fast-arm-63150
10/27/2021, 11:51 AMprehistoric-activity-61023
10/27/2021, 11:52 AM# create service account
svc_account = gcp.serviceaccount.Account(
f"sa-{svc_account_spec.account_id}",
account_id=svc_account_spec.account_id,
display_name=svc_account_spec.display_name,
project=project.project_id,
opts=pulumi.ResourceOptions(parent=project),
)
# assign project roles
for role in svc_account_spec.project_roles:
gcp.projects.IAMMember(
f"sa-{svc_account_spec.account_id}-{simple_role_name(role)}",
member=pulumi.Output.concat("serviceAccount:", svc_account.email),
project=project.project_id,
role=role,
opts=pulumi.ResourceOptions(parent=svc_account),
)
fast-arm-63150
10/27/2021, 11:55 AMprehistoric-activity-61023
10/27/2021, 11:56 AMrole
in gcp.projects.IAMMember
is a string with roles/
prefix, e.g. roles/storage.admin
simple_role_name
is just my util function:
def simple_role_name(role: str) -> str:
"""
Create a simplified role name that can be used as a part of resource name.
Example: "roles/logging.logWriter" becomes "logging-logwriter"
"""
return role.replace("roles/", "").replace(".", "-").lower()
fast-arm-63150
10/27/2021, 11:59 AMprehistoric-activity-61023
10/27/2021, 12:16 PMclass ServiceAccount(BaseModel):
account_id: str
display_name: Optional[str]
project_roles: List[str] = []
create_key: bool = False