managed",
       "type": "google_project_iam_member",
-      "name": "SA_getAccessToken",
+      "name": "SA_get_access_token",
       "provider": "provider[\"registry.opentofu.org/hashicorp/google\"]",
       "instances": [
         {
           "schema_version": 0,
           "attributes": {
             "condition": [],
-            "etag": "BwYNxR9UGJw=",
-            "id": "dse-nps/roles/iam.serviceAccountUser/serviceAccount:[email protected]",
+            "etag": "BwYNxTEeIYM=",
+            "id": "dse-nps/roles/iam.serviceAccountTokenCreator/serviceAccount:[email protected]",
             "member": "serviceAccount:[email protected]",
             "project": "dse-nps",
-            "role": "roles/iam.serviceAccountUser"
+            "role": "roles/iam.serviceAccountTokenCreator"
           },
           "sensitive_attributes": [],
           "private": "bnVsbA==",
@@ -347,7 +347,7 @@
           "schema_version": 0,
           "attributes": {
             "condition": [],
-            "etag": "BwYMkHdJFvc=",
+            "etag": "BwYNxR9UGJw=",
             "id": "dse-nps/roles/cloudbuild.builds.builder/serviceAccount:[email protected]",
             "member": "serviceAccount:[email protected]",
             "project": "dse-nps",
@@ -371,7 +371,7 @@
           "schema_version": 0,
           "attributes": {
             "condition": [],
-            "etag": "BwYMkHdJFvc=",
+            "etag": "BwYNxR9UGJw=",
             "id": "dse-nps/roles/run.admin/serviceAccount:[email protected]",
             "member": "serviceAccount:[email protected]",
             "project": "dse-nps",

diff --git a/terraform.tfstate.backup b/terraform.tfstate.backup
@@ -1,7 +1,7 @@
 {
   "version": 4,
   "terraform_version": "1.6.0",
-  "serial": 62,
+  "serial": 64,
   "lineage": "44075ebe-b91a-1e72-3b17-affdfb63c0f1",
   "outputs": {},
   "resources": [
@@ -313,6 +313,30 @@
         }
       ]
     },
+    {
+      "mode": "managed",
+      "type": "google_project_iam_member",
+      "name": "SA_getAccessToken",
+      "provider": "provider[\"registry.opentofu.org/hashicorp/google\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "condition": [],
+            "etag": "BwYNxR9UGJw=",
+            "id": "dse-nps/roles/iam.serviceAccountUser/serviceAccount:[email protected]",
+            "member": "serviceAccount:[email protected]",
+            "project": "dse-nps",
+            "role": "roles/iam.serviceAccountUser"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA==",
+          "dependencies": [
+            "google_service_account.default"
+          ]
+        }
+      ]
+    },
     {
       "mode": "managed",
       "type": "google_project_iam_member",