feat: update federated web identify to support multiple gsa ids (#85)

Signed-off-by: lili <[email protected]>

modules/aws/README.md

@@ -1539,7 +1539,8 @@ No modules.
 | <a name="input_sn_policy_version"></a> [sn\_policy\_version](#input\_sn\_policy\_version) | The value of SNVersion tag | `string` | `"3.11.1"` | no |
 | <a name="input_source_identities"></a> [source\_identities](#input\_source\_identities) | Place an additional constraint on source identity, disabled by default and only to be used if specified by StreamNative | `list(any)` | `[]` | no |
 | <a name="input_source_identity_test"></a> [source\_identity\_test](#input\_source\_identity\_test) | The test to use for source identity | `string` | `"ForAnyValue:StringLike"` | no |
-| <a name="input_streamnative_google_account_id"></a> [streamnative\_google\_account\_id](#input\_streamnative\_google\_account\_id) | The Google Cloud service account ID used by StreamNative for Control Plane operations | `string` | `"108050666045451143798"` | no |
+| <a name="input_streamnative_google_account_id"></a> [streamnative\_google\_account\_id](#input\_streamnative\_google\_account\_id) | (**Deprecated**, use `streamnative_google_account_ids` instead) The Google Cloud service account IDs used by StreamNative for Control Plane operations | `string` | `"108050666045451143798"` | no |
+| <a name="input_streamnative_google_account_ids"></a> [streamnative\_google\_account\_ids](#input\_streamnative\_google\_account\_ids) | The Google Cloud service account IDs used by StreamNative for Control Plane operations | `list(string)` | `["108050666045451143798"]` | no |
 | <a name="input_streamnative_principal_ids"></a> [streamnative\_principal\_ids](#input\_streamnative\_principal\_ids) | When set, this applies an additional check for certain StreamNative principals to futher restrict access to which services / users can access an account. | `list(string)` | `[]` | no |
 | <a name="input_streamnative_support_access_role_arns"></a> [streamnative\_support\_access\_role\_arns](#input\_streamnative\_support\_access\_role\_arns) | A list ARNs provided by StreamNative that enable streamnative support engineers access the StreamNativeCloudBootstrapRole. This is used only in some initial provisioning and in case of on-call support. | `list(string)` | <pre>[<br>  "arn:aws:iam::311022431024:role/cloud-support-general"<br>]</pre> | no |
 | <a name="input_streamnative_vendor_access_role_arns"></a> [streamnative\_vendor\_access\_role\_arns](#input\_streamnative\_vendor\_access\_role\_arns) | A list ARNs provided by StreamNative that enable us to work with the Vendor Access Roles created by this module (StreamNativeCloudBootstrapRole, StreamNativeCloudManagementRole). This is how StreamNative is granted access into your AWS account, and should typically be the default value unless directed otherwise. This arns are used *only* for automations. | `list(string)` | <pre>[<br>  "arn:aws:iam::311022431024:role/cloud-manager"<br>]</pre> | no |

modules/aws/main.tf

@@ -110,7 +110,7 @@ data "aws_iam_policy_document" "streamnative_bootstrap_access" {
     }
     condition {
       test     = "StringEquals"
-      values   = [var.streamnative_google_account_id]
+      values   = var.streamnative_google_account_id != "" ? [var.streamnative_google_account_id] : var.streamnative_google_account_ids
       variable = "accounts.google.com:aud"
     }
   }
@@ -149,7 +149,7 @@ data "aws_iam_policy_document" "streamnative_management_access" {
     }
     condition {
       test     = "StringEquals"
-      values   = [var.streamnative_google_account_id]
+      values   = var.streamnative_google_account_id != "" ? [var.streamnative_google_account_id] : var.streamnative_google_account_ids
       variable = "accounts.google.com:aud"
     }
   }

modules/aws/variables.tf

@@ -88,10 +88,16 @@ variable "source_identity_test" {
 
 variable "streamnative_google_account_id" {
   default     = "108050666045451143798"
-  description = "The Google Cloud service account ID used by StreamNative for Control Plane operations"
+  description = "(Deprecated, use streamnative_google_account_ids instead) The Google Cloud service account ID used by StreamNative for Control Plane operations"
   type        = string
 }
 
+variable "streamnative_google_account_ids" {
+  default     = ["108050666045451143798"]
+  description = "The Google Cloud service account IDs used by StreamNative for Control Plane operations"
+  type        = list(string)
+}
+
 variable "streamnative_vendor_access_role_arns" {
   default     = ["arn:aws:iam::311022431024:role/cloud-manager"]
   description = "A list ARNs provided by StreamNative that enable us to work with the Vendor Access Roles created by this module (StreamNativeCloudBootstrapRole, StreamNativeCloudManagementRole). This is how StreamNative is granted access into your AWS account, and should typically be the default value unless directed otherwise. This arns are used *only* for automations."