From bdf1df7f9a34d614ddfd2a1eb91d11406b69d3c2 Mon Sep 17 00:00:00 2001
From: Li Li <urfree@apache.org>
Date: Wed, 3 Jul 2024 07:54:21 +0800
Subject: [PATCH] feat: update federated web identify to support multiple gsa
 ids (#85)

Signed-off-by: lili <lli@streamnative.io>
---
 modules/aws/README.md    | 3 ++-
 modules/aws/main.tf      | 4 ++--
 modules/aws/variables.tf | 8 +++++++-
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/modules/aws/README.md b/modules/aws/README.md
index 7fe0c10..ed7a941 100644
--- a/modules/aws/README.md
+++ b/modules/aws/README.md
@@ -1539,7 +1539,8 @@ No modules.
 | <a name="input_sn_policy_version"></a> [sn\_policy\_version](#input\_sn\_policy\_version) | The value of SNVersion tag | `string` | `"3.11.1"` | no |
 | <a name="input_source_identities"></a> [source\_identities](#input\_source\_identities) | Place an additional constraint on source identity, disabled by default and only to be used if specified by StreamNative | `list(any)` | `[]` | no |
 | <a name="input_source_identity_test"></a> [source\_identity\_test](#input\_source\_identity\_test) | The test to use for source identity | `string` | `"ForAnyValue:StringLike"` | no |
-| <a name="input_streamnative_google_account_id"></a> [streamnative\_google\_account\_id](#input\_streamnative\_google\_account\_id) | The Google Cloud service account ID used by StreamNative for Control Plane operations | `string` | `"108050666045451143798"` | no |
+| <a name="input_streamnative_google_account_id"></a> [streamnative\_google\_account\_id](#input\_streamnative\_google\_account\_id) | (**Deprecated**, use `streamnative_google_account_ids` instead) The Google Cloud service account IDs used by StreamNative for Control Plane operations | `string` | `"108050666045451143798"` | no |
+| <a name="input_streamnative_google_account_ids"></a> [streamnative\_google\_account\_ids](#input\_streamnative\_google\_account\_ids) | The Google Cloud service account IDs used by StreamNative for Control Plane operations | `list(string)` | `["108050666045451143798"]` | no |
 | <a name="input_streamnative_principal_ids"></a> [streamnative\_principal\_ids](#input\_streamnative\_principal\_ids) | When set, this applies an additional check for certain StreamNative principals to futher restrict access to which services / users can access an account. | `list(string)` | `[]` | no |
 | <a name="input_streamnative_support_access_role_arns"></a> [streamnative\_support\_access\_role\_arns](#input\_streamnative\_support\_access\_role\_arns) | A list ARNs provided by StreamNative that enable streamnative support engineers access the StreamNativeCloudBootstrapRole. This is used only in some initial provisioning and in case of on-call support. | `list(string)` | <pre>[<br>  "arn:aws:iam::311022431024:role/cloud-support-general"<br>]</pre> | no |
 | <a name="input_streamnative_vendor_access_role_arns"></a> [streamnative\_vendor\_access\_role\_arns](#input\_streamnative\_vendor\_access\_role\_arns) | A list ARNs provided by StreamNative that enable us to work with the Vendor Access Roles created by this module (StreamNativeCloudBootstrapRole, StreamNativeCloudManagementRole). This is how StreamNative is granted access into your AWS account, and should typically be the default value unless directed otherwise. This arns are used *only* for automations. | `list(string)` | <pre>[<br>  "arn:aws:iam::311022431024:role/cloud-manager"<br>]</pre> | no |
diff --git a/modules/aws/main.tf b/modules/aws/main.tf
index 5c4ce9e..87fb3db 100644
--- a/modules/aws/main.tf
+++ b/modules/aws/main.tf
@@ -110,7 +110,7 @@ data "aws_iam_policy_document" "streamnative_bootstrap_access" {
     }
     condition {
       test     = "StringEquals"
-      values   = [var.streamnative_google_account_id]
+      values   = var.streamnative_google_account_id != "" ? [var.streamnative_google_account_id] : var.streamnative_google_account_ids
       variable = "accounts.google.com:aud"
     }
   }
@@ -149,7 +149,7 @@ data "aws_iam_policy_document" "streamnative_management_access" {
     }
     condition {
       test     = "StringEquals"
-      values   = [var.streamnative_google_account_id]
+      values   = var.streamnative_google_account_id != "" ? [var.streamnative_google_account_id] : var.streamnative_google_account_ids
       variable = "accounts.google.com:aud"
     }
   }
diff --git a/modules/aws/variables.tf b/modules/aws/variables.tf
index 2cec63f..6b7155d 100644
--- a/modules/aws/variables.tf
+++ b/modules/aws/variables.tf
@@ -88,10 +88,16 @@ variable "source_identity_test" {
 
 variable "streamnative_google_account_id" {
   default     = "108050666045451143798"
-  description = "The Google Cloud service account ID used by StreamNative for Control Plane operations"
+  description = "(Deprecated, use streamnative_google_account_ids instead) The Google Cloud service account ID used by StreamNative for Control Plane operations"
   type        = string
 }
 
+variable "streamnative_google_account_ids" {
+  default     = ["108050666045451143798"]
+  description = "The Google Cloud service account IDs used by StreamNative for Control Plane operations"
+  type        = list(string)
+}
+
 variable "streamnative_vendor_access_role_arns" {
   default     = ["arn:aws:iam::311022431024:role/cloud-manager"]
   description = "A list ARNs provided by StreamNative that enable us to work with the Vendor Access Roles created by this module (StreamNativeCloudBootstrapRole, StreamNativeCloudManagementRole). This is how StreamNative is granted access into your AWS account, and should typically be the default value unless directed otherwise. This arns are used *only* for automations."