add cloudProfiler role to rekor-sa (#779)

Signed-off-by: Bob Callaway <[email protected]>
sigstore · Oct 10, 2023 · 3d39042 · 3d39042
1 parent c004f08
commit 3d39042
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/terraform/gcp/modules/rekor/service_accounts.tf b/terraform/gcp/modules/rekor/service_accounts.tf
@@ -41,3 +41,10 @@ resource "google_project_iam_member" "rekor_kms_member" {
   member     = "serviceAccount:${google_service_account.rekor-sa.email}"
   depends_on = [google_service_account.rekor-sa]
 }
+
+resource "google_project_iam_member" "rekor_profiler_agent" {
+  project    = var.project_id
+  role       = "roles/cloudprofiler.agent"
+  member     = "serviceAccount:${google_service_account.rekor-sa.email}"
+  depends_on = [google_service_account.rekor-sa]
+}