google-cloud-platform - 想要通过 terraform 将多个 Google Cloud IAM 角色分配给服务帐户

Question

我想通过 terraform 将多个 IAM 角色分配给单个服务帐户。我准备了一个 TF 文件来执行此操作，但它有一个错误。使用单个角色可以成功分配，但使用多个 IAM 角色时会出错。

data "google_iam_policy" "auth1" {
  binding {
    role = "roles/cloudsql.admin"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]    
    role = "roles/secretmanager.secretAccessor"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]      
    role = "roles/datastore.owner"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]  
    role = "roles/storage.admin"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]      
  }
}

如何为单个服务帐户分配多个角色？

Answer 1

根据documentation

Each document configuration must have one or more binding blocks, which each accept the following arguments: ....

你必须重复绑定(bind)，像这样

data "google_iam_policy" "auth1" {
  binding {
    role = "roles/cloudsql.admin"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]
  }
  binding {
    role = "roles/secretmanager.secretAccessor"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]
  }
  binding {
    role = "roles/datastore.owner"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]
  }
  binding {
    role = "roles/storage.admin"
    members = [
      "serviceAccount:${google_service_account.service_account_1.email}",
    ]
  }
}

使用 gcloud 命令也是如此，您一次只能在电子邮件列表中添加 1 个角色。