Grant TUF SA access to modify storage objects (#947)

Needed to use the TUF SA on GitHub Actions workflows.

Signed-off-by: Hayden Blauzvern <[email protected]>

terraform/gcp/modules/tuf/tuf.tf

@@ -74,6 +74,14 @@ resource "google_storage_bucket_iam_member" "public_tuf_member" {
   depends_on = [google_storage_bucket.tuf]
 }
 
+resource "google_storage_bucket_iam_member" "tuf_sa_editor" {
+  bucket = google_storage_bucket.tuf.name
+  role   = "roles/storage.objectUser"
+  member = format("serviceAccount:%s@%s.iam.gserviceaccount.com", var.tuf_service_account_name, var.project_id)
+
+  depends_on = [google_storage_bucket.tuf, google_service_account.tuf-sa]
+}
+
 resource "google_storage_bucket" "tuf_preprod" {
   name     = var.tuf_preprod_bucket
   location = var.region
@@ -119,3 +127,11 @@ resource "google_storage_bucket_iam_member" "public_tuf_preprod_member" {
 
   depends_on = [google_storage_bucket.tuf_preprod]
 }
+
+resource "google_storage_bucket_iam_member" "tuf_sa_preprod_editor" {
+  bucket = google_storage_bucket.tuf_preprod.name
+  role   = "roles/storage.objectUser"
+  member = format("serviceAccount:%s@%s.iam.gserviceaccount.com", var.tuf_service_account_name, var.project_id)
+
+  depends_on = [google_storage_bucket.tuf_preprod, google_service_account.tuf-sa]
+}